Visão Geral

Curso Forcepoint DLP Administrator, você aprenderá como testar uma implantação existente, como administrar políticas e relatórios, lidar com incidentes e endpoints, atualizar e gerenciar o sistema Forcepoint DLP. Você desenvolverá habilidades na criação de políticas de dados, construção de classificadores personalizados e uso de políticas predefinidas, gerenciamento de incidentes, geração de relatórios e manutenção do sistema.

Objetivo

Após realizar este Curso Forcepoint DLP Administrator você será capaz de:

• Crie e use classificadores personalizados
• Use classificadores, regras e políticas predefinidos
• Controle vários canais de possíveis vazamentos de dados – em rede TCP, descoberta e por endpoint
• Manipule incidentes e relatórios
• Configure fluxos de trabalho de incidentes usando TRITON GUI ou e-mail
• Execute o backup e restauração

Publico Alvo

• Usuário final/clientes
• Administradores de sistema,
• Administradores de segurança de rede,
• Equipe de TI Parceiros de canal,
• Engenheiros de vendas,
• Consultores,
• Especialistas em implementação,

Materiais

Conteúdo Programatico

AP-DATA Product and Basic Deployment

1. Forcepoint product overview
2. What is DLP
3. What is new in the 8.x versions
4. Simple Forcepoint DLP deployments, network topology before and after
5. Management consoles
6. Forcepoint DLP key configurations
7. Registering CG and Forcepoint Email Security
8. ICAP-mode Protector
9. Data security in cloud deployments

Forcepoint DLP Components, Transaction Processing

1. Involved machines, OS, virtualization, processes
2. Load Balancing and Policiy Engine Interface (PEI)
3. Processing data transactions, Policy Engine (PE)
4. Testing DLP channels
5. CLI tools to extract plaintext and test policies
6. Custom logic in rule conditions
7. Testing limits of file size, large ZIPs and timeouts.

Custom and Predefined Classifiers

1. Keyphrases and dictionaries
2. Regular expressions
3. File classifiers
4. Script overview. "Supporting terms" near sensitive data; context analysis
5. Credit cards: PCI audit rules, CCN classifiers, Luhn check, prefixes (BINs)
6. Policy exceptions for custom LDAP groups, domains, etc.
7. Cumulative rules (Drip DLP)

Fingerprinting and ML

1. File fingerprinting; possibly with ignored sections
2. Database fingerprinting
3. Scheduling, exporting and synchronizing fingerprints
4. Machine Learning

Data Endpoint

1. Data Endpoint Initial setup
2. EP statuses and disabling them
3. EP profiles, updates and incident reporting
4. Endpoint support for browsers
5. Endpoint support for email clients
6. Hooking application OS calls
7. Unhooking/excluding applications
8. Encryption with User-Defined Key and Profile Key
9. EP and printer drivers, screenshots, optical media, LAN control

Discovery Policies

1. Custom and predefined discovery policies
2. Scheduling file scans, incremental scanning
3. Scheduling scans of SharePoint Online, Outlook PST, etc.
4. Responding to discovery incidents
5. Configuring file discovery on EP
6. Incremental scans
7. FPNE - fingerprint classifiers on EP

Incidents and Reporting

1. Incident manipulation: release, escalation, severity change, assignment, deletion
2. Action plans and notifications
3. Force-release feature
4. Email-based workflow
5. Create a Delegated Admin (DA) with limited permissions
6. Incident reports - exporting from TRITON GUI or with a script
7. Traffic and audit logs

Diagnostics, Backups, Upgrades

1. Inspecting PEI and PE logs; issues with timeouts and load balancing
2. Mega-breaches and performance
3. Gathering diagnostics for issue escalation
4. Archiving incident DB partitions and forensics
5. Full backup and restore of a AP-DATA Forcepoint DLP configuration
6. Semi-automatic failover
7. Forcepoint DLP Manager and system module upgrades, backward compatibility
8. Endpoint upgrades, backward and forward compatibility