Policy Guide › Intervention Setting › Intervention Setting: Enforce Encryption

Intervention Setting: Enforce Encryption

Available for: Outgoing Emails, Data In Motion

Not available for: Incoming Emails, Web, Data At Rest. Files and webmails detected by the NBA; see the note below.

Important! Do not choose this intervention option for your NBA triggers. The NBA cannot send encryption warnings or enforce encryption when it detects unencrypted files and webmails. Consequently, such webmails and files are sent or copied without encryption.

Choose Enforce Encryption to ensure that sensitive emails are encrypted before they are sent or that sensitive files are encrypted before they are copied to a removable device such as a USB drive. When CA DLP detects these operations, it warns the user. The user can encrypt their email or file, or they can cancel the operation. They cannot send an unencrypted email or copy an unencrypted file.

Emails

For emails detected by a CA DLP endpoint agent, CA DLP displays a warning dialog to the email sender. The sender can choose one of the following:

Encrypt

CA DLP inserts an 'encryption request' x-header into the email. This x-header is subsequently detected by a third-party encryption provider, which in turn encrypts the email before it leaves your network.

Cancel

The email is not sent.

For emails detected by a CA DLP email server agent:

• If server-side interactive warnings are not enabled, CA DLP automatically encrypts the email before sending it.
• If server-side interactive warnings are enabled, CA DLP sends a warning email to the sender. If the sender replies to the warning promptly, their original email is released and sent encrypted to its intended recipients. If they do not reply (or reply too late), their original email is disposed of without being sent.

Important! If server-side interactive warnings are enabled, make sure that the message to users in the warning email clearly explains the consequences of replying and not replying! In particular, note the different reply handling for the Advise Encryption and Enforce Encryption options.

Data In Motion

When the warning displays, the user copying the file can choose one of the following:

Encrypt

CA DLP prompts the user for a password, and uses this password to encrypt the file on the removable device.

Cancel

The file is not copied.