McAfee Data Loss Prevention Endpoint

Transcription

1 Release Notes Revision A McAfee Data Loss Prevention Endpoint For use with McAfee epolicy Orchestrator Contents About this release New features Enhancements Installation instructions Known issues Find product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. This release includes the following: McAfee Data Loss Prevention extension for McAfee epolicy Orchestrator (McAfee epo ) To upgrade policies and events, install the McAfee DLP extension in McAfee epo together with McAfee Data Loss Prevention Endpoint (McAfee DLP Endpoint) extension (Patch 5) or later. Upgrade to the version or later extension before installing the version extension. McAfee Data Loss Prevention Endpoint (McAfee DLP Endpoint) client for Microsoft Windows build McAfee DLP Endpoint client for OS X build McAfee DLP Endpoint Diagnostic Tool for Windows McAfee Help Desk

2 This release was developed for use with: McAfee epo 4.6.9, 5.1.3, and When running McAfee epo in Microsoft Internet Explorer, use Internet Explorer 10.0 or later. McAfee Agent for Windows 4.8 Patch 3 and McAfee Agent for Mac 4.8 Patch 2 or later or 5.0 or later OS X Yosemite requires McAfee Agent 4.8 Patch 2 or later, or McAfee Agent 5.0 or later; OS X El Capitan requires McAfee Agent (Patch 3) or HF Supported systems The McAfee DLP Endpoint client for Microsoft Windows in this release was developed for use with the following Microsoft operating systems. Windows 7 SP1 or later Enterprise and Professional editions, 32-bit and 64-bit Windows 8 and 8.1 or later Enterprise and Pro, 32-bit and 64-bit Windows 10 Enterprise and Pro, 32-bit and 64-bit Windows Server 2008 R2 and 2008 SP2 or later, 32-bit and 64-bit Windows Server 2012 and 2012 R2 or later, 64-bit File System Discovery rules and Network Communication Protection rules are not supported on servers. The McAfee DLP Endpoint client for OS X in this release was developed for use with the following Mac operating systems. OS X Mountain Lion OS X Mavericks OS X Yosemite OS X El Capitan Install McAfee Endpoint Protection for Mac 2.3 and McAfee Agent (Patch 3) before upgrading OS X to El Capitan 10.11, and before upgrading McAfee DLP Endpoint for OS X to this release. Compatible McAfee managed products The McAfee DLP Endpoint client for Windows in this release has been tested for compatibility with the following McAfee managed product versions. McAfee Application Control (formerly Solidcore) and 6.2 McAfee Client Proxy 1.2 and 2.0 McAfee Data Exchange Layer (DXL) 1.1 and 2.0 McAfee Drive Encryption (formerly McAfee Endpoint Encryption for PC) McAfee Endpoint Security McAfee File and Removable Media Protection (FRP) (formerly McAfee Endpoint Encryption for Files and Folders) HF ( ) 2

3 McAfee Host Intrusion Prevention System 8.0 Patch 5 (Patch 6, if applicable for Microsoft Windows 10) McAfee Management of Native Encryption (MNE) McAfee Policy Auditor 6.2 McAfee Risk Advisor 2.7 Patch 2 McAfee Rogue System Detection (RSD) and McAfee SiteAdvisor Enterprise 3.5 Patch 3 McAfee Threat Intelligence Exchange (TIE) 1.1 McAfee Virtual Technician McAfee VirusScan Enterprise 8.7 Patch 5 and 8.8 Patch 6 The McAfee DLP Endpoint client for Mac in this release has been tested for compatibility with the following McAfee managed product versions. McAfee Client Proxy 2.0 McAfee Endpoint Encryption for Mac 7.0 Endpoint Protection for Mac 2.2 and 2.3 OS X El Capitan requires Endpoint Protection for Mac 2.3 only. McAfee Endpoint Security for Mac 10.0 McAfee Management of Native Encryption (MNE) 2.1 McAfee VirusScan for Mac 9.7 Supported software McAfee DLP Endpoint supports the following third-party software products. These versions have been tested for compatibility with this release. Virtualization applications: Citrix XenApp 6.0, 6.5 FP2, and 7.6 Citrix Device Rules are not supported when using a separate controller server with XenApp 7.6. Citrix XenDesktop 5.5, 5.6, 7.0, 7.1, 7.5, and 7.6 VMware View 5.3, 6.0, and 6.2 VMware Hyper-V Cloud applications: Box Sync Microsoft OneDrive Dropbox Syncplicity Google Drive

