McAfee Data Loss Prevention 9.2.2 Product Guide

Managing McAfee DLP systemsAdding servers to McAfee DLP systems 13Table 13-3 Syslog server message definitions (continued)Message fieldDestination portSource user nameDestination nameEmail subjectFile nameDefinitionDestination portSource user nameDestination user nameEmail subjectFile nameUsing DLP on directory serversThe ability to monitor user traffic on Active Directory servers now has been extended to directoryservers, making global user management a reality.The ability of McAfee Data Loss Prevention to connect to multiple domain controllers makes it possibleto capture data on local networks and up to two LDAP servers.When users can be recognized by name, group, department, city or country, a DLP administrator canextract a great deal of significant information by using a few seminal facts to gradually gather moredetails about potential violations.OpenLDAP and Active Directory server differencesMcAfee Data Loss Prevention supports OpenLDAP as well as Active Directory servers.OpenLDAP and Active Directory produce different user schemas. Active Directory has a constrained setof parameters, but OpenLDAP is completely customizable, so user implementations might vary widely.OpenLDAP and Active Directory servers identify users by using different means of user identification.Active Directory uses sAMAccountName, and OpenLDAP uses UID. LDAP queries forsAMAMccountName are handled by using the UID property on OpenLDAP systems.OpenLDAP and Active Directory servers also identify user classes by using different user attributes.Instead of the User object class, OpenLDAP uses inetOrgPerson, which does not support country or"memberOf" attributes.How directory server accounts are accessedHistorically, McAfee DLP Manager has been linked to sAMAccountName as the main user identificationelement. But if that attribute is applied to users in the same domain who have similar or matchinguser names, they cannot be identified conclusively.McAfee DLP keys on the unique alphanumeric SID (Security Identifier) that is assigned to each useraccount by the Windows domain controller.Because McAfee Logon Collector allows McAfee DLP to key on SIDs (Security Identifiers), the identitiesof individual users can be resolved and their traffic can be monitored. By leveraging multiple userattributes, it is now possible to identify end users precisely, regardless of what email or IP addressesthey are using.When a SID is retrieved from the Active Directory server, all of its associated attributes, such asdomain name, location, department and user group, come with it. That collection of information canthen be used in rules, templates, action rules, and notifications to find and stop security violations byspecific users.For example, the user name jsmith might belong to John Smith or Jack Smith, so more informationwould be needed to distinguish between those two users. They might even be using the same IPaddress, which would amplify the problem of discovering the identity of the actual user.McAfee Data Loss Prevention 9.2.2 Product Guide 261