Getting Started with Versa Data Loss Prevention for Exact Data Match

Internet Protection Rule

An internet protection (or private app protection) rule is required to match the desired traffic for DLP scanning.

The configuration examples are validated using DLPTest. To avoid having the DLP engine scan all other traffic, use a rule named DLPTEST that matches on a custom URL category called DLPTEST. The traffic is analyzed by the DLP engine using the MY-DLP-PROFILE profile.

The DLPTEST URL category is configured in a very simple way by matching on the "dlptest.com" pattern. 

DLP Profile

DLP profiles are configured under Configure > Secure Services Edge > Real-Time Protection > Profiles > Data Loss Prevention  > DLP Profiles in Concerto.

The MY-DLP-PROFILE used in the examples is configured as follows:

• A single rule is attached, and is then extended with another rule.
• Logging is enabled.
• Exit on first match (exit) is disabled. This means that all listed DLP rules are checked. If it is enabled, the DLP engine does not check further rules after the first match.
• Default Action is set to Allow. This means that if no rule has been matched, the flow is allowed.

Data Patterns

The DLP engine does not search simply for the exact data in the document; it first looks for data of the given data type. In the above example, the DLP engine looks first for email addresses and last names and then checks if they match the given data. The definition of how an email address or a last name should look like is defined in the EMAIL_ADDRESS and LAST_NAME data patterns.

Versa Security Packages (SPacks) deliver and update built-in data patterns. For each pattern, there is a defined keyword, proximity, and data regexp. The keyword such as “email” must be present before the actual email address. Once the keyword is found, the DLP engine looks for the data regexp within proximity, also called the range window. Proximity is the number of bytes between the keyword and the data. Generally, it is between 25 and 200 bytes. 

For example, here is the definition of the EMAIL_ADDRESS built-in data pattern:

Keyword (case insensitive): (email|mail-id|e-mail|mail addres)
Data (regexp): ([a-zA-Z][0-9a-zA-Z._-]{0,25}\x40[a-zA-Z0-9._-]{1,25}\x2e[a-zA-Z]{2,3})
Proximity: 100

The details of the built-in data patterns can be found in the official documentation (see Additional Information below).

Example 1—DLP Rule Matching on Last Name or Email Address

In Example 1, a rule is created to block an uploaded .txt file if it contains one of the last names and email addresses. There is no correlation between the data, so the rule will match on any combination of the email addresses and last names. 

1. Create a new EDM rule in Concerto under Configure > Real-Time Protection > Profiles > Data Loss Prevention (DLP) > DLP Rules.
2. Click Create Expression and provide the data expression name, data pattern, and data list. The expression name is used only for the Boolean operation to specify the match condition. 
   
   
    
3. Click Next and select file type as Txt.
   
   
    
4. On the next screen, select upload as activity and select HTTP and all three contexts. 
   
   NOTE: the protocol is HTTP, because the flow must be TLS Decrypted. 
   
   
    
5. Click Next and leave the file exclude empty. Click Next again. 
   
   
    
6. On this screen, set the action to Block, enable logging, and select DLP Violation Type and Severity. These last two are used only for logging purposes. Click Next.
   
   
    
7. The last step is to set the name of the rule. 
   
   

The rule must be associated the MY-DLP-PROFILE DLP Profile:

In this case, the rule order does not really matter since there is only one rule. 

On the next screen, HTTP and HTTPS are selected as applications: 

On the next screen, the file reputation is not relevant for our case.

On the Action screen, the Default action is set to Allow and logging is enabled. This means that when there is no match on any of the DLP rules, the flow is allowed. 

Example 1—Validation

To test this DLP rule, the following text file is uploaded to DLPTest:

When uploading the text file, a notification of a policy violation displays, as shown below.

In Versa Analytics, under DLP logs, you can see which file triggered the DLP action and which patterns were matched:

 

Example 2—Custom Data Pattern

The built-in data patterns can cover many cases, but they have their own limitations. For example, the keywords are only in English, and they are just covering the most common keywords. There are also some data patterns which are not available.

In Example 2, a new data pattern is created to cover the International Bank Account Numbers (IBAN) and is used in a DLP rule to match on a certain set of data.

Here is the IBAN data pattern:

This custom data pattern:

• Expecting the keyword (case-insensitive) IBAN 
• Matching on regexp “\b([a-zA-Z]{2}[0-9 ]{14,33}[0-9])\b”
• Use any publicly available regexp check (e.g. regexp101) for developing and checking your regular expressions 
• The proximity is set for 100 characters from the keyword (Range Window)

A new DLP rule, EDM-DEMO-IBAN, is configured to match two IBAN numbers. You can see that one IBAN is defined with spaces, the other is without spaces. Both are valid, however the DLP engine does not do any normalization and matches only on data exactly provided in the Data List. The other configuration items of the rule is the same as in the previous example (EDM-DEMO-RULE1).

This new rule is added to the existing MY-DLP-PROFILE as a second rule. The order does not matter in this case, because the two rules match on two different data type and data set. 

Example 2—Validation

After the configuration is published in Versa Concerto and the client is connected to the Versa Cloud Security Gateway, the following test file is uploaded to DLPTest:

The upload was blocked by the gateway and a notification was sent to the user, because the second IBAN number was detected. You can see that the keyword “IBAN” check is not case-sensitive.

In the DLP logs in Analytics you can see that that the DLP engine blocked the file. Note that the gateway maintains a cache, so if the same file (checked with a hash) is uploaded multiple times, the original action is taken. 

The data in the file must exactly look like it is specified in Concerto. In the example below, a space is removed from the second IBAN (highlighted). It is still a valid IBAN number and the regexp will match, but it does not match the specified data because one space is missing.

When the file is uploaded to DLPTest, it is not blocked: