McAfee Data Loss Prevention 9.2.2 Product Guide

Managing McAfee DLP PreventHow McAfee DLP Prevent works 3How McAfee DLP Prevent works with webmailIf a webmail user violates any of the policies deployed through McAfee DLP Manager, McAfee DLPPrevent applies the appropriate action and returns the transmission to the proxy server. For example,if he sends a message that violates a Human Resources policy from his webmail account, an actionrule might be triggered to block that transmission and notify HR.Although McAfee DLP Prevent supports block, bounce, encrypt, monitor, quarantine and redirect actions,proxy servers can only BLOCK or ALLOW webmail.1 The proxy server captures outgoing HTTP/HTTPS communications traffic and sends it to McAfee DLPPrevent over ICAP (Internet Control Adaptation Protocol).2 On receiving the traffic, the McAfee DLP Prevent appliance compares it to existing policies and rulesfor web traffic.3 If a rule matches, McAfee DLP Prevent determines from its action rule whether or not the webmailshould be blocked.4 The McAfee DLP Prevent sends the webmail back to the proxy server. If it is blocked, a web pagestating that the transmission violates policy is sent to the user's browser. But if the associatedaction rule allows it, it is simply delivered to the addressee.5 The software sends notification of the action to any defined email address.Prevent policy actionsPreventive actions are added to rules that are matched to data in motion on the network. When a rulehits, the action is applied.McAfee DLP Prevent supports the following actions. But if the appliance is configured with a proxyserver, only ALLOW and BLOCK actions are supported.• Allow (default) • Monitor• Block • Notify• Bounce • Quarantine• Encrypt • RedirectEach action can be configured to automatically notify users that a preventive action has been applied,place a record in a system log, assign the incident to one or more reviewers, or apply a status thatindicates its stage of resolution.McAfee Data Loss Prevention 9.2.2 Product Guide 67