The Protector works in tandem with the Data Security server. The Data Security server provides advanced analysis capabilities, while the protector sits on the network, intercepts traffic and can either monitor or block the traffic, as needed. The Protector supports analysis of SMTP, HTTP, FTP, plain text, IM traffic (e.g., Yahoo, MSN, chat, and file transfer). The Protector is also an integration point for third-party solutions that support ICAP.

Most data-loss detection devices can be connected off the network, enabling them to sniff network traffic and monitor breaches. This monitoring method is useful because it does not interfere with traffic; however, it also does not enable the loss-prevention system to prevent (block) data losses - only to note and report them. In addition to monitoring mode, user can connect the Forcepoint Protector to the network directly in the path of the traffic, enabling traffic to be blocked, quarantined and even terminated before it reaches its destination.

Features

• If it wants to monitor SMTP traffic, the Protector is a good choice. User can configure a span port to be connected to the Protector. This span contains the SMTP traffic.
• If it wants email blocking capabilities, user can use either the Protectors explicit MTA mode or the SMTP agent.
• If it wants to monitor or transparently block HTTP traffic, user can use the Protector to do so, or user can integrate Data Security with Forcepoint Content Gateway or another Web proxy.
• If it wants to monitor FTP, plain text, or IM traffic, user should use the Protector. Note that the Protector cannot block traffic on these channels. User can block FTP using Forcepoint Content Gateway (as a DLP agent) or other Web proxy that buffers FTP and supports ICAP.
• The first decision that needs to be made when installing a Protector is its location on the network. User can deploy the Protector in SPAN/mirror port mode or in inline mode.