Question about monitoring data removed from workstations but not to the server

[twenden]

I have a question about if DLP can perform the tasks that our management is requesting. Basically, they are wanting to monitor all data that is removed from workstations except for the data between the workstations and server. Is that something that can be achieved with DLP?

[JaganA]

@twenden Thanks for choosing McAfee Community portal.

Could you elaborate your requirement more in detail?

[jsubbura]

Hi @twenden ,

Yes, you can monitor the data loss which is happening using DLP in general.

However, can you explain the below in detail?

"they are wanting to monitor all data that is removed from workstations except for the data between the workstations and server."

Thank you.

[twenden]

I will try to get more detailed clarification today. I basically think that my boss is wanting DLP to report on any data that leaves or is removed from a workstation except for data that occurs between the workstation and the servers in this secure environment. 

[jsubbura]

Hi @twenden ,

I think am able to understand your requirement now.

So the data transfer between workstations and servers needs not be monitored by DLP and the data leak (data leaving the workstation) from the workstation alone needs to be monitored by DLP.

If this is the requirement, this is achievable using DLP.

For more information on DLP rules and policy configurations, kindly review the playlist below and test your requirement 🙂

Thank you

[twenden]

Thanks. I will take a look at this video. I will reply if I have any more questions. 

[jsubbura]

Sure, you are welcome!

[twenden]

Have been testing the Network Communication Protection rule. In my example I have managed to get it to block all data to RDP. Can we use this rule to block all network traffic outgoing, for all data to the whole internet except for internal secure LAN?

I can't seem to figure out how top specify all IP except for internal? Is that possible?

See screen shot below. 

[jsubbura]

Hi @twenden ,

Can you help me with an example of your requirement, seems that I am unable to get the requirement.

Kindly help me with your exact requirement so that we can suggest and help on the same.

Thank you.

[twenden]

Sorry for the delay. My boss has taken the whole week off for a vacation. Will ask him next week what his requirements are. In the mean time, I have managed to test DLP and some scenarios.

I will respond back once I get any answers next week.