McAfee Data Loss Prevention 9.2.2 Product Guide

3Managing McAfee DLP PreventConfiguring McAfee DLP PreventPreventive, corrective, and protective actionsThe networked McAfee DLP products offer a variety of different responses when significant incidents orevents are detected. Each type of action acts on a different type of data.Table 3-1 McAfee DLP actions by productProduct Data type Available actions Role in networked DLP suiteMcAfee DLPPreventMcAfee DLPMonitorMcAfee DLPDiscoverMcAfee DLPEndpoint HostData in Motion Allow, Block, Bounce,Encrypt, Monitor,Notify, Quarantine,RedirectData in Motion AllowData at RestData in UseMove, Copy, Encrypt,DeleteBlock, Delete, Encrypt,Monitor, Notify,Quarantine, RequestJustification, StoreEvidence, TagEvaluates email and webmail that hasbeen forwarded from an MTA or proxyserver, marks messages that violateactive rules with certain actions, andpasses them back to the mail servers tobe enforced.Captures, monitors, analyzes, and detectsviolations by applying rules to or queryingdata in network traffic.Executes remedial actions when sensitiveor registered content is detected in anetwork repository or database.Protects endpoint data and devices withspecific actions that can be deployed onoroff‐site when violations are found.Implementation of actions in a unified policy systemIn a managed system including McAfee DLP Monitor, McAfee DLP Discover, and McAfee DLP Endpoint,every rule can be configured to deploy one action of each of the three data types (Data‐in‐Motion,Data‐at‐Rest, Data‐in‐Use).When McAfee DLP Prevent is added to a McAfee DLP Manager managed system, it is used toimplement remedial actions and protection rules defined by McAfee DLP Discover and McAfee DLPEndpoint as well as all actions appended to McAfee DLP Monitor rules.McAfee DLP Monitor is a passive component on the network, so it allows all traffic by default. Except forALLOW, McAfee DLP Monitor cannot implement Data‐in‐Motion Prevent policy actions unless McAfee DLPPrevent is added to the system.Configuring McAfee DLP PreventTo configure McAfee DLP Prevent, set it up with an Mail Transfer Agent (MTA) or proxy server, thenallow rules that find policy violations to apply pre‐configured actions.Requirements for configuring MTAs with McAfee DLP PreventBefore you set up an MTA to interoperate with McAfee DLP Prevent, you must determine if it meets theminimum requirements.• The email server must be capable of sending outgoing traffic to the McAfee DLP Preventapplication. In some environments, only a portion of SMTP traffic might need to be scanned. Forexample, only messages with attachments or those that are directed to public sites (such as Gmail)might be directed to the Prevent appliance.• The email server must be capable of inspecting headers of incoming messages.• The email server must be capable of acting on header strings in email headers — specifically,X‐RCIS‐Action headers with values ALLOW, BLOCK, QUART, ENCRYPT, BOUNCE, REDIR and NOTIFY.68 McAfee Data Loss Prevention 9.2.2 Product Guide