Easy remediation for false positives: Balance productivity and security

ManageEngine Endpoint DLP Plus is a functional tool that focuses on striking the right balance between employee productivity and endpoint security by making it easy to reduce the number of false positives. This helps organizations avoid wasting precious time tending to false security concerns so they can prioritize the high risk ones instead.

Reducing false positive occurrences in a DLP solution

Minimizing false positive events has been a challenge for DLP tools since the very beginning. Frequent false positives in a DLP solution can hamper productivity. It is time-consuming for sysadmins to sort through hundreds of false positive tickets everyday.

False positives in a DLP solution commonly occur when policy discrepancies arise due to the cookie-cutter approach used in content detection and matching. An everyday example of this is when numbers present in a document are mistaken for a credit card number or a PIN due to the same number of digits in them and thus marked as sensitive. Information classified as sensitive by a configured policy could lead to one of the following circumstances in the end user's system:

• The information is present in the file, but the user does not see it as sensitive content that needs to be blocked.
• The file does not contain the information, but it was mistakenly detected as sensitive.
• The end user wants to transfer a file containing the sensitive information to a user outside the organization.

Endpoint DLP provides a single step solution to remediate false positives. When a false positive is raised by the end user, Endpoint DLP examines the false positive and offers a tip to easily fix the same. This tip points out how the policy applied on the file can be altered to remediate and prevent the false positive from recurring again. Sysadmins can further fine tune the policy or allow the end users to overrule the event in keeping with the necessity.

Advantages of using Endpoint DLP Plus to combat false positive incidents

• One-click mitigation of incidents thereby causing minimum hindrance to workflow.
• Accurate content detection using advanced techniques such as fingerprinting, keyword search, and RegEx.
• Custom policies that can be fine-tuned effortlessly to accommodate changes.
• Authorization to override false positive events provided to privileged users to ensure smooth functioning.
• Comprehensive audits and reports that extends better visibility into the network.