Intervention Setting: Enforce Encryption

Policy Guide › Intervention Setting › Intervention Setting: Enforce Encryption

Intervention Setting: Enforce Encryption

Available for: Outgoing Emails, Data In Motion

Not available for: Incoming Emails, Web, Data At Rest. Files and webmails detected by the NBA; see the note below.

Important! Do not choose this intervention option for your NBA triggers. The NBA cannot send encryption warnings or enforce encryption when it detects unencrypted files and webmails. Consequently, such webmails and files are sent or copied without encryption.

Choose Enforce Encryption to ensure that sensitive emails are encrypted before they are sent or that sensitive files are encrypted before they are copied to a removable device such as a USB drive. When CA DataMinder detects these operations, it warns the user. The user can encrypt their email or file, or they can cancel the operation. They cannot send an unencrypted email or copy an unencrypted file.

Emails

For emails detected by a CA DataMinder endpoint agent, CA DataMinder displays a warning dialog to the email sender. The sender can choose one of the following:

Encrypt: CA DataMinder inserts an 'encryption request' x-header into the email. This x-header is subsequently detected by a third-party encryption provider, which in turn encrypts the email before it leaves your network.
Cancel: The email is not sent.

For emails detected by a CA DataMinder email server agent:

If server-side interactive warnings are not enabled, CA DataMinder automatically encrypts the email before sending it.
If server-side interactive warnings are enabled, CA DataMinder sends a warning email to the sender. If the sender replies to the warning promptly, their original email is released and sent encrypted to its intended recipients. If they do not reply (or reply too late), their original email is disposed of without being sent.

Important! If server-side interactive warnings are enabled, make sure that the message to users in the warning email clearly explains the consequences of replying and not replying! In particular, note the different reply handling for the Advise Encryption and Enforce Encryption options.

Data In Motion

When the warning displays, the user copying the file can choose one of the following:

Encrypt: CA DataMinder prompts the user for a password, and uses this password to encrypt the file on the removable device.
Cancel: The file is not copied.

Note: CA DataMinder cannot encrypt files being copied to network locations. Do not use Advise Encryption or Enforce Encryption control actions to prevent unencrypted files being copied to shared locations on your network.