McAfee Network Data Loss Prevention (DLP) Monitor

McAfee Network DLP Monitor Overview:

McAfee Network DLP Monitor enables you to find, track, and protect sensitive information from any application or location, in any format, over any protocol or port, over time. Unrivaled data analytics supports easy, accurate policy creation and rapid, flexible response.

Description:

With McAfee Network DLP Monitor, gather, track, and report on the data in motion across your entire network, over time. Building a wealth of information about data usage patterns supports better decision making and provides greater insight. By detecting more than 300 content types traversing any port or protocol, Network DLP Monitor easily uncovers unknown threats to your data so you can quickly take action to protect it.

Network DLP Monitor’s industry–leading data scanning and analysis examines network traffic at a deeper level than any other solution on the market. Real–time discovery quickly details how data is being used, who is using it, and where it’s going, providing you with information you can act on. Network DLP Monitor stores all analysis and classification results in a secure, easily searchable database, so you can assess risk, ensure compliance, and protect sensitive data—without the need for lengthy and incomplete data inventory projects.

Scan and Analyze Information in Real Time
Integrated into the network using a SPAN or tap port, McAfee Network DLP Monitor performs real-time scanning and analysis of network traffic using its industry-leading classification engine that provides a deeper level of data inspection than any other solution on the market today.

Discover Risks Not Previously Considered
Through detailed classification, indexing, and storage of all network traffic— not just information that matches its real-time rules— McAfee Network DLP Monitor allows you to quickly leverage historical information to understand what data is sensitive, how it is being used, who is using it, and where it is going.

Complex Data Classification
McAfee Network DLP Monitor empowers your organization to scan all kinds of sensitive data— from common, fixed-format data to complex, highly variable intellectual property. Object classification mechanisms include:

• Multi-layer classification
• Document registration
• Grammar analysis
• Statistical analysis
• File classification

View Incident Reports to Inform Action
Once traffic is scanned, analyzed, and classified by its classification engine, McAfee Network DLP Monitor stores all the pertinent information in a proprietary database. With easy access to this information, you can take action to address these threats by applying a range of actions to ensure compliance with regulations and protect sensitive data.

Benefits and Features:

System Requirements:

McAfee Network DLP Monitor is supported on either the Network DLP Monitor 1650 appliance (1U) or the Network DLP Monitor 3650 appliance (3U).

Network DLP Monitor supports indexing and storage for objects found in motion. The Network DLP Monitor 1650 appliance (1U) provides 500 GB of usable storage capacity, and the Network DLP Monitor 3650 appliance (3U) provides 6 TB of usable storage capacity. For environments where the amount of information exceeds storage capacity or higher levels of retention are required, multiple devices can be deployed or an external storage array can be attached.

Platform Specifications:

McAfee Network DLP Appliance 1650:

Form factor: 1RU
Dimensions: 17 1/4"W x 27 3/4"D x 1 3/4"H
Weight: 39 lbs.
Optional expansion cards: External storage interconnection card
Datastore capacity: 500 GB
Drive bays: 4
Disk capacity: 500 GB
Disk technology: SATA2
RAID: RAID–1
System memory: 16 GB
System fans: 5 cooling fans
Operating temperature: 10°–35° C / 50°–95° F
Humidity range: 8%–90%, non–condensing
Power supply: Redundant hot–swappable 650 W AC–DC power supply, 100–240V AC, 50–60 hertz
Power Supply Safety/EMC: USA-UL/Canada-CUL/Germany-TUV/EN 60950 Compliant/IEC 60950 Compliant/CB Report/CCC Certification
Network Interfaces: Two 10/100/1000 copper network interface

McAfee Network DLP Appliance 3650:

Form factor: 3RU
Dimensions: 17 1/4"W x 25 1/2"D x 5 1/4"H
Weight: 72 lbs.
Optional expansion cards: External storage interconnection card
Datastore capacity: 6 TB
Drive bays: 16
Disk capacity: 500 GB
Disk technology: SATA2
RAID: RAID–1 and RAID–5
System memory: 16 GB
System fans: 5 cooling fans/redundant rear exhaust fans
Operating temperature: 10°–35° C / 50°–95° F
Humidity Range: 8%–90%, non–condensing
Power Supply: Redundant hot–swappable 800W AC–DC power supply, 100–240V AC, 50–60 hertz
Power Supply Safety/EMC: USA-UL/Canada-CUL/Germany-TUV/EN 60950 Compliant/IEC 60950 Compliant/CB Report/CCC Certification
Network Interfaces: 210/100/1000 copper network interface

Technical Specifications:

Configurations Supported
McAfee Network DLP Monitor is supported on either the McAfee Network DLP Monitor 1650 Appliance (1U) or the McAfee Network DLP Monitor 3650 Appliance (3U).

Capture and Index Capacity
The McAfee Network DLP Monitor Appliance supports indexing and storage for objects found in motion. The McAfee Network DLP Monitor 1650 Appliance (1U) provides 500GB of usable storage capacity, and the McAfee Network DLP Monitor 3650 Appliance (3U) provides 6TB of usable storage capacity. For environments where the amount of information exceeds storage capacity or higher levels of retention are required, multiple devices can be deployed or an external storage array can be attached.

System Throughput
Up to 200Mbps of full content analysis, indexing, and storage throughput per McAfee Network DLP Monitor Appliance is available. For networks with higher throughput requirements, multiple devices can be used in a load-balanced configuration.

Network Integration
The McAfee Network DLP Monitor Appliance integrates passively into the network using either a SPAN port or a physically-inline network tap (optional).

Content Types
The McAfee Network DLP Monitor Appliance supports file classification of over 300 content types, including:

• Office Documents
• Multimedia Files
• Source Code
• Design Files
• Archives
• Encrypted Files
• Built-in Policies
• Intellectual property

Protocols Supported
The McAfee Network DLP Monitor Appliance supports all transmissions over any protocol or port utilizing TCP as a transport protocol. Classification of application based on PDUs, byte signatures, and statistics, not by port number. Protocol handlers for both common and uncommon protocols such as HTTP, HTTPS, SMTP, IMAP, Skype, IRC, LDAP, DASL and more.

Built-In Policies
The McAfee Network DLP Monitor Appliance provides built-in policies and rules for common requirements including:

• Compliance: For example, PCI, GLBA, HIPAA, SOX, Personally Identifiable Information, Patient Health Information, SSN, CCN, stripe data, financial information, etc.
• Intellectual property: For example, source code, internal memos, product documents, patent applications, business strategy documents, pricing information, etc.
• Acceptable use: For example, resumes, discrimination, harassment, violence, inappropriate language, weapons, user account information.

Remediation
The McAfee Network DLP Monitor Appliance supports notification to senders, recipients, content owners, or system administrators using configurable notification messages.

Documentation:

Download the McAfee Network DLP Monitor Datasheet (PDF).