Sophos Enterprise Console
7 Setting up data control policies
7.1 Defining a data control policy
The data control policy enables you to manage the risks associated with the accidental transfer of sensitive data from computers.
Each company will have its own definition of sensitive data. Common examples include:
• Customer records containing personally identifiable information.
• Financial data such as credit card numbers.
• Confidential documents.
When the data control policy is enabled, Sophos monitors user actions at common data exit points:
• Transfer of files onto storage devices (removable storage, optical media, and disk-based media).
• Upload of files into applications (corporate web browsers, email clients, and IM clients).
A data control rule is made up of three elements:
• Items to match: Options include file content, file types, and file names.
• Points to monitor: Monitoring points include storage types and applications.
• Actions to take: Available actions include "Allow file transfer and log event" (monitor mode),
"Allow transfer on acceptance by user and log event" (training mode), and "Block transfer and log event" (restricted mode).
For example, data control rules can be defined to log the uploading of any spreadsheet using
Internet Explorer or to allow for the transfer of customer addresses onto a DVD once the transfer is confirmed by the user.
Defining sensitive data based on content can be complex. Sophos has simplified this task by providing a pre-built library of sensitive data definitions, known as Content Control Lists. The library covers a wide range of personally identifiable and financial data formats and is kept up-to-date by
Sophos. As necessary, you can also define custom Content Control Lists.
As with all Sophos policies, the data control policy continues to be enforced on computers even when they are disconnected from your company's network.
7.2 Recommended settings
When setting up your data control policy, consider the following:
• Use the Allow file transfer and log event action to detect but not block controlled data. Initially defining a report only policy enables you to gain a better view of data use across your network.
• Use the Allow transfer on acceptance by user and log event action to alert users about the risks of transferring documents that potentially contain sensitive data. This approach can reduce the risk of data loss without a significant impact on IT operations.
• Use the "quantity" setting within content rules to configure the volume of sensitive data you want to find before a rule is triggered. For example, a rule that is configured to look for one postal address within a document will generate more data control events than a rule looking for 50 or more addresses.
Copyright © Sophos Limited 13
Sophos Enterprise Console
Note
Sophos provides default quantity settings for each Content Control List.
• Use the data control Event Viewer to quickly filter events for investigation. All data control events and actions are logged centrally in Sophos Enterprise Console. You can access the Event Viewer by clicking Events > Data Control Events.
• Use the Report Manager to create trend reports on data control events by rules, computers, or users.
• Use the custom desktop messaging options to provide users with additional guidance when an action is triggered. For example, you could provide a link to your company's data security policy.
• Use the verbose logging mode to gather additional detail on the accuracy of data control rules.
Once the evaluation of these rules is complete, disable verbose logging.
Note
Verbose logging must be activated on each computer. All data generated is stored in the computer's local data control log. When the verbose logging mode is active, all strings contained in each file that match the data specified in a rule are logged. The additional detail within the log can be used to identify phrases or strings within a document that triggered a data control event.
7.3 How to roll out a data control policy
By default, data control is turned off and no rules are specified to monitor or restrict the transfer of files onto storage devices or into applications. We recommend that you introduce data control as follows:
1. Understand how data control works on your computers:
• Storage devices: Data control intercepts all files copied onto monitored storage devices using Windows Explorer (this includes the Windows desktop). However, direct saves from within applications, such as Microsoft Word, or transfers made using the command prompt are not intercepted.
It is possible to force all transfers onto monitored storage devices to be made using Windows
Explorer by using either the "Allow transfer on acceptance by user and log event" action or the "Block transfer and log event" action. In either case, any attempt to save directly from within an application or transfer files using the command prompt are blocked by data control, and a desktop alert is displayed to the user requesting that they use Windows Explorer to complete the transfer.
When a data control policy only contains rules with the "Allow file transfer and log event" action, direct saves from within applications and transfers using the command prompt are not intercepted. This behavior enables users to use storage devices without any restrictions.
However, data control events are still only logged for transfers made using Windows
Explorer.
Note
This restriction does not apply to application monitoring.
14 Copyright © Sophos Limited
Sophos Enterprise Console
• Applications: Data control intercepts files and documents uploaded into monitored applications. To ensure only file uploads by users are monitored, some system file locations are excluded from data control monitoring. For more information on the content or actions
within applications that are scanned or not scanned, see Understanding data control scanning within applications
(page 16).
Note
If you are monitoring e-mail clients, data control scans all file attachments but does not scan e-mail content. The Sophos Email Security and Data Protection solution can be used if scanning email content is required.
2. Consider what types of information you want to identify and create rules for. Sophos provides a set of sample rules that you can use to help build your data control policy.
Important
Content scanning can be an intensive process and this should be taken into consideration when creating content rules. It is important to test the impact of a content rule prior to rolling it out across a large number of computers.
Note
When creating your first policy, we recommend focusing on the detection of large collections of personally identifiable information within documents. Sophos provides sample rules to meet this requirement.
3. Enable data control scanning, and select the Allow file transfer and log event action in your rules to detect but not block controlled data.
Important
We recommend that you configure all rules to use this action for the initial deployment. This will enable you to assess the effectiveness of the rules without impacting user productivity.
4. Deploy your data control policy to a small number of computers to make it easier to analyze data control events triggered by the policy.
5. Use the data control Event Viewer to view data being used, check for any weaknesses in the test configuration (e.g. a rule being too sensitive and generating a higher than anticipated volume of events). You can access the Event Viewer by clicking Events > Data Control Events > .
6. Once the policy has been tested, you can make any required adjustments and roll it out to a larger set of computers within your company. At this stage, you may decide to:
• Change the actions for some rules as necessary to Allow transfer on acceptance by user
and log event or Block transfer and log event.
• Create different policies for different groups. For example, you may want to allow computers within the human resources department to transfer personally identifiable information, but prevent all other groups from doing so.
For more information on setting up data control policy, see the Sophos Enterprise Console help .
Copyright © Sophos Limited 15
Sophos Enterprise Console
7.4 Understanding data control scanning within applications
The following is a list of the content or actions that are scanned or not scanned within supported applications.
For a complete list of known limitations with data control, see Sophos support knowledgebase article
63016 ( http://www.sophos.com/en-us/support/knowledgebase/63016.aspx
).
Applications
Web browsers
Data Control Scanning Actions
Scanned:
• File uploads
• Webmail attachments
• Microsoft SharePoint uploads
Not scanned
• Webmail message content
• Blog entries
• File downloads
Note
In a small number of cases, files may be scanned when downloaded.
Email clients Scanned
• Email attachments
Not scanned
• Email message content
• Forwarded attachments
• Attachments made using the "Send" email option within applications
(e.g. Windows Explorer and Microsoft Office)
• Attachments using the "E-mail this file" option within Windows Explorer
• Attachments copied from one email to another email
• Saved attachments
Note
In a small number of cases, files may be scanned when saved.
16 Copyright © Sophos Limited
Sophos Enterprise Console
Applications Data Control Scanning Actions
Instant messaging (IM) clients Scanned
• File transfers
Note
A file may be scanned twice: once upon upload to the IM client and again upon acceptance by the recipient. Both scans occur on the sender's computer.
Not scanned
• IM message content
• Sent files
Copyright © Sophos Limited 17
