Sensitive Data Protection
Overview
Sensitive Data Protection detects sensitive values in the browser and protects them at the two points where they are exposed: when they are displayed on a page, and when a user types or pastes them into one.
What counts as sensitive is defined by data types. DefensX provides a library of common personal, financial, health and technical identifiers. Organizations can also define their own data types from keywords, regex, or both, to cover internal terms and record formats.
|
Tip
|
Sensitive Data Protection requires a CORE+ subscription or higher. |
How it works?
In a Sensitive Data Policy, each data type is given two actions: Visual Protection for what is displayed and Data Entry Protection for what is entered. The two are set independently, so a passport number can be masked on screen and blocked on entry.
A policy is applied through a Custom URL Group. The group decides which addresses are inspected, and the policy group where it is assigned decides which users or devices are covered.
Configuration
Adding Data Types
Start with the data types the policy will detect. Navigate to Policies → Sensitive Data Protection and open Data Types.
Click the arrow next to Data Types. From Library opens the built-in set, while Keyword-Based Data Type, Regex-Based Data Type and Combined Data Type are used to define detection of your own.
The library is organized by category. Select a category, then the data types to monitor, and click Add Selected.
The data type now appears in the list, where Assigned Policies shows how many policies use it.
Custom data types are created from the same menu:
Keyword-Based Data Type:
Regex-Based Data Type:
Combined Data Type:
Library data types are placed in their categories automatically, as shown under Data Categories. Adding categories of your own is optional.
Creating a Sensitive Data Policy
With the data types in place, open Data Policies and click Add Policy.
Enter a Policy Name and, optionally, a Description, then click Create Policy. Active controls whether the policy is enforced once it is assigned, so clearing it allows a policy to be prepared in advance and switched on later.
Assigning Data Type Actions
Creating the policy opens Edit Data Type Actions, where protection is set for each data type. Click Add Data Type Mapping.
In Add Data Type Mapping, select the data types to protect.
Visual Protection decides what happens when a match appears on a page. Blur obscures the value but leaves it in place. Persistent Data Masking permanently replaces the value with a mask.
Data Entry Protection decides what happens when a user tries to submit a match. Log Only records the event without interrupting the user. Ask User Consent stops the submission and asks the user for consent, which is recorded for that website. Block stops the submission with no way through. Persistent Data Masking permanently replaces the matched value in the field with a mask, so the original never reaches the destination.
Once the actions are set, click Add Selected.
The selected data type is added to the table, where its actions can still be changed. Click Update Data Type Actions to save the policy.
The policy now appears under Data Policies. Expand it to see how each data type is protected.
Applying the Policy
The policy takes effect once it is assigned to a Custom URL Group. To assign it, navigate to Policies → Policy Groups, open the policy group and go to the Web Filters tab.
Select the policy in the Sensitive Data Protection column of the Custom URL Group.
|
Note
|
The Custom URL Group's Action must be Allow, Isolate or ReadOnly for the policy to be enforced. |
The policy now protects sensitive data on every address in the Custom URL Group.
Viewing Sensitive Data Logs
Matches are recorded under Logs → Sensitive Data Logs. Each entry includes the action taken, the hostname, the user, the policy applied and the date.
Summary
Sensitive Data Protection detects sensitive values through data types and protects them with separate actions for what appears on a page and what a user submits. These actions are set in a Sensitive Data Policy and enforced through a Custom URL Group in a policy group.