Unable to detect encrypted removable media transfer on Mac

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

While copying files with PII to removable storage that uses the customer is unable to get  DLP detections / blocking.

Environment

McAfee Removable Media Protection

15.8.xxx Edpa

Macos 10.15, 11.x, 12.x

Resolution

Enabling AFAC and adding the vendor process to Global Application Monitoring list in Enforce is recommended. This vendor process is the one that is writing to the Removable Drive after encrypting the Data.

Suggested that the process on MacOS to be added is named - "McAfee Removable Media Protection".

Additional Information

Please note:

Adding third party applications do not guarantee results.

While the Symantec DLP agent will make every effort to inject and monitor any application that you add, the results will vary from application to application. Symantec DLP cannot test every application in the world and provide compatibility with the same. Therefor we recommend that you thoroughly test any application that you add, and retest any time that application has an update, as well as any time there is an update to the DLP agent or operating system.

If you have a high priority application feel free to submit a feature request to provide official support of the application.