Secure Access - DLP RealTime

Welcome to the presentation on Cisco Secure Access, focusing specifically on data loss prevention with a spotlight on real time policies. Today, we'll explore how Cisco leverages advanced technologies to protect sensitive information as it traverses through organizational networks and.00:04Services. Let's begin by reviewing today's agenda. 1st, we will cover an overview of the real time policies for data loss prevention. This will include an explanation of how these policies function and their significance in maintaining security integrity within an organization. After that, we will proceed to a practical demonstration.00:20Showcasing these concepts in action. A DLP real time policy in Cisco secure access is used to monitor and protect sensitive data as it moves in real time across your organization's web traffic and endpoint channels. Real time DLP rules inspect web requests, file uploads, and transfers to external devices such.00:39Says usbs, network shares, Bluetooth and local/network printers. These rules help detect and prevent data exfiltration or policy violations by monitoring for specific types of data, file properties, and user actions.00:59Here, we explain how real time rules are structured and enforced. A rule specifies which traffic or files are monitored, including their identities and destinations. It also defines the type of content or document properties to be checked and determines if the action should be to monitor and log or to block the transfer altogether. Additionally, real time rules support scanning not only.01:14Web uploads and file transfers, but also forms data, embedded files, and document properties.01:34Next, let's take a look at how these policies are implemented and managed within the Cisco Secure Access. Go to secure policy data Loss prevention policy. Click add rule and select real time rule.01:42Now, let's enter a meaningful name, description, and set the severity, helps filter/report events, then select data classifications. Choose which sensitive data types to scan for it can be content, file names or both. Here, we have the files control section. Through this interface, you can.01:59Include various filters such as file labels, sizes, and types which the rule will inspect. This level of customization ensures that your organization's specific data management and security needs are met, providing a comprehensive approach to data protection.02:19Now, let's configure identities and destinations. You can specify which identities are included or excluded from the rule and select destinations for applying or excluding the rules. Here, we can choose between two actions for the rules monitor or block. The monitor option allows us to track content through destination and identity trees.02:36Traffic without interfering with data flow. Alternatively, selecting block prevents content uploads and posts from proceeding. These choices are critical for tailoring data loss prevention measures to align with organizational needs.02:56Below the action settings, we have user notifications configurations. This feature enables notifications to be sent to users whenever a rule is triggered. Options include enabling pop up notifications, which alert the user directly on their endpoint and configuring email notifications to inform recipients via email messages. This ensures that stakeholders are promptly informed.03:08Formed of any security incidents.03:28The following report illustrates an instance where a DLP rule has been triggered. This example captures an attempt to upload a PDF containing sensitive information, allowing us to review both the file name and the user responsible for the action because the policy was configured to monitor. The user was permitted to transmit the file. However, the activity remains visible for review.03:31View via secure access. Thank you for watching this video.03:51