Data Loss Prevention

Dear all experts,

I try to filter contents of files or IMs that are sending through Microsoft skype, Teamviewer, Apple itune. However, DLP agent can not capture any things. Does anyone have good ideas for these problems? Can you help me to sort out these matters?

Thank you very much in advance :)

In order to get those kinds of apps you can use applicaiton file access control (AFAC) and cut off the access to file reads. The aps are not in by default but you can add any applicaiton you want into the applicaiton file access area within the DLP console which will enable the agent to block these areas.

Hi,

As I understand your instruction, the following options are chosen:

Application Monitoring==>Application Mornitoring Configuration ==>Filesystem Activity==>Monitor Application File Access==>Monitor all files that application attempts to==>File Open

Is it right?

I applied these configurations to Skype, iTunes, Teamviewer but our users can copy .xlsx from local hard disk drive to their iPhones or they can send files via Teamviewer without any incident messages

I still get stuck with these problems.

Anyway, thank you very much.

You would also need to enable Application File Monitoring within the endpoint configuration to enable the Applicaiton monitoring on the endpoints themselves. It is a two step process. As for the copy from the local drive to the iPhone that would be covered under the configuration as removable media. Once both of those config changes are in place you should be getting incidents within the console and you can add the block response rule to stop these types of incidents from occuring.

Hi John Gruhn,

Can you show me further details of this instruction "You would also need to enable Application File Monitoring within the endpoint configuration to enable the Applicaiton monitoring on the endpoints themselves"? I don't know where I can enable Application File Monitoring. Can you give me the path of this option or a picture of it?

Thanks a lot.

To change the configuraiton you would go to System -> Agent Configuration and then open the configuration you wanted to change. On the agent monitoring tab you would check each vector you would want to monitor. Once every vector is selected that you want you would then click "Save and Update". This will take you to a screen asking where the configuration will apply. Once updated from that screen all furture events should start triggering.

Hi,

You're right. The path is ...Agent Monitoring==>Enable Monitoring==>Applications==>Application File Access.

Thank you for you help.