Endpoint DLP Device and Content Control Policies

Endpoint DLP Policy

Endpoint DLP provides two types of protection policies: Device Control and Content Control.

Device Control policies provide decisions about access to devices. These decisions can be based on the user, group membership, endpoint device classification, and destination device characteristics such as device type, serial number, manufacturer, or encrypted state. This feature can be used to ensure that only corporate file shares are used, or that access to USB Mass Storage devices is limited to standard company-issued, encrypted devices.

Content Control policies provide security controls based on the content of the data. Content Control policies can use all the same device and user criteria that are used for Device Control policies, but they can also inspect and classify the content of the data and use this information in policy decisions.

Device Constraints

Most destination device types support Device Constraints. Device Constraints are criteria about the destination device such as hardware attributes (Serial Number, Manufacturer, Model) or configuration (Printer Port, Encryption state). Device Constraints can be managed in the Policy>Constraints section of the UI.

You can define Device Control policies that allow users to access only corporate devices. You can leverage device control policies to take action based on the device.

Endpoint DLP Device Control Policies are grouped by RBAC/LBAC-based groups.

All Policy Groups (except for Default) can be modified by Rename, Assign Labels, Move, Enable, Disable, and Delete.

There is also RBACv3 support. For more information, see RBAC v3 Overview.

Creating Endpoint DLP Device Control Policies

1. In the Netskope UI, go to Policies > Endpoint Protection.

2. In the Device Control tab, click New Device Control Policy.

3. On the Endpoint Device Control Policy page:

   • Endpoint Protection: Select any of the following criteria for by the policy:

     • Users: Select the Users, User groups, or Organizational units affected by the policy. Click + Exclusions to select the users, user groups, or organizations you want to exclude from the policy.Device Classification: Choose to apply the policy to managed or unmanaged devices. You also can click to go to the Device Classification page and configure rules.

     • Device Classification: Choose to apply the policy to Managed or Unmanaged devices. You also can click the Settings icon to go to the Device Classification page and configure rules.

   • Device: Select

     • USB storage device – To allow or block connected USB device on corporate laptops

     • Printer – To allow or block local/network printers used by endusers

     • Network File Share – To control which network file shares endpoints are allowed to access.

     • Bluetooth File Control – To allow or deny outgoing file transfers over Bluetooth.

     • CD and DVD Drives (Windows) – To allow or deny writes to discs.

     • Any: Select to apply this policy to all devices.

     • Matches: Select the constraint profiles that contain the devices you want to include in the policy. For example, you can select a constraint profile that includes a particular brand of USB devices you want to limit access to. Click “+ Create New” to create a new constraint profile. This policy only applies to devices that match the selected constraint profiles.

     • Does not match: Select the constraint profiles that contain the devices you want to exclude from the policy. For example, you can select a constraint profile that includes all local printer devices. Click + Create New to create a new constraint profile. This policy only applies to devices that don’t match the selected constraint profiles.

     For detailed info on Constraint Profiles, see Constraint Profile.

   • Action: Select the action to be performed when the policy is triggered.

     • Allow: Select to allow users read and write access to the USB, printer, NFS or Bluetooth File Control.

     • Make Read-Only: Select to only allow users read access to the storage device. This is only available for USB devices.

       WPD/phone devices do not support Read-Only policy actions. These devices will be blocked.

     • Block: Select to block users from accessing the device.

     • USB Devices can have a notification template displayed to users to explain why their devices are Read-Only.

       

   • Set Policy: Enter a policy name. You can only use alphanumeric characters and symbols such as underscore (_), dash (-), and square brackets ([ ]). You cannot use the greater-than (>) or less-than (<) symbols in policy names. Optionally, You can click + Policy Description to add notes or information and toggle

   • Status: Enable or disable the policy.

Creating Endpoint Control Policies

You can define Content Control policies to prevent users from copying or printing sensitive data to sanctioned USB devices, printers, and Bluetooth File Control on Windows. You can leverage content control policies to take action based on the sensitive content in the file or where the file came from (i.e., file origin).

1. In the Netskope UI, go to Policies > Endpoint Protection.

2. Click the Content Control tab.

3. Click New Content Control Policy.

4. On the Endpoint Content Control Policy page:

   • Endpoint Protection: Select any of the following criteria for by the policy:

     • User: Select the users, user groups, or organizational units affected by the policy. Click + Exclusions to select the users, user groups, or organizations you want to exclude from the policy.

     • Device Classification: Choose to apply the policy to managed, unmanaged, or Custom (starting in version 124.0.0) devices. You also can click the Settings icon to go to the Device Classification page and configure rules.

   • Destination: Select USB Storage Device, Printer (Windows), Bluetooth File Transfer (Windows), Network File Share (Windows), and/or Browser App (Windows, R130+ client required) for the content destination.

     For both the devices, admins can select the following conditions:

     • Any: Select to apply this policy to all corporate sanctioned and unsanctioned USB storage devices.

     • Matches: Select the constraint profiles that contain the USB devices you want to include in the policy. For example, you can select a constraint profile that includes encrypted USB devices you want to limit access to. Click + Create New to create a new constraint profile. This policy only applies to devices that match the selected constraint profiles.

     • Does not match: Select the constraint profiles that contain the USB devices you want to exclude from the policy. For example, you can select a constraint profile that includes all local and network printer devices. Click + Create New to create a new constraint profile. This policy only applies to devices that don’t match the selected constraint profiles.

   • File: Select the file information for the policy.

     • File Profile: Select the file profiles that define the files you want to allow or block users from copying to a USB storage device or printing. For ex., you can create a file profile which includes text files and/or spreadsheets. Click + to create a new file profile. You also can click the Settings icon to go to the File Profile page.

     • File Origin: Select the predefined or custom applications and application instances that contain files you want to allow or block users from copying to a USB storage device or printing. For example, you can create a file origin with Slack Enterprise or Gmail application instances so that any file downloaded from these apps can be blocked from copying to devices. Under Exceptions, you can select the application instances you want to exclude from this policy. You also can click the Settings icon to go to the App Definition page and configure a custom app.

   • Profile & Action: Select the DLP profiles you want to use to inspect files for violations and configure an action for each profile.

     • Allow: Select to allow users to transfer files that have no DLP violations from the USB storage device.

     • Alert: Select to receive alerts about files that are transferred to the USB storage device and contain DLP violations.

     • User Alert: Select to send a default or custom notification message to users when they transfer files with DLP violations to a USB storage device. Click + Create Template to create a notification message that allows them to proceed after they justify their reasons.

     • Block: Select to prevent users from transferring files to the USB storage device, send a default or custom notification message to users when they transfer files with DLP violations. Click + Create Template to create a notification message that teaches them to adhere to your data policy.

   • Set Policy: Enter a policy name. You can only use alphanumeric characters and symbols such as underscore (_), dash (-), and square brackets ([ ]). You cannot use the greater-than (>) or less-than (<) symbols in policy names. Optionally, You can click + Policy Description to add notes or information.

   • Status: Enable or disable the policy.

5. Click Save and then click Apply Changes.

You can configure the fallback settings when the Netskope cloud can’t perform content inspection for an endpoint because it’s offline, the file size is too large, or there’s a system error.

To configure the Content Control policy settings: