McAfee Data Loss Prevention 9.2.2 Product Guide

More documents

Recommendations

Info

5Integrating McAfee DLP EndpointControlling devices2 In the navigation pane under Device Management, select Device Rules.The available device management rules appear in the right pane.3 In the Plug and Play Device Rule section, select Add New from the Actions menu.The Add Plug and Play Device Rule window appears.You can use the Plug and Play device blocking rule to block USB devices, but McAfee recommendsusing the removable storage device blocking rule instead. Using the Plug and Play device blockingrule can result in blocking the entire USB hub/controller. The removable storage device blocking ruleallows the device to initialize and register with the operating system. It also allows you to define thedevice as read‐only.4 Type in a name and optional description.5 From the State menu, select Active to activate the rule.6 From the Device Definitions menu, select device and device group definitions to be added to orexcluded from the rule. The Exclude option is used to whitelist devices that should not be controlled.7 From the Actions menu, select the checkboxes of actions that are to be executed when the rule hits.Each action can be set to execute if the user is on or off the premises, or both.Select the Block checkbox if the device is to be blocked when the user is on‐ or offsite, or both.Select the Monitor checkbox if the device is to be monitored when the user is on‐ or offsite, or both.If either is selected, select a checkbox that indicates the Severity of the violation.Select the Notify User checkbox if an alert is to be sent when users who are on‐ or offsite, or both,trigger the Block or Monitor actions.8 Set a User Assignment condition if an alert is to be sent to users when the device is used on‐ or offsite.Users can be identified positively or negatively by name or affiliation, and they can be retrievedfrom an LDAP server.Click + to add multiple user assignments.9 Click Save.Device parametersDevice parameters are used to build device definitions, which are incorporated into device rules thatsecure sensitive data at endpoints.The following table provides definitions for all parameters used in device definitions.Device parameters cannot be imported in the McAfee DLP Manager implementation of McAfee DLPEndpoint.Table 5-2 Device definitions for plug and Play and removable storage devicesParameternameFoundin...DescriptionBus Type Both Selects the device BUS type from the available list (IDE, PCI, and soforth.)CD/DVD Drives RS only A generic category for any CD or DVD drive.168 McAfee Data Loss Prevention 9.2.2 Product Guide
Integrating McAfee DLP EndpointControlling devices 5Table 5-2 Device definitions for plug and Play and removable storage devices (continued)ParameternameContentencrypted byMcAfee EndpointEncryption forFiles and FoldersFoundin...RS onlyDescriptionSelect to indicate a device protected with McAfee Endpoint Encryptionfor Files and Folders.Device Class PnP only Selects the device class from the available managed list.DeviceCompatible IDsDevice InstanceID (MicrosoftWindows XP;MicrosoftWindows 2000)Device InstancePath (MicrosoftWindows Vista;MicrosoftWindows 7)BothBothA list of physical device descriptions. Effective especially with devicetypes other than USB and PCI, which are more easily identified usingPCI VendorID/DeviceID or USB PID/VID.A Windows‐generated string that uniquely identifies the device in thesystem. For example, USB\VID_0930&PID_6533\5&26450FC&0&6.Device Name Both The name attached to a hardware device, representing its physicaladdress.File System Type RS only The type of file system, for example NTSF, FAT32, and so forth.File SystemAccessFile SystemVolume LabelFile SystemVolume SerialNumberPCI VendorID /DeviceIDRS onlyRS onlyRS onlyBothThe access to the file system: read only or read‐write.The user‐defined volume label, viewable in Windows Explorer. Partialmatching is allowed.A 32‐bit number generated automatically when a file system is createdon the device. It can be viewed by running the command linecommand dir x:, where x: is the drive letter.The PCI VendorID and DeviceID are embedded in the PCI device.These parameters can be obtained from the Hardware ID string ofphysical devices, for example, PCI\VEN_8086&DEV_2580&SUBSYS_00000000&REV_04.USB Class Code PnP only Identifies a physical USB device by its general function. Select theclass code from the available list.USB Device SerialNumberUSB Vendor ID /Product IDBothBothA unique alphanumeric string assigned by the USB devicemanufacturer, typically for removable storage devices. The serialnumber is the last part of the instance ID; for example, USB\VID_3538&PID_0042\00000000002CD8.A valid serial number musthave a minimum of 5 alphanumeric characters and must not containampersands (&). If the last part of the instance ID does not followthese requirements, it is not a serial number.The USB VendorID and ProductID are embedded in the USB device.These parameters can be obtained from the Hardware ID string ofphysical devices, for example: USB\Vid_3538&Pid_0042.McAfee Data Loss Prevention 9.2.2 Product Guide 169
Page 1:
Product GuideRevision AMcAfee Data
Page 6 and 7:
ContentsFind host names in data at
