Typically, users from the home PC use the VPN connection to connect to systems in the corporate network, and use Remote Desktop Protocol (RDP) to access systems on the corporate network. It's possible that some of the classified data can get copied to the personal systems.
Windows generally has
rdpclip.exe, which is invoked on the remote PC when RDP is initiated. It's responsible for copy-paste operations between the remote client PC and the host from where the Remote Desktop Connection starts.
To prevent the data being copied from the corporate or organization's system to the personal system, you must configure the
Application File Access Protection rule in DLP Endpoint.
To configure the
Application File Access Protection rule, perform the following steps:
- Log on to the ePolicy Orchestrator (ePO) console.
- From the ePO menu, go to Data Protection, DLP Policy Manager.
- On the DLP Policy Manager page, click the "Rule set" you want to use.
- On the Rule set page, click the Data Protection tab and click Actions, New Rule, Application File Access Protection.
- On the Application File Access Protection page:
- Rule Name: Enter a name for the rule.
- Description: (Optional) Provide a description for the rule.
- Under the Conditions tab:
- Classifications: Click the three dots, select the classification you want, and click OK.
- Applications: Click the three dots, select the "Rdpclip [built-in]” definition, and click OK.
- Under the Reaction tab:
- Action: Select Block from the drop-down list.
- User Notification: Click the three dots and select the notification that needs to be displayed to the user.
- Report Incident: Select the checkbox.
- Click Save and then Close.
- On the DLP Policy Manager page, click the Policy Assignment tab.
- Click Edit next to the Policy Settings for the DLP Policy that uses the new rule, and then click Apply Policy to apply the changes.
