Data Loss Prevention

Would like to discuss with anyone who has implemented Symantec DLP with a web proxy AND Websense Web Filter v7 (URL filtering only).

We are currently in the middle of our DLP deployment and have discovered that Websense is not ICAP compatible so we need to install a web proxy in addition to Websense.   

Can anyone shed some insight on how to do this? 

A free web proxy that works pretty well is Squid (if you dont mind linux) and it supports ICAP. Otherwise, i'd suggest BlueCoat as the top pick.

if you are in the north east, i know a few freelance people that can help you install and set Squid up.

Well I have Websense deployed here in my office, but I'm not using DLP Network Monitor/Prevent (only Endpoint at the moment) so I'm afraid I don't have the experience you're looking for but I may be able to help out somehow =]

My suggestion would be to look into an open-source web proxy that's ICAP compliant like Squid, Shweby or Greasy Spoon. I've seen a post in the forum relating to configuring the Squid proxy to work with DLP. I figure you'd run both Websense and Net Prevent into the Squid server which would connect to your edge router.

Information about Sqiud here:
http://icap-server.sourceforge.net/squid.html
http://www.websense.com/content/support/library/data/v753/install/squid_icap.aspx

Forum post about DLP and Squid itegration
https://www-secure.symantec.com/connect/forums/network-prevent-and-squid-configuration

As I said I don't have the experience or expertise with web proxies and/or Network Prevent but hopefully the links have some helpful information.

I forgot about Blue Coat =]

Only thing is that it costs money

In any case, you can search the forums for problems related to setting up a web proxy 'cause I'm sure that some solutions are around the place.

All the best!

As far as I've been told, Symantec does not support the integration to Websense (yet).

However, Web Security Gateway 7.5 does support fully compliant ICAP, and configuration with DLP Servers is documented/supported by Websense in a document titled:

"Integrating the Content Gateway component with Third Party Data Loss Prevention Applications "



My inclination, since you're already running WebSense, is that you're better off using the ICAP integration they have, rather than trying to "get creative" with other types of proxies (i.e. Squid).