Page 8 and 9:
ContentsDelete views . . . . . . .
Page 10 and 11:
ContentsTypical scenarios . . . . .
Page 12 and 13:
Contents12 McAfee Data Loss Prevent
Page 14 and 15:
PrefaceFind product documentationTi
Page 16 and 17:
1McAfee DLP ManagerMcAfee DLP data
Page 18 and 19:
2Using McAfee DLP MonitorHow data i
Page 20 and 21:
2Using McAfee DLP MonitorTypical sc
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
2Using McAfee DLP MonitorSearch bas
Page 28 and 29:
2Using McAfee DLP MonitorUsing logi
Page 30 and 31:
2Using McAfee DLP MonitorSupported
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
2Using McAfee DLP MonitorRules used
Page 40 and 41:
2Using McAfee DLP MonitorFinding in
Page 42 and 43:
2Using McAfee DLP MonitorFinding in
Page 44 and 45:
2Using McAfee DLP MonitorUse concep
Page 46 and 47:
2Using McAfee DLP MonitorFind data
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
2Using McAfee DLP MonitorSearching
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
2Using McAfee DLP MonitorFinding do
Page 66 and 67:
3Managing McAfee DLP PreventHow McA
Page 68 and 69:
3Managing McAfee DLP PreventConfigu
Page 70 and 71:
3Managing McAfee DLP PreventConfigu
Page 72 and 73:
4Using McAfee DLP DiscoverTypical s
Page 74 and 75:
4Using McAfee DLP DiscoverTypical s
Page 76 and 77:
4Using McAfee DLP DiscoverRegisteri
Page 78 and 79:
4Using McAfee DLP DiscoverRegisteri
Page 80 and 81:
4Using McAfee DLP DiscoverCrawling
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
4Using McAfee DLP DiscoverOptimizin
Page 88 and 89:
4Using McAfee DLP DiscoverOptimizin
Page 90 and 91:
4Using McAfee DLP DiscoverManaging
Page 92 and 93:
Page 94 and 95:
Page 96 and 97:
Page 98 and 99:
Page 100 and 101:
Page 102 and 103:
Page 104 and 105:
4Using McAfee DLP DiscoverScan stat
Page 106 and 107:
Page 108 and 109:
4Using McAfee DLP DiscoverSearch di
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
4Using McAfee DLP DiscoverRemediati
Page 116 and 117:
4Using McAfee DLP DiscoverRemediati
Page 118 and 119: 4Using McAfee DLP DiscoverRemediati
Page 120 and 121: 4Using McAfee DLP DiscoverRemediati
Page 122 and 123: 4Using McAfee DLP DiscoverGetting s
Page 124 and 125: 4Using McAfee DLP DiscoverGetting s
Page 126 and 127: 4Using McAfee DLP DiscoverConfiguri
Page 128 and 129: 4Using McAfee DLP DiscoverConfiguri
Page 130 and 131: 5Integrating McAfee DLP EndpointTyp
Page 138 and 139: 5Integrating McAfee DLP EndpointVie
Page 140 and 141: 5Integrating McAfee DLP EndpointCon
Page 142 and 143: 5Integrating McAfee DLP EndpointUni
Page 148 and 149: 5Integrating McAfee DLP EndpointTag
Page 172 and 173: 6Managing the Home pageHow the Home
Page 174 and 175: 7Using the Incidents dashboardTypic
Page 176 and 177: 7Using the Incidents dashboardSort
Page 178 and 179: 7Using the Incidents dashboardGetti
Page 180 and 181: 7Using the Incidents dashboardGetti
Page 182 and 183: 7Using the Incidents dashboardSet u
Page 184 and 185: 7Using the Incidents dashboardGener
Page 186 and 187: 7Using the Incidents dashboardCusto
Page 188 and 189: 7Using the Incidents dashboardContr
Page 190 and 191: 8Working with casesManage case perm
Page 192 and 193: 8Working with casesAdd, delete, or
Page 194 and 195: 8Working with casesModify casesYou
Page 196 and 197: 8Working with casesCustomize cases3
Page 198 and 199: 8Working with casesCustomize cases4
Page 200 and 201: 9Managing policies and rulesHow pol
Page 202 and 203: 9Managing policies and rulesTypical
Page 204 and 205: 9Managing policies and rulesTypical
Page 206 and 207: 9Managing policies and rulesManagin
Page 208 and 209: 9Managing policies and rulesAdd, mo
Page 210 and 211: 9Managing policies and rulesAdd, mo
Page 212 and 213: 9Managing policies and rulesManage
Page 218 and 219:
9Managing policies and rulesIdentif
Page 220 and 221:
9Managing policies and rulesIdentif
Page 222 and 223:
10Managing action rulesHow McAfee D
Page 224 and 225:
10Managing action rulesAdd, modify,
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
11Managing conceptsTypical scenario
Page 234 and 235:
11Managing conceptsAdd, apply, rest
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
12Using templatesTypical scenariosT
Page 242 and 243:
12Using templatesAdd, modify, and d
Page 244 and 245:
12Using templatesAdd, modify, and d
Page 246 and 247:
13Managing McAfee DLP systemsConfig
Page 248 and 249:
13Managing McAfee DLP systemsConfig
Page 250 and 251:
13Managing McAfee DLP systemsUsing
Page 252 and 253:
Page 254 and 255:
Page 256 and 257:
Page 258 and 259:
13Managing McAfee DLP systemsAdding
Page 260 and 261:
Page 262 and 263:
Page 264 and 265:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 274 and 275:
13Managing McAfee DLP systemsManagi
Page 276 and 277:
Page 278 and 279:
Page 280 and 281:
13Managing McAfee DLP systemsTechni
Page 282 and 283:
13Managing McAfee DLP systemsTechni
Page 284 and 285:
14Disaster recovery backup and rest
Page 286 and 287:
Page 288 and 289:
Page 290 and 291:
15Technical supportCreate a technic
Page 292 and 293:
Indexdevice class (continued)status
Page 294 and 295:
Indexuser groupscreating 275deletin
show all

McAfee Data Loss Prevention 9.2.2 Product Guide

Create successful ePaper yourself

Delete template?

Save as template?