McAfee Data Loss Prevention 9.2.2 Product Guide

13Managing McAfee DLP systemsAdding servers to McAfee DLP systemsEach account on an Active Directory server is made up of attributes that identify the individual whoowns the account. McAfee Logon Collector matches the unique SIDs that are assigned to each ActiveDirectory user to IP addresses, and all of the parameters associated with that SID are extracted whenMcAfee Logon Collector moves binding updates from the Active Directory server to McAfee DLP.Because sAMAccountName was used to index data in earlier releases, that information might be lostduring ad hoc searches when the user upgraded, or the data residing in the capture database pre‐datesthe upgrade.How directory servers are used with DLP systemsIf a directory server is added to McAfee Data Loss Prevention Manager, DLP can use the data on theserver to identify remote users and manage their data.Directory servers enable enterprise users to locate users through their logins, email or IP addresses,or by compound rules that combine user logins with locations or affiliations.How LDAP user accounts are monitoredHistorically, DLP Manager has been linked to sAMAccountName as the main user identificationelement. But if that attribute is applied to users in the same domain who have similar or matchinguser names, they cannot be positively identified.McAfee Data Loss Prevention now keys on the unique alphanumeric SID (Security Identifier) that isassigned to each user account by the Windows domain controller.For example, the user name jsmith might belong to John Smith or Jack Smith, so more informationwould be needed to distinguish between those two users. Those individuals might even be using thesame IP address, which would aggravate the problem of discovering the identity of the actual user.But each account on an Active Directory server is made up of attributes that identify the individualwho owns the account. McAfee Logon Collector matches the unique SIDs that are assigned to eachActive Directory user to IP addresses, and all of the parameters associated with that SID are extractedwhen McAfee Logon Collector moves binding updates from the Active Directory server to DLP.Because sAMAccountName was used to index data in earlier releases, that information might be lostduring ad hoc searches when the user has upgraded, or when the data residing in the capture databasepre‐dates the upgrade.Monitoring LDAP usersThe ability to monitor user traffic on LDAP servers has extended the reach of McAfee DLP tools todirectory servers used by enterprise‐sized organizations. Connections through multiple domaincontrollers makes this possible.Data on local networks is captured and the software extends this capability to all traffic on up to tworemote LDAP servers.When users can be recognized by name, group, department, city or country, a DLP administrator canextract a great deal of significant information by using what little information is known about thoseusers to gradually gather more details about a potential threat.For example, suppose you know that your company has lost intellectual property to a Chinese firm,and you suspect that the leak came from an insider in your Shanghai branch.Because McAfee DLP Monitor captures all traffic on your company's network, you can add an ActiveDirectory server that contains the user account of that insider to McAfee DLP Manager, then search forthe UserName of that individual and monitor his communications.262 McAfee Data Loss Prevention 9.2.2 Product Guide