Product Guide Revision A
Total Page：16
File Type：pdf, Size：1020Kb
Product Guide Revision A McAfee Data Loss Prevention 9.3.1 For use with ePolicy Orchestrator 4.5, 4.6, 5.0 Software COPYRIGHT Copyright © 2014 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, ePolicy Orchestrator, McAfee ePO, McAfee EMM, Foundscore, Foundstone, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. Product and feature names and descriptions are subject to change without notice. Please visit mcafee.com for the most current products and features. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Data Loss Prevention 9.3.1 Product Guide Contents Preface 13 About this guide .................................. 13 Audience ..................................13 Conventions .................................13 Find product documentation ............................. 14 1 Introduction to McAfee Data Loss Prevention 15 Understanding McAfee DLP products ..........................15 McAfee DLP product suite ........................... 15 McAfee DLP data vectors ............................16 How McAfee DLP works ............................... 16 How McAfee DLP handles data ......................... 16 How McAfee DLP acts on data ..........................19 Integrating multiple McAfee DLP products .....................20 Deployment 2 Deployment options 25 Types of installations ................................ 25 Management options ................................ 25 Using McAfee DLP with other McAfee products ...................... 26 3 Deployment scenarios 27 Deployment scenario: McAfee DLP Monitor ....................... 27 Deployment scenario: McAfee DLP Discover and McAfee DLP Prevent .............28 Deployment scenario: Full product suite integration ....................29 4 Plan your deployment 31 Product-specific requirements .............................31 Network integration requirements for McAfee DLP Monitor .............. 31 Requirements for configuring MTA servers with McAfee DLP Prevent .......... 33 Supported repositories with McAfee DLP Discover ..................33 Network placement .................................34 Default ports used in McAfee DLP communications .................... 34 Order of deployment ................................ 36 Deployment Checklist ................................37 Installation 5 Set up the hardware 41 Check the shipment .................................41 Rack mount the appliance .............................. 41 Identify network ports ................................42 Configure SPAN or tap mode for McAfee DLP Monitor ................... 43 McAfee Data Loss Prevention 9.3.1 Product Guide 3 Contents Integrate the appliance using a SPAN port .....................43 Integrate the appliance using a network tap ....................44 Connect the management port ............................ 44 Serial console settings ................................44 6 Install or upgrade the system 45 Installing or upgrading the software on 4400 and 5500 appliances ..............45 Download the 4400 or 5500 archive ....................... 45 Install a new image on 4400 or 5500 appliances .................. 46 Upgrading appliances in a managed environment ..................47 Upgrade the products on 4400 or 5500 appliances ................. 47 Boot options .................................49 Set the next boot image ............................50 Installing or upgrading the software on 1650 and 3650 appliances ..............51 Download the 1650 or 3650 archive .......................51 Install a new image on 1650 or 3650 appliances .................. 51 Upgrading appliances in a managed environment ..................52 Upgrade the products on 1650 or 3650 appliances ................. 53 Applying hotfixes ..................................54 Re-imaging an appliance ...............................54 7 Complete post-installation tasks 55 Add NAT IP addresses ................................55 Configure McAfee DLP Manager ............................ 56 Add McAfee DLP Manager to ePolicy Orchestrator .....................56 Install the network extension ..........................56 Add an ePolicy Orchestrator database user .................... 57 Register McAfee DLP Manager on ePolicy Orchestrator ................57 Install the host extension ........................... 58 Required ePolicy Orchestrator registration information ................58 Register ePolicy Orchestrator on McAfee DLP Manager ................59 Add McAfee DLP devices to McAfee DLP Manager .....................59 Configure standalone McAfee DLP appliances using the Setup Wizard .............60 Configure servers for McAfee DLP Prevent ........................61 Link negotiation for McAfee DLP appliances ....................... 61 Testing the system ................................. 62 Additional tasks .................................. 62 System configuration 8 Integrating network servers 67 Using external authentication servers ......................... 67 OpenLDAP and Active Directory server differences ................. 67 How directory server accounts are accessed ................... 67 How directory servers are used with DLP systems ................. 68 How LDAP user accounts are monitored ......................68 Monitoring LDAP users ............................ 69 Add Active Directory servers .......................... 69 Add Active Directory or OpenLDAP users ..................... 71 Export certificates from Active Directory servers .................. 71 How ADAM servers extend McAfee DLP Manager .................. 72 Mapping default to custom attributes .......................72 Using Active Directory attributes ........................ 73 Viewing Active Directory incidents ........................73 Search for user attributes in LDAP data ......................74 Find user attributes in LDAP data ........................ 74 4 McAfee Data Loss Prevention 9.3.1 Product Guide Contents LDAP columns available for display ....................... 75 Add columns to display user attributes ...................... 75 Using McAfee Logon Collector .............................75 Connect McAfee Logon Collector to McAfee DLP .................. 76 How McAfee Logon Collector enables user identification ...............76 How McAfee DLP uses SIDs .......................... 77 Using DHCP servers .................................77 Add DHCP servers .............................. 77 Using NTP servers ................................. 78 Configure time settings ............................ 78 Synchronize McAfee DLP devices with NTP .................... 79 Reset the hardware clock ........................... 79 Using syslog servers ................................ 80 9 Administrator accounts 81 Managing user accounts ...............................81 Configure primary administrator accounts .....................81 Activate a failover account ...........................82 Customize logon settings ........................... 82 Customize password settings ..........................82 Managing user groups ................................83 Add user groups ............................... 83 Delete user groups ..............................84 Managing permissions ................................84 Assign incident permissions .......................... 84 Assign task and policy permissions ....................... 85 Check user permissions ............................ 85 Check group incident permissions ........................ 85 Policy configuration and data use 10 Policies and rules 89 How policies and rules can be used .......................... 89 Analyzing trends in data matching ........................89 Use Chart and Compare to prioritize policies ....................90 Use Chart and Compare to tune policies and rules ................. 90 Managing policies ................................. 91 Policy inheritance .............................. 91 Policy activation ............................... 92 Activate or deactivate policies ......................... 92 Add, modify, and deploy policies ........................ 92 Managing rules .................................. 96 Add rules ..................................97 Find rules ................................. 97 View rule parameters ............................. 98 Copy rules to policies ............................. 98 Disable rule inheritance ............................ 98 Reconfigure rules for web traffic .........................99 Delete rules .................................99