McAfee Data Loss Prevention 9.2.2 Product Guide

4Using McAfee DLP DiscoverRegistering documents and structured dataWhen registered text is plagiarized, it is unlikely that a 100 percent match will be found to the originaldocument. Therefore, searching for a percentage match of the registered material is more likely toexpose intellectual property theft.Use the high granularity signature type to detect percentages of matching signatures.Table 4-1 Definitions of signature typesSignature typeHigh granularityDefinitionHigh granularity signatures provide full plagiarism detection and protection bygenerating overlapping tiles over every bit of text. The original document can beidentified, even if words are transposed or the contents differ by a couple oflines of text. Only High Granularity signature types are generated for WebUploaded documents.Medium granularity Medium granularity signatures provide basic plagiarism detection and protectionby generating tiles over every eighth word. The original document can beidentified even if the contents differ by a couple of pages of text.Low granularityLow granularity signatures include a single compact digital signature for eachdocument registered. Exact copies of the file can be detected.How signatures are shared with managed systemsWhen McAfee DLP Discover is managed by McAfee DLP Manager, the signatures generated from scansor web uploads are distributed to other McAfee DLP appliances in the built‐in concepts DocReg andDBReg. The signatures stored in those concepts are used to locate registered data in network trafficand remote repositories.When McAfee DLP Discover and McAfee DLP Monitor are in communication through McAfee DLPManager, the registration records produced on a McAfee DLP Discover appliance are automaticallyshared with the McAfee DLP Monitor signature agents.Signatures are automatically transferred from the McAfee DLP Discover appliance to any managedMcAfee DLP Monitor or McAfee DLP Discover when a registration scan is run. Rescanning is notnecessary.When signatures are shared, protection for content that has been identified in data at rest is extendedto Data in Motion and Data in Use on the network.Add DocReg or DBReg to a ruleAdd the DocReg or DBReg concepts to a rule to match signatures to data at rest in file systems anddatabase repositories.You can add up to two scan tasks to a rule, but only one of each type (Data‐in‐Motion or Data at Rest). Thedefinition of the rule determines which type is targeted.If you add a scan task to a rule after the DocReg or DBReg concept is added, you can apply existingsignatures to the data that was registered or discovered by that task.If a Registration task is used with the DocReg or DBReg concepts, the rule will also be evaluated by anyDiscover scan that uses its policy. You must manually configure the rule to include the concept if youwant to register the same document across multiple rules.Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Policies.• On your McAfee DLP appliance, select Policies.76 McAfee Data Loss Prevention 9.2.2 Product Guide