Netskope Endpoint Data Loss Prevention (Endpoint DLP) provides data protection at the endpoint by utilizing Netskope cloud DLP capabilities. You can use Endpoint DLP to monitor and govern USB storage devices connected to your endpoint. Endpoint DLP is an optional add-on capability to the Netskope Client and does not require deploying and managing a separate client or agent on the endpoint.
With Endpoint DLP, you can create Device Control and Content Control policies. Device Control policies enable granular control over which devices are allowed and which users can access them. Whereas, Content Control policies enable the full use of Netskope DLP profiles and rules to inspect and control data movement between an endpoint and a USB mass storage device.
To avoid user interaction during deployment, please ensure that full disk access is enabled for all Mac OS systems for which the endpoint DLP service would be deployed.
Within the Customer Zero team, we have deployed endpoint DLP policies in the following manner to monitor and secure data movement between Netskope managed devices and unmanaged endpoint devices (USBs, hard-disks, etc).
Device control policies help define granular control over what are allowed devices, and which users can access them.
Content Control Policies help leverage Netskope DLP capabilities to inspect and control data movement between managed endpoints and external storage devices.
The Incidents -> DLP is a good place to monitor Endpoint DLP incidents and alerts in the Netskope tenant. It gives a detailed summary of DLP incidents that triggered the content control policies for Endpoint DLP, along with forensics (if configured). Forensics help in concluding whether the alert is a false positive or not, and also helps finetine our DLP rules accordingly.
We hope this helps other Netskope admins and CISO groups to outline Endpoint DLP policies and craft them aligning with your use cases. We are also interested in getting your insights on how you have deployed Endpoint DLP in your organization. Please let us know if you have any questions or concerns.
In order to view this content, you will need to sign in to your account. Simply click the "Sign In" button belowSign In