Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 3 subscribers
  • Views 8939 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Data Control

pdturbo80

Hi,

 

I am trying out Data Control on a test OU at the moment and it is enabled fine. However when I copied across a file from a file share the information wasn't recorded. From what i have read, if on-access for remote files isn't enabled this is expected condition-Does this still apply on SEC 5.5.0 ?

Thanks



This thread was automatically locked due to age.
Parents
  • 0

    Hello pdturbo80,

    functionality is solely implemented on the endpoint, the console version doesn't really matter.
    Anyway - what exactly is across a file share? DLP only controls transfer to destinations it considers (potentially) external - removable storage and certain applications like mail clients and browsers.

    Christian

  • 0 in reply to QC

    Sorry, should have been more explicit. A mapped drive on a Windows File Server. I copied a file from that to a USB drive and no alerts happened if I copied across a file from My Documents to the USB drive it alerted me.

  • 0 in reply to pdturbo80

    Hello pdturbo80,

    I see. What's excluded from AV scanning is also not subject to Data Control.

    Christian

  • 0 in reply to QC

    Thanks Christian for confirmation.

    Is there a downside to excluding remote files from scanning-everyone seems to do it from what I have read.

  • 0 in reply to pdturbo80

    Hello pdturbo80,

    everyone seems to do it
    not really. There are two schools of thought -     one that deems scanning remote files redundant (as they are scanned on the server anyway) and a drag on performance and the other that doesn't make a distinction local/remote.

    a downside to excluding remote files
    obviously it's only safe if scanning is enabled on the share's host.     In the unlikely event that the server is compromised ... well, too bad. In addition the components that depend on the scanner (DLP and Application Control) don't kick in.

    Christian

Reply
  • 0 in reply to pdturbo80

    Hello pdturbo80,

    everyone seems to do it
    not really. There are two schools of thought -     one that deems scanning remote files redundant (as they are scanned on the server anyway) and a drag on performance and the other that doesn't make a distinction local/remote.

    a downside to excluding remote files
    obviously it's only safe if scanning is enabled on the share's host.     In the unlikely event that the server is compromised ... well, too bad. In addition the components that depend on the scanner (DLP and Application Control) don't kick in.

    Christian

Children
No Data
Unfiltered HTML