McAfee Data Loss Prevention 9.2.2 Product Guide

Integrating McAfee DLP EndpointTypical scenarios 5Keep data from being copied to removable mediaMcAfee DLP Endpoint can be configured to block, monitor, notify, or allow read‐only access toremovable media. You can combine a Protect Removable Media rule with other rule parameters to keepdefined data from being copied to one of these devices.Data that is available through top secret governmental networks relies on the scruples of its users.Using a removable media ensures that secret information cannot be copied and distributed tounauthorized users or organizations.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a policy and a rule, or create new ones.Make sure the policy is active and the Inherit Policy State state of the rule is set to Enabled.3 On the Add Rule or Edit Rule page, select Keyword from the Content menu and enter an identifying wordor phrase into the value field (for example, Confidential or Top Secret).If you know the document type, you might want to add another element (for example, Content Type isany of MS Word) to identify the content type.4 From the Endpoint menu, select Protect Removable Media, click ?, select the Enable checkbox, and clickApply.5 Click the Actions tab and click Add Action, then select Removable Media Reaction from the Data‐in‐Use menu.6 Review the reaction settings in the Actions column.If they do not match your objectives, go to Actions Rules and edit the rule, or create a new one.You must select at least one Online or Offline checkbox when you select any action.7 Click Save.Keep data from being cut and pastedMcAfee DLP Endpoint can be configured to disable clipboard functionality, making it impossible forusers to cut or paste data between existing and new documents.Trusted processes are not part of the clipboard rule logic. Applications with a Trusted strategy are notexempt from screen capture rules, and will be blocked like any other application.For example, if you want to ensure that the contents of financial documents cannot be cut and pastedinto new documents, use the Banking and Financial Sector with the Protect Clipboard rule to protectthose documents.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a policy and a rule, or create new ones.Make sure the policy is active and the Inherit Policy State state of the rule is set to Enabled.McAfee Data Loss Prevention 9.2.2 Product Guide 131