Data Loss Prevention

Hello everyone,

I am having problems when copying files on network and devices like USB, in specific if the files are compressed.

I have noticed that in the path C: \Program Files\Manufacturer\temp\ is created as a copy of the files that we are going to copy which analyzes first, there would be a way to skip this procedure and start copying because if want to copy a 4 GB file this takes really a lot.

As a data I only have the DLP agent installed on each version 14.5 device and I use Kasperky as an antivirus.

If someone can help me I would appreciate it very much.

regards

Hello,

Are you saying that a similar copy with other DLP version would be faster?

You should bear in mind that if the document you want to copy is compressed the DLP agent will need to decompress before analyze it against the deplpoyed DLP policies, therefore will take longer than copy a file that is not compressed.

These potential impacts in copy to external storage device are a given / accepted behavior by implementing DLP solution.

BR,

Morgado

I had a similar issue with transferring content to USB.  According to support, as files are copied DLP will make copies in a temp directory.  If I remember correctly, all of the analysis is performed here.  Like Morgado mentioned, DLP agent will process text files, Word documents, spreadsheets, etc pretty easily.  When it encounters a compressed file, it will extract everything and analyze prior to copying content to the final destination.

I would recommend reviewing your Advanced Agent Configuration settings, as that's where we saw a quick turn around.  I have had to update my agent configuration to disable/update a few attributes, such as: FileSystem.ENABLE_FILE_RESTORATION.int, FileSystem.ENABLE_VEP_FILE_ELIMINATION, FileSystem.DRIVER_OPEN_REQUEST_TIMEOUT.int, and IncidentHandler.MAX_INCIDENT_FILE_SIZE.int. 

You have the option of ingoring file types, but that wasn't our ideal soluiton.  DLP cannot handle some file types - I don't recall what they are.  I'm not sure if DLP will just idle on them until the timeout has been reached or if it immediately goes to analyze the next file in the queue.

Thanks,
Sash

Also you may want to make sure that you EXCLUDE the EDPA and WPD processes from your Anti-Virus. (Or all of the Agent install directory) This can add to the workload.