DLP Policy Configuration against MTP Devices

[dilan90]

Hi All,

I am experiencing issue with DLP 9.4. I have been added rule for DLP policy to block MTP devices. Its working fine and user getting the default block notification at the end point. But the issue is when user get chance to bypass the DLP block rule by having the challenge code, the DLP agent displaying the same block notification as before. So anyone have any resolution to prevent getting this notification at the bypass mode?

[dilan90 · Accepted solution]

Can anyone please help on this question??

[hhoang]

I'm not sure I understand the issue.  Are you saying that your users are receiving a block message after they have already entered bypass mode? 

[dilan90]

Hi,

After bypassing the DLP agent, pop-up shows DLP is monitoring/blocking the device

[Former Member]

I did a presentation on McAfee last year covering DLP and HIPS

http://www.slideshare.net/KyleTaylor24/kyle-taylor-increasing-your-security-posture-using-mc-afee-ep...

take a look to see if it covers your issue.......I think the issue is that MTP mounts as a device...not Removable storage

[dilan90]

thanks for your response on this

[hhoang · Accepted solution]

Did not see the response the first time around - entering bypass mode will "default" to monitor only.  In short it is expected behavior to enter bypass mode and still receive a monitor notification.  If you do not want the user to receive the notification you can temporarily assign a policy to them that has the rule disabled and/or has them added as a privileged user.

[dilan90]

Its done. Thank you