This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Data Control

Hi,

I am trying out Data Control on a test OU at the moment and it is enabled fine. However when I copied across a file from a file share the information wasn't recorded. From what i have read, if on-access for remote files isn't enabled this is expected condition-Does this still apply on SEC 5.5.0 ?

Thanks

This thread was automatically locked due to age.

Parents

0 QC over 7 years ago

Hello pdturbo80,

functionality is solely implemented on the endpoint, the console version doesn't really matter.
Anyway - what exactly is across a file share? DLP only controls transfer to destinations it considers (potentially) external - removable storage and certain applications like mail clients and browsers.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 pdturbo80 over 7 years ago in reply to QC

Sorry, should have been more explicit. A mapped drive on a Windows File Server. I copied a file from that to a USB drive and no alerts happened if I copied across a file from My Documents to the USB drive it alerted me.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 7 years ago in reply to pdturbo80

Hello pdturbo80,

I see. What's excluded from AV scanning is also not subject to Data Control.

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 QC over 7 years ago in reply to pdturbo80

Hello pdturbo80,

I see. What's excluded from AV scanning is also not subject to Data Control.

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 pdturbo80 over 7 years ago in reply to QC

Thanks Christian for confirmation.

Is there a downside to excluding remote files from scanning-everyone seems to do it from what I have read.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 7 years ago in reply to pdturbo80

Hello pdturbo80,

everyone seems to do it
not really. There are two schools of thought - one that deems scanning remote files redundant (as they are scanned on the server anyway) and a drag on performance and the other that doesn't make a distinction local/remote.

a downside to excluding remote files
obviously it's only safe if scanning is enabled on the share's host. In the unlikely event that the server is compromised ... well, too bad. In addition the components that depend on the scanner (DLP and Application Control) don't kick in.

Christian
Cancel
Vote Up 0 Vote Down

Cancel