Is there a way to monitor files being copied from a USB device to a host DLP computer? I saw this question posted before with no answer.
I'd like to see what's moving into the environment before I make decisions on policies to block. I think it can be done with File Application Protection rules, but can't think my way through a policy. Any help would be appreciated.
Unfortunately this is a current limitation of the McAfee HDLP application. Its only capable of monitoring data being moved to USB devices. I have hope this will be addressed in a future release.
You cannot report on files copied from USB to computer.You can use location based tagging rule to tags files copied from removable storage and CD/DVD devices to the computer. You may use this tag on protection rules to enforce block/monitor etc. reactions.
This will at least report on files that the user copied from the USB and tried to send out.
DLP is Data Loss/Leak Prevention. Data coming to your computer is not considered Data Loss/Leak.