Web Gateway 7.1.5 Product Guide - McAfee

Preventing data leaks
Proxies and caching
Preventing data leaks 3
When you are running the appliance together with a DLP (Data Leakage Prevention) solution that uses
an ICAP server for the filtering process, you can implement a rule set to ensure the smooth flow of data
between the appliance and the ICAP server. This section describes the rule set and the settings that are
implemented with it.
The DLP solution that you can run together with the appliance is named nDLP. Its purpose is to filter
data that users want to upload from your network to the web in order to prevent data leaks. An ICAP
server is used by the solution for the filtering process. The data flow is as follows:
• Data sent from the client systems of your users is forwarded to the appliance.
• The appliance provides an ICAP client that sends REQMOD requests with the user data to the ICAP
server that is part of the DLP solution.
• The requests are filtered on the server by modifying them according to the ICAP protocol and passed
on to the web servers that are the destinations of the requests.
After importing the Data Leakage Prevention rule set from the rule set library, rules are executed on
the appliance to handle the sending of requests to the ICAP server.
According to these rules, a request is not forwarded if:
• The body of the request contains no data and the request does not include URL parameters.
• The body of the request exceeds a given size (default: 50 MB).
Together with the rule set, settings are imported that you need to configure. These include a list of the
ICAP servers that the appliance can forward requests to. You can also configure the ICAP client on the
appliance not to open more connections for sending requests than a particular ICAP server can handle
at the same time.
For more information, see Import a rule set and Data Leakage Prevention.
Data Leakage Prevention
This section describes the rules in the Data Leakage Prevention library rule set.
For general information on understanding and handling rules, see Rules and rule sets.
Library rule set — Data Leakage Prevention
Criteria — URL.Host does not equal “ ”
Cycles — Requests (and IM) and embedded objects
The rule set criteria specifies that the rule set applies when a host name can be found for a URL that is
sent in a request to the appliance.
The rule set contains the following rules:
Skip requests that do not carry information
Body.Size equals 0 AND ListOfString.IsEmpty(URL.Parameters) equals true –> Stop Rule Set
The rule uses the Body.Size property to check whether a request has a body that is empty. It also
uses the ListOfString.IsEmpty property to check whether a request has URL parameters. If one of
the two parts of this criteria is matched, processing of the rule set stops and the request is not
forwarded to the ICAP server.
McAfee Web Gateway 7.1.5 Product Guide 73