Prevent data leaks from SaaS apps

Using Protected Browser, you can prevent unauthorized data transfers from your SaaS applications.

Key steps are as follows:

1. Create an application group that contains the applications you want to protect. See Create an application group.
2. Create an allow policy for selected user and application groups and apply the required data controls. See Create an allow policy for selected users.
3. Create a block policy to prevent all other users from accessing those applications. See Create a block policy for all other users.

Requirement

Make sure users can access the SaaS applications only through Sophos Protected Browser and not through another browser. To do this, configure browser enforcement. See Protected Browser enforcement.

Create an application group

Create an application group that contains the applications you want to protect.

To create an application group, do as follows:

1. Go to My Products > Protected Browser > Policy objects.
2. Click Add object and select Application group.
3. Enter a name for the application group.
4. Search for the applications you want to protect and select them.
5. Click Save.

Create an allow policy for selected users

Create an allow policy for the selected user and application groups, and apply the required data controls.

To create an allow policy, do as follows:

1. Go to My Products > Protected Browser > Web policy.
2. Click Add policy.
3. Enter a name for the policy.
4. Keep the action as Allow.

5. In User group, click Edit.

   

6. Search for the user groups you want to apply the policy to and move them to Assigned.

7. Click Save.
8. In Application group, select the application group you created for your SaaS applications.

9. Configure Download protection. For example, select Block all downloads.

   For more information, see Download protection.

10. Configure Upload protection. For example, select Block all uploads.

    For more information, see Upload protection.

11. Configure Data boundaries as required.

    For more information, see Data boundaries.

12. Turn on Enforce use of full browser if users must access the applications through the full browser instead of the browser extension.

13. Click Save.

Create a block policy for all other users

Create a block web policy to prevent all other users from accessing those applications.

To create a block web policy, do as follows:

1. Go to My Products > Protected Browser > Web policy.
2. Click Add policy.
3. Enter a name for the policy.
4. Change the action to Block.
5. Select the application group you created for your SaaS applications.
6. Click Save.

7. In the Policies table, move the allow policy above the block policy by changing its policy rank. See Update policies.