Resolving user experience issues when monitoring the Chrome browser with DLP 15.8.x Agents

Data Loss Prevention

4 more products

19755

08 December 2021

08 December 2021

Customers of Symantec Data Loss Prevention 15.8.x have reported that Windows end users experience issues when using the Chrome browser and the DLP Agent is configured to monitor Chrome. This advisory provides details about how to address such issues. 

Background: Prior to DLP 15.8, the DLP Agent “hooked” into the Chrome browser to monitor HTTPS activity. Beginning with DLP 15.8, the DLP Agent architecture changed in response to Chrome changes; in the new architecture, file uploads are monitored through an extension that is loaded in the browser. However, based on customer feedback, the changes in the monitoring mechanism have a negative impact on end-user experience when Clipboard paste operations are used. 

Workaround: To ensure a positive user experience while the DLP Agent monitors Chrome, DLP 15.8.x customers can selectively disable Clipboard Paste monitoring by using an advanced agent setting in the DLP Agent configuration. While the solution as described here means that Chrome Paste monitoring will not work, all other aspects of Chrome browser monitoring will work. 

Note: Symantec is working on restoring support for Chrome Clipboard Paste monitoring, and that support will be included as part of an upcoming release. The workaround described here is a temporary solution to ensure that users continue to have an optimal experience when using Chrome. 

To implement the workaround for Windows DLP Agents: 

  1. Download the DisableBrowserClipboardAdvancedSettings.zip from the Symantec Data Loss Prevention Download Portal. (The file is with other Data_Loss_Prevention_15.8_MP_Server files at the Download Portal.)
  2. Extract the DisableBrowserClipboardAdvancedSettings.sql file from the zip file.
  3. Log on to the DLP Oracle Server as the protect user.
  4. Execute the DisableBrowserClipboardAdvancedSettings.sql file.

This adds one advanced setting in the Agent Configuration, ENABLE_BROWSER_CLIPBOARD_MONITORING. The default value is 1.

  1. Change the value of the setting to 0. 
  2. Save the configuration(s) and apply for all endpoints.