cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Question on ITAR copying

Hello

I have setup a rule in DLP for monitoring ITAR content. My setup is as follows:

Classification       is one of (OR)       ITAR

End User             is any user (ALL)

Application          is any application (ALL)

Copy Direction    Outgoing

                              Incoming

Removable Media    CD and DVD

                                   Removable Storage

There are No Exceptions to the rule

Reaction tab

Action: Block

User notification        Default generic user notification

Report Incident

I also have a rule for Prevent write to USB

My problem is that when I copy a Word document that has the phrases which should set off the ITAR Content, from the USB to the desktop of the computer, I get no alert or blocking. I have applied the policy to the laptop, so I know it is there. Is there something else I need to do in order for a report to be generated, or the attempt blocked?

7 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: Question on ITAR copying

Hi @skeating ,

Thank you for writing in here.

I do get the Incidents for both directions. I am pasting the screenshot for the Incoming direction.

itarincident.PNG

Can you help with the DLP version which you are using? or can you try to make sure your document which you are copying or moving from USB to computer has 150 to 300 characters? 

 

https://kc.mcafee.com/corporate/index?page=content&id=KB53436

 

Thank you.

Regards,
Jithendran S
McAfee Employee
Highlighted

Re: Question on ITAR copying

I am using DLP 11.5. The document I was using is not that large, so I'll try to use the zipped file provided.

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: Question on ITAR copying

Hi @skeating ,

Sure, kindly give it a try and share us the results.

Thank you

Regards,
Jithendran S
McAfee Employee
Highlighted

Re: Question on ITAR copying

I have used the DLP test file to copy from USB to Desktop and the other way. I have not gotten any response from the Incident Manager. There is no Incident ID for the copying. I have only made one change to the above configuration, I changed the User Notification from 5 seconds to close manually.

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 8

Re: Question on ITAR copying

Hi @skeating ,

I even tested with DLP 11.5 and its working fine.

dlp115.PNG

May be you can raise a support case with McAfee Tech Support so that we can remote into the machine and troubleshoot further.

 

Thank you.

Regards,
Jithendran S
McAfee Employee
Highlighted

Re: Question on ITAR copying

I realized my problem. I had not created a document with enough characters in it. Can that be changed, or is the 150-300 characters hard wired into the application?

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: Question on ITAR copying

Hi @skeating ,

McAfee DLP is designed to trigger a reaction on data that is no less than 350 characters.

Which is around 150 - 300 and its per design.

Kindly refer the below article for more info.

https://kc.mcafee.com/corporate/index?page=content&id=KB53436

 

Thank  you

Regards,
Jithendran S
McAfee Employee
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community