Question on ITAR copying

[skeating]

Hello

I have setup a rule in DLP for monitoring ITAR content. My setup is as follows:

Classification       is one of (OR)       ITAR

End User             is any user (ALL)

Application          is any application (ALL)

Copy Direction    Outgoing

                              Incoming

Removable Media    CD and DVD

                                   Removable Storage

There are No Exceptions to the rule

Reaction tab

Action: Block

User notification        Default generic user notification

Report Incident

I also have a rule for Prevent write to USB

My problem is that when I copy a Word document that has the phrases which should set off the ITAR Content, from the USB to the desktop of the computer, I get no alert or blocking. I have applied the policy to the laptop, so I know it is there. Is there something else I need to do in order for a report to be generated, or the attempt blocked?

[jsubbura]

Hi @skeating ,

Thank you for writing in here.

I do get the Incidents for both directions. I am pasting the screenshot for the Incoming direction.

Can you help with the DLP version which you are using? or can you try to make sure your document which you are copying or moving from USB to computer has 150 to 300 characters? 

https://kc.mcafee.com/corporate/index?page=content&id=KB53436

Thank you.

[skeating]

I am using DLP 11.5. The document I was using is not that large, so I'll try to use the zipped file provided.

[jsubbura]

Hi @skeating ,

Sure, kindly give it a try and share us the results.

Thank you

[skeating]

I have used the DLP test file to copy from USB to Desktop and the other way. I have not gotten any response from the Incident Manager. There is no Incident ID for the copying. I have only made one change to the above configuration, I changed the User Notification from 5 seconds to close manually.

[jsubbura]

Hi @skeating ,

I even tested with DLP 11.5 and its working fine.

May be you can raise a support case with McAfee Tech Support so that we can remote into the machine and troubleshoot further.

Thank you.

[skeating]

I realized my problem. I had not created a document with enough characters in it. Can that be changed, or is the 150-300 characters hard wired into the application?

[jsubbura]

Hi @skeating ,

McAfee DLP is designed to trigger a reaction on data that is no less than 350 characters.

Which is around 150 - 300 and its per design.

Kindly refer the below article for more info.

https://kc.mcafee.com/corporate/index?page=content&id=KB53436

Thank  you