DLP for user outside the corporate

[Tamoor Khan]

Hi, 

I am confused between DLP cloud connector and other cases. If any of the component of DLP (including cloud) protects confidential data/attachments sending through corporate email (O365) or private email(gmail) when a user is outside the corporate network ? 

[Alan.Waggott]

Hi,

 

Do you mean how is the user protected? Your question isn't very clear.

 

Thanks

[Tamoor Khan]

Hi Alan,

 

Thanks for the reply. Actually customer is looking for DLP solution and he is asking if user is outside corporate network and using mobile device to send confidential files and transfering those files to any unauthorized person through email. How these confidential files will be prevented from the user's mobile device to send? 

[Alan.Waggott]

Hi Tamoor,

 

If you are using cloud mail protect and the user is using an app say o365 app to send the email then the mail will be routed through the connector to the cloud dlp. The cloud DLP will detect the mail if the user is sending confidential files.

 

If you are worried about the user transferring confidential files from the network to there mobile device by plugging the phone into the workstation then you could use DLP endpoint agent and and block files being transferred to usb devices. This would stop the user transferring files and emailing them off there mobile dsevice using a personal account.

However if the user has the office 365 app installed on the mobile device and they download the attachment to there own personal device and forward this on using a 3rd party app then there is no real way to stop this.

 

The best way to stop these kind of things would be for the company to issue company phones and use some kind of device management to stop 3rd party apps being installed and files being downloaded. The issue we are faced with today is that a lot of people use there own personal devices for communicating for there work. Symantec don't extend the agent out to mobile devices, although i have a feeling in the near future they will make this a feature.

 

I hope this helps a little. If you have any more questions feel free to ask away.

 

Thanks

 

[Jyl Broder]

2 ways to cover this, 

1. Content aware IRM 

2. Fingerprints stored at the endpoint which will determine if data needs to be blocked (when off the network), not sure if Symantec DLP does this?  But i do know that forcepoint and GTB Technologies DLP  endpoint protector do.

BR