DLP
When copying content from Box Drive to an external volume, Sophos DLP is unable to capture information about this event.
According to the Sophos team, this is a result of Box Drive relying on a legacy file system filter driver, CBFS.
It is suggested that Box update Box Drive to work with Windows file system minifilter drivers as opposed to CBFS. That way DLP could monitor and capture these events.
Statement from Microsoft regarding legacy file system drivers as opposed to minifilter drivers: https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/blocking-file-system-filter-drivers
2
votes
Anonymous
shared this idea