McAfee Data Loss Prevention 9.2.2 Product Guide

Integrating McAfee DLP EndpointTagging and tracking 5available for use in a unified rule. Once Photoshop files are defined as significant objects andsupplemented with other parameters, they can be detected and tagged when the unified rule is run,and an appropriate action might be taken at that time.Strategies for categorizing applicationsMcAfee DLP Endpoint software divides applications into four categories or strategies.A strategy is assigned to each application definition. You can change the strategy to achieve a balancebetween security and the computer’s operating efficiency. The strategies, in order of decreasingsecurity, are:• Editor — Any application that can modify file content. This includes “classic” editors like MicrosoftWord and Microsoft Excel, as well as browsers, graphics software, accounting software, and soforth. Most applications are editors.• Explorer — An application that copies or moves files without changing them, such as MicrosoftWindows Explorer or certain shell applications.• Trusted — An application that needs unrestricted access to files for scanning purposes. Examplesare McAfee ® VirusScan ®Enterprise, backup software, and desktop search software (Google,Copernic, and so forth).• Archiver — An application that reprocesses files. Examples are compression software such asWinZip, and encryption applications such as McAfee ® Endpoint Encryption for Files and Folderssoftware or PGP.Change the strategy as necessary to optimize performance. For example, the high level of observationthat an editor application receives is not consistent with the constant indexing of a desktop searchapplication. The performance penalty is high, and the risk of a data leak from such an application islow. Therefore, you should use the trusted strategy with these applications.Add a file extension parameterFile extensions can be defined along with other endpoint parameters to control applications by type.Before you beginCheck to see if the file extension parameter already exists on the Endpoint file extensionpop‐up menu. If not, you can add it by entering it in the Original Executable File Name pop‐upmenu on the Create Application Definition page, which will add it to the Enterprise Application List. Theadded file type can then be selected from the Application Definition pop‐up menu.Suppose you want to implement role‐based access on a Windows network engineering share. Youmight have developers who have full access, users who are allowed to manage the contents of thesite, and users who have special skills that are needed on specific document types.For example, a group of technical illustrators might need access to the Adobe Photoshop andIllustrator files on that share. You could create a rule that would allow only those users access to thosefiles.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.2 Click a policy and a rule, or create new ones.Make sure the policy is active and the Inherit Policy State state of the rule is set to Enabled.McAfee Data Loss Prevention 9.2.2 Product Guide 151