Fltering in real time, and control

[relemedf5w023]

The first such example of a hybrid DLP on the Russian market is the updated version of DeviceLock DLP 8.3, supplemented by the DeviceLock EtherSensor server module. The hybrid DLP system effectively solves several problems and tasks facing information security services at once - monitoring network traffic from computers and mobile devices on which, for technical reasons, it is impossible to install or operate a DLP agent, or reducing the load on user workstations due to separate control of various network services and protocols at different levels. Automatic switching of various combinations of DLP policies for monitoring network traffic in the DeviceLock DLP agent depending on the presence of a connection to the corporate network and / or corporate servers allows for extremely flexible user control, when, for example, at the agent level, when the laptop is in the office, control of devices, printers and particularly critical network applications and services is maintained,

including using content and inspection of other network lebanon whatsapp data and services is assigned to the EtherSensor module. A single database of event logging and shadow copying, filled with events and data obtained by intercepting traffic from the network level and as a result of monitoring network communications and devices on workstations, allows you to identify information security incidents for the widest range of potential data leakage channels.

Let's consider several typical scenarios of using DeviceLock DLP as a hybrid DLP system. The simplest is a very common scenario when full control of network traffic with blocking of data transfer is impossible or inapplicable. This situation occurs when using guest computers and mobile devices in a corporate network, as well as for workstations running Linux and MacOS. In addition, interception and analysis of network communications directly on workstations may be impossible or excessively resource-intensive on workstations with weak computing power. The solution to the problem of network traffic control in such a scenario is provided by interception and analysis of traffic at the network level - listening to traffic from mirror ports of the server, integration with NGFW devices and proxy servers, other methods that do not require installing an agent on workstations, which is successfully provided by the EtherSensor server. In this case, the task of DLP control of peripheral devices and workstation ports is performed by the DeviceLock agent (on Windows and MacOS operating systems), and events and data from both EtherSensor in terms of network traffic objects and DeviceLock agents in terms of device control are collected in the DeviceLock Enterprise Server database for centralized analysis.