Data policies: How to create data policies

Protect your data from leaking out of your company. Learn how to set up data policies and configure additional sections, including data classifications, actions, and options for clipboard and screen capture.

Introduction

Creating data policies is a bit more advanced than creating policies for applications or websites. They work in a similar manner but have more sections that need to be configured. Before creating a data policy, have a look at setting up policies for applications and websites.

How to create a data policy

To create a new data policy, navigate to Policies > Data and Add policy. Data policies have the following extra sections:

1. Data classifications
2. More advanced Policy actions
3. Destination types
4. Options for clipboard and screen capture

1. Data classifications

2.  More advanced Policy actions

You can choose what policy action should happen when the policy is applied (i.e. the user transfers files to a selected destination):

• Allow: The file operation is allowed, and no records are created about it.
• Log: The file operation is silently recorded without the user being notified. The policy silently records both allowed operations and operations that violate the policy.
• Notify: The user is shown a notification that the operation violates a policy.
  • For some data destinations (web upload, email, instant messaging, git), they can decide whether to perform or abort the operation. If they perform it, it is recorded.
  • For other data destinations (print, virtual print, RDP, external storage devices, network file share, cloud drive upload), the operation is performed and recorded. 
  • Allowed activities are also recorded. Safetica does not record: Delete, Create, Rename, Copy/Move within one physical storage (exceptions: destination is a cloud folder).
• Block: Activities that violate a policy are completely blocked and recorded. Allowed activities are only recorded.
• Block (with override): Certain users are allowed to override a blocking policy, if they provide a reason for performing the file operation. The reasoning is linked to the record about the file operation. If they choose to override the policy, the operation proceeds and is recorded; otherwise, it’s blocked and recorded.

What destinations does this policy apply to?

In the drop-down below, you can also select to which destinations and destination groups from your Data destinations the policy will apply. This allows the policy to be specifically applied to files transferred to chosen destinations:

• All destinations: The policy will apply to all data destinations.
• All except safe destinations: The policy will apply to destinations in the Unassigned and Untrusted columns.
• Only safe destinations
• Only unassigned destinations
• Other...: You can choose specific destination groups to which the policy will apply.

Example: In a company, uploads to all file shares are blocked. The only exception is upload to a file share that is part of the company’s intranet and is considered a safe destination.

3. Destination types

The core of each data policy is selecting destination types, such as Email, Web upload, External storage devices, etc.

4.  Options for clipboard and screen capture

Extend your data protection by blocking copying to the clipboard (up to 160 symbols without sensitive content are allowed, more than 160 symbols are always blocked) or block screen capture.

Read next:

Data classification in Safetica

Policies: How they work in Safetica

Policies: How to create them

Auditing policies: what are they

Data destinations: What are they