McAfee Data Loss Prevention 9.2.2 Product Guide

4Using McAfee DLP DiscoverRemediating incidentsRemediating incidentsMcAfee DLP Discover protects data by finding and displaying sensitive data. Remedial actions can bepre‐programmed to resolve any problems found.When a violation is found, you can use a Data‐at‐Rest action rule to prevent or resolve the problem.Use the Remediation button on the Incident Details page to resolve incidents as their components arereviewed.Remediation is part of the incident workflow, and any time incidents are wiped from the system,remediated files will also be wiped.When violations are found in Data‐at‐Rest, the remediation feature might be used to do the following:• Copy files containing violations to another location on the network• Move files containing violations to another location on the network• Password‐protect files containing violations• Delete files containing violationsEach of these actions also includes the capability to do the following:• Notify users of violations found in scanned data• Record violations found in scanned data in a system log• Assign incidents to one or more reviewers• Set a status that indicates the state of resolutionRemediation can be applied directly to incidents reported on the Data‐at‐Rest dashboard, orpre‐programmed by attaching an action rule to rules that produce incidents.Types of remedial actionRemedial actions can be set up to copy, move, encrypt and delete incidents found in Data‐at‐Rest.Incidents found by a Discover scan might be processed using one of four remedial actions.• Copy the file to another location• Move the file to another location• Encrypt the file• Delete the fileEach action can be configured to automatically notify users that a remedial action has been applied toa violation found in Data‐at‐Rest.Each action can also be configured to place a record in a system log, assign the incident to one ormore reviewers, or apply a status that indicates its stage of resolution.Compliance with FIPS standardsWith this release, best practices for implementing cryptographic algorithms, which handle key materialand data buffers, are supported by compliance with FIPS standards.The Federal Information Processing Standard (FIPS 140‐1) and its successor (FIPS 140‐2) are U.S.government standards that provide a benchmark for implementing cryptographic software. Algorithmsused for encryption, hashing, and signing are enabled to secure the McAfee DLP Discover remediationprocesses.114 McAfee Data Loss Prevention 9.2.2 Product Guide