We have MAC OS for our developers (running with root). We also deploy an DLP endpoint agent. Now what happens, in some cases they just sudo and uninstall the agent because it slows down the machine. What options do we have to prevent them doing that ? I guess technically there's probably nothing that can be done, right ?


I know this is not the answer your want, but from a security perspective, the right answer is removing admin privileges and granting them more specific permissions if needed. Giving your users full admin rights are the best way to a full ransomware outbreak and other fun stuff you don't want to live through.

Unfortunately, you're probably living in the real world with bosses and other fun stuff, who claims local admin rights for users are just fine. In that case some DLP agents can be configured to require a password(seperate from the machine) to start the uninstall process. If the DLP tool you're using doesn't provide this configuration option you could install a monitoring tool(or cron job) on the endpoints that continuously checks for a running(or just installed) DLP service and if the service stops working, sends you an email or create an alert in your monitoring or SIEM tool. Depending on your infrastructure there are many ways to do this but generally you should try to avoid false positives. One way is to only alert whenever a DLP agent has not responded for a few days(if your company is okay with that risk) and then gather the information to a monthly report to monitor the development.

Another way to fix the issue would be with people skills. Assuming you've already tried to talk with the devs about not uninstalling your tools, work with HR or C-level to communicate this message and you'll see how easy it is to change people's minds when their job security is on the line ;-)

  • The DLP endpoint agent provide a challenge-response mechanism but only for Windows. After a short evaluation it looks like DLP on MAC OS is still years behind Windows. Installing any additional tool for monitoring does not help to much as again with full admin rights they can do whatever they want to do. Also, regarding the cronjob / SIEM that would probably give some information but the management console for the DLP product has reporting functionalities as well (to see when was the last time the agent checked-in) but that would work if connected via a VPN or direct connection). – cyzczy Aug 9 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.