Data Loss Prevention

Hello,

We currently have a range of incidents that are being blocked where we would would like the ability to release a blocked incident in certain situations.

Does the Symantec DLP 14.6 solution provide the ability to release incidents which have been blocked by policy in the tool? If so, is this easy to implement?

Many thanks,

AJ

hi,

 You could not released "blocked" incident. If you want to manage a release there is two ways to do it :

- good one : dont block but quarantine message. DLp itself is not able to do this, so DLP will just add a header to mail that has to be quarantined and you need to setup a gateway to manage quarantine after DLP servers. If you use SMG (symantec gateway) there is some existing plugin which allow you to release message based on incident assessment (incident coul dbe reviewed in DLP console and then release by person who review it).

- "bad" one (at least it is a workaround if you do not have a gateway to manage quarantine) : use a specific code to bypass policy and add it as an exception in your policy. So if someone want to release message he will have to request the code and resend same email adding code in it.

 Regards

AJ,

As Stephan mentioned, the best way is to Quarantine the Email and then use your MTA to hold the email for an X number of days (Configurable in most MTA's). Once quarantined the email will need to be released and sent, based on someones approval.

SYMC Mail gateway has the integration done seamlessly, so the release aspect works through the DLP console. In order to do this with a different MTA, it would require someone to log into the MTA's console and manually release it OR build a custom Flex Response API that you can call from the DLP console. (I know that ProofPoint is building (about to release) an API process so someone can build this)

Hope this helps..

Good Luck,

Ronak

PLEASE MARKED SOLVED WHEN POSSIBLE.

Hi both,

Thank you for the guidance, we are currently exploring the Quarantine option through MTA.

Can mark this as resolved