Intervention Setting: Enforce Encryption

Policy Guide › Intervention Setting › Intervention Setting: Enforce Encryption

Intervention Setting: Enforce Encryption

Available for: Outgoing Emails, Data In Motion events detected by CFSA.

Not available for: Incoming Emails; Data At Rest events; events detected by the Client Network Agent (CNA). See the warning below.

Choose Enforce Encryption to ensure that sensitive emails are encrypted before they are sent or that sensitive files are encrypted before they are copied to a removable device or a sync folder. When CA Data Protection detects these operations, it warns the user. The user can encrypt their email or file, or they can cancel the operation. They cannot send an unencrypted email or copy an unencrypted file.

Important! Do not choose this intervention option for triggers associated with the CNA.

The CNA cannot enforce encryption warnings when it detects unencrypted data submissions to web sites. Consequently, items such as file uploads are submitted without encryption.

Emails

For emails detected by a CA Data Protection endpoint agent, CA Data Protection displays a warning dialog to the email sender. The sender can choose one of the following:

Encrypt: CA Data Protection inserts an 'encryption request' x-header into the email. This x-header is subsequently detected by a third-party encryption provider, which in turn encrypts the email before it leaves your network.
Cancel: The email is not sent.

For emails detected by a CA Data Protection email server agent:

If server-side interactive warnings are not enabled, CA Data Protection automatically encrypts the email before sending it.
If server-side interactive warnings are enabled, CA Data Protection sends a warning email to the sender. If the sender replies to the warning promptly, their original email is released and sent encrypted to its intended recipients. If they do not reply (or reply too late), their original email is disposed of without being sent.

Important! If server-side interactive warnings are enabled, make sure that the message to users in the warning email clearly explains the consequences of replying and not replying! In particular, note the different reply handling for the Advise Encryption and Enforce Encryption options.

Data In Motion

When the warning displays, the user copying the file can choose one of the following:

Encrypt: CA Data Protection prompts the user for a password, and uses this password to encrypt the file on the removable device.
Cancel: The file is not copied.

Note: CA Data Protection cannot encrypt files being copied to network locations. Do not use Advise Encryption or Enforce Encryption control actions to prevent unencrypted files being copied to shared locations on your network.