4 Security and encryption applications: Boldon James Classifier Microsoft Active Directory Rights Management Service (AD RMS) 2008, 2012 Seclore FileSecure Policy Server Seclore Desktop Client Stormshield Data Security Titus Message Classification 3.5 Titus Classification for Desktop 3.1 Titus Classification Suite 4.3 HF1 Titus SDK TrueCrypt Office applications: Adobe Acrobat Pro, X and XI Adobe Reader Adobe Acrobat Reader DC Google Chrome 32-bit Lotus Notes client software 8.5.2, 8.5.3, 9.0, and Microsoft Edge Microsoft Internet Explorer 8 11 Microsoft Office 2007, 2010, and 2013 SP1 Microsoft Outlook 2007, 2010, 2013 SP1 Microsoft Sharepoint 2007, 2010, and 2013 Mozilla Firefox 32-bit New features This release of the product includes these new features. Case management McAfee DLP Endpoint supports case management. The feature is implemented as a module under Data Protection in the McAfee epo menu. The module is available to both McAfee DLP Endpoint and McAfee Data Loss Prevention Discover (McAfee DLP Discover). Case management allows administrators to collaborate toward the resolution of related incidents. Policy and event migration from 9.3 to 9.4 Policies, operational events, and incidents from McAfee DLP Endpoint version 9.3 can be upgraded to version 9.4. The feature can upgrade data from version and later. The feature is implemented as McAfee epo Server Tasks one each for incidents, operational events, and policy. For limitations, known issues, and a demo video, see this McAfee KnowledgeBase article: KB

5 After running conversions, check the Server Task Log to verify the conversion. The DLP policy conversion task is run after installing McAfee DLP Endpoint Rules appear in the DLP Policy Manager Rule Sets table as [9.3] Policy conversion rule set. All converted rules appear as a single rule set. There is no division into separate rules. Classifications and definitions appear in their respective tabs, labeled as [9.3]. Operation events and incident conversions are run in chunks of 200,000 per run. We recommend scheduling the operational events and incident conversions to run at night, during off-peak hours, or weekends to avoid placing an excessive load on the processor during work hours. Data rollup tasks McAfee epo rollup tasks draw data from multiple servers to produce a single report. You can create rollup reports for McAfee DLP operational events and incidents. The feature is implemented as a McAfee epo server task. You can now create a data rollup server task, and select either DLP Incidents or DLP Operational Events from the Data Type drop-down list on the Actions page. Enhancements This release of the product includes these enhancements. Microsoft Windows 10 support McAfee DLP Endpoint supports Windows bit and 64 bit PC operating systems. Microsoft Edge support in web post protection rules Web post protection rules now support uploads from the Microsoft Edge browser. Threat Intelligence Exchange integration McAfee Data Exchange Layer (DXL) communicates threat information to McAfee DLP Endpoint. The threat information received from DXL can track application-based threats according to a specified TIE reputation using Application File Access Protection rules. Improved Titus support For supported versions of Titus, McAfee DLP Endpoint calls the Titus API to identify tagged files and determine the tags. The Titus SDK must be installed on the endpoint computer in order to call the API. The enhancement is implemented with the classification criteria File conditions Third party tags. The third-party tag condition can be set to search for an exact Titus tag name or a substring of a Titus tag name. Multiple Titus tag names or substrings can be added to a single definition when separated by semicolons. The enhancement is supported in all data protection rules. Stormshield Data Security encryption support Removable storage and network share data protection rules now support encryption with Stormshield Data Security software. The enhancement is implemented when selecting the prevent action Encrypt, with an option for either FRP or Stormshield Data Security. In addition, classification and tagging criteria have the File Encryption option of Stormshield Data Security encryption. These criteria can be used to define any data protection or endpoint discovery rule. 5

6 Improved printer definitions The Network Printer definition now accepts substrings in the UNC field. Improved exceptions engine Exceptions in data protection rules have been moved to a separate tab. The Conditions tab no longer supports NOT options. On the Exceptions tab, you can create multiple exceptions for each rule. Multiple rule exception pages are treated as AND. Added rule exceptions are disabled by default, but can be enabled from a drop-down list on the page. Summary event for endpoint discovery moved to DLP Incident Manager The summary for each scan run is now exported to DLP Incident Manager. It is no longer treated as an operational event. A McAfee epo server task migrates McAfee DLP Endpoint summary events to the DLP Incident Manager. True file type support in removable storage file access device rules Removable storage file access device rules now support true file type in addition to file extension and file name. Installation instructions The McAfee DLP extension is installed in McAfee epo. The McAfee DLP Endpoint client is available in two versions, one for Microsoft Windows and one for OS X computers. The recommended installation of the client software uses the McAfee epo infrastructure for deployment to the endpoint computers. You can also deploy McAfee DLP Endpoint client software to your network using third party enterprise software deployment tools. For information about installing McAfee DLP Endpoint, see the McAfee Data Loss Prevention Endpoint Product Guide, version Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: KB Find product documentation On the ServicePortal, you can find Information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, select Product Documentation. 3 Select a product and version, then click Search to display a list of documents. 6

7 Product documentation Every McAfee product has a comprehensive set of documentation. See this documentation for your product version: McAfee Data Loss Prevention Endpoint Release Notes McAfee Data Loss Prevention Endpoint Product Guide Help modules are automatically included with the product installation. Copyright 2015 McAfee, Inc. Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others. 0-A00