This article explains how to use the "Shield Trial Mode" feature, which enables you to test Shield's classification-based security controls in your production environment of Box during a trial, without impacting the Box experience for the majority of your managed users.
Getting startedWhen certain criteria are met, Box enables prospective Box Shield customers to test Shield capabilities through a 30-day trial (also known as proof of concept, or POC). If you're interested in deploying Shield on a trial basis, please contact your account team to request a Shield trial.
Step 1: Select users for the Shield trialAfter Box enables your Shield trial, first determine the Box users in your organization who will test Shield's classification-based access controls. This may be a group of individuals in your IT or Security teams, or a small department or functional team in your organization. As a Shield admin, you can configure a list of users for the Shield trial. Only this group of users will be able to view, apply, or modify new classification labels created for the purposes of the trial. The rest of your managed users, will see no change to their Box experience.
To configure a list of users for Shield trial:
- In the Admin Console's left pane, click Shield.
- In the top of the Shield window, click Access Policies.
- In the top-right corner, click Configure Trial Users. Box displays the Configure Trial Users window.
- Select one of the following options:
- Disable for all managed users
- Enable for all managed users
- Enable for select users (whitelist)
- Enable for everyone except select users (blacklist)
- Box recommends you select Enable for select users (whitelist) to limit the Shield Trial to a small group of users. Type Box users by name or email address. As you type, Box displays names of users you can select (see screenshot below).
- In the bottom-right corner of the window, click Save.
Step 2: Create new classification label(s)Next, create new classification label(s) ("trial classifications") for the purposes of your Shield trial. For instructions on how to create, modify, or delete classification labels, see . If you are already using Box classifications in your Box environment, you will still need to create new classification labels for the Shield trial purposes - for example, [TEST CONFIDENTIAL].
Step 3: Configure Shield Smart Access policiesYou can now create Shield Smart Access policies for your new classification labels, which will be enforced for only the group of Shield trial users. Refer to our Using Smart Access article to .
Step 4: Apply classifications and test policy enforcementYou can now ask your Shield trial users to begin classifying files and folders using the new labels, and test out the access policy enforcement and restrictions. Shield trial users can apply trial classifications to files or folders that are owned by Shield trial users.
IMPORTANTBox recommends your Shield trial users apply trial classifications only to previously unclassified files and folders. If a Shield trial user applies a trial classification to a previously classified file, non-Shield trial users will NOT see a classification on the file. Additionally, Shield trial users will NOT see the Classify option for files or folders that are not owned by a Shield trial user.
Ending the Shield trialAt the end of your 30-day trial, Shield will be disabled from your production environment. All trial classification labels created during the 30-day trial will be permanently deleted, and all files and folders that had a trial classification will become unclassified. All other trial data, i.e., access policies, detection rules, alerts, will also be permanently deleted.