Data Loss Prevention

Module Data Loss Prevention allows you to control how data is used, copied, transferred, and stored on computers managed by eAuditor Cloud.

Using DLP policies, you can define:

• which events should be monitored,

• when the system should respond,

• what action should be performed,

• whether the operation should be allowed or blocked,

• who should be notified about the event.

This allows you to create rules tailored to how the organization works, for example, blocking data copying to specified USB storage devices, controlling file transfers, responding to the launch of selected applications, or monitoring operations performed on files.

Data protection is not based on a single setting. The module's operation results from the configuration of policies and rules, which define which event should be detected and how the system should respond to it.

How does data protection work?

The module is based on the following relationship:

Policy -> Rule -> Trigger -> Action -> Notification

Each of these elements serves a different function.

Component	Purpose
Policy	Groups data protection rules and allows them to be assigned to specific users or devices
Rule	Defines the specific response method for a selected event
Trigger	Defines when the rule should be activated, for example after a device is connected, a file is copied, or an application is launched
Action	Defines what the system should do after the condition is met, for example block the operation, take a screenshot, or display a message
Notification	Defines who should be notified about the event and how

View of data protection policies and the rules assigned to them.

One rule can be used in more than one policy. Changing the configuration of such a rule can therefore affect all policies in which it is used.

What can be protected?

Data protection covers several areas of user and computer activity.

Devices and media

You can control the connection of devices and media used to transfer data.

Depending on the configuration type, it is possible, among other things, to:

• control peripheral devices,

• block selected device types,

• control USB storage devices,

• recognize specific USB storage devices,

• use device identifiers when creating rules.

Data in use

The system can respond to operations performed by the user while working with data, for example:

• copying data,

• operations performed on files,

• taking screenshots,

• using specific applications and processes,

• printing documents.

Data in transit

Rules can apply to situations in which data leaves the computer or is transferred between systems.

This may include, among other things:

• sending files,

• using websites,

• network connections,

• data transfer through supported channels.

Data stored in files

Classification mechanisms allow you to identify and tag files, which can then be covered by appropriate protection rules.

It is possible, among other things, to:

• tag selected files,

• use Fingerprint markers,

• search for specific content,

• use regular expressions,

• classify files automatically or according to a schedule.

The method of data protection depends on the policy objective. The same organization can apply different rules for different users, devices, or types of data.

What does the system response look like?

Detecting an event alone does not yet mean it will be blocked.

Depending on the configuration, the system can, among other things:

• log the event,

• block a specific operation,

• display a message to the user,

• take a screenshot,

• start screen recording,

• run the configured task,

• send a notification to the administrator or user.

This means that rules can be used both to monitor events and to provide active data protection.

Example

The administrator wants to restrict the ability to copy data to private USB drives.

The rule can be configured as follows:

Trigger: USB storage device usage meeting specified conditions detected.

Action: block the unauthorized operation.

Notification: notify the administrator about the event.

In a more advanced configuration, you can additionally specify the particular devices that should be allowed.

How do you start the configuration?

If you are configuring data protection for the first time, work in the following order:

1

Define what you want to protect

Consider which user or device activity should be controlled.

For example, this may be copying files, connecting a USB storage device, sending a file, or launching a specific application.

2

Create a policy

A policy groups rules that are to apply to selected users or devices.

3

Add a rule and select a trigger

The trigger defines the event after which the system will start executing the rule.

4

Configure the action

Define what the system should do after detecting the event.

Depending on the scenario, this may be only event logging or an active response, for example blocking the operation.

5

Configure notifications

If the administrator or user should be informed about the event, add the appropriate notification.

6

Assign the rule to a policy

Assign the created rule to the appropriate policy, thereby defining the users or devices it should apply to.

7

Update policies

After creating or changing the configuration, click Update policies, to deploy the current version of the policies to eAgents.

Until the update is performed, eAgent operates according to the last received configuration. This means that saving changes in the console does not apply them immediately on the computer.

You can check the date of the last policy update next to the button Update policies.

After any change to a policy, rule, trigger, or action, remember to update the policies. Otherwise, computers may continue to operate according to the previous configuration.

Blocking rules can affect users' daily work. Before assigning a new configuration to a larger group of computers, we recommend testing it on a limited test group.

Where can you check logged events?

Events related to data protection activity are recorded in the DLP log.

Go to:

Data Loss Prevention -> DLP Logs

In the log, you can review recorded events and use the available information to analyze rule behavior.

The DLP event log enables analysis of configured rules.

What next?

If you already know the module's basic operating principle, go to the section How does data protection work.

In the following sections of the documentation, you will learn about:

• the relationship between a policy and a rule,

• available types of triggers,

• possible actions,

• notification configuration,

• policy assignment,

• file classification and tagging,

• event analysis in DLP Logs.

FAQ

Does saving changes cause them to be applied immediately on computers?

No. After changing the configuration, you must use the option Update policies. Until then, eAgent operates according to the last received configuration.

Can one rule be used in multiple policies?

Yes. One rule can be assigned to more than one policy.

Keep in mind that changing such a rule can affect all policies in which it is used.

Does every detected operation have to be blocked?

No. The response depends on the configured action. The rule can only log the event or additionally perform a specific action, for example block the operation, display a message, or send a notification.

Can I apply different policies for different users or devices?

Yes. Policies can be configured and assigned so that different groups of users or devices are covered by different data protection rules.

Where can I check whether the rule was triggered?

You can check events related to rule activity in:

Data Loss Prevention -> DLP Logs