McAfee Data Loss Prevention 9.2.2 Product Guide

Using McAfee DLP MonitorTypical scenarios 2Typical scenariosTo find significant data in network traffic, use search parameters to form queries. Some typical usecases follow.Tasks• Find leaked documents on page 19Whether accidental or unintentional, confidential documents on corporate networks areoften open to discovery by unauthorized users.• Monitor sensitive files after close of business in different time zones on page 20If you are managing several McAfee DLP Monitor appliances in different time zones, youmight want to monitor data at the same local clock time in every location. For example,certain files might be allowed to enter or leave local networks during business hours — butafter 5 p.m. in any time zone, it might indicate a leak.• Find email using non-standard ports on page 20When non‐standard ports are used to transmit email, a deliberate attempt to conceal illegalactivity should be suspected.• Find evidence of frequent communications on page 21You might suspect that a particular user is communicating with an off‐site competitor. Youmight be able to identify the sources and destinations of frequent communications that willeventually reveal that leak.• Find source code leaving the network on page 22You can use the Source Code content type to find intellectual property that might be leavingthe company.• Find encrypted traffic and files on page 22Insiders attempting to conceal illegal activity or steal your intellectual property routinelyuse encryption.• Find unencrypted user data on page 23You might assume that user names and passwords are protected on your network as amatter of course, but that might not always be the case.• Find geographic users and incidents on page 23The classification engine sorts all network data into geographic locations. Find incidentsgenerated by users in other countries by defining geographic locations in your query.• Find evidence of foreign interference on page 23Protecting intellectual property can be difficult when sensitive data is so easily transportedbeyond national borders.• Search for social networking activity on page 24Employees who are accustomed to using social networking sites might not realize howmuch time they are spending on activities that reduce their productivity, or how muchsensitive information might be leaked when they use such sites in the workplace.• Find postings to message boards on page 24Employees sometimes spend company time posting to Internet sites that are notwork‐related.• Find frequently visited web sites on page 25Find web sites that are frequently visited by users who might routinely use the Internet tocomplete their job duties, but might enter URLs that can compromise network security.Find leaked documentsWhether accidental or unintentional, confidential documents on corporate networks are often open todiscovery by unauthorized users.This case helps you to locate leaked documents, then analyze the incidents to find out how they wereleaked.McAfee Data Loss Prevention 9.2.2 Product Guide 19