Data Loss Prevention

• DLP module prevents sensitive data from leaving or entering your network by scanning for various patterns while inspecting traffic passing through the FortiADC

• The DLP module is configured based on the following components:

  • DLP Policy

  • Sensitive Data Type

  • DLP Sensor

    • Note: This DLP component requires the FortiGuard DLP service to be enabled.

  • DLP Dictionary

    • Note: This DLP component requires the FortiGuard DLP service to be enabled.

• Note:

  • Data Loss Prevention can still function without the FortiGuard DLP service. You can still configure a DLP Policy to defend against data loss using only Sensitive Data Type.

  • In the backend, DLP uses Hyperscan to perform a one-parse algorithm for scanning multiple patterns. This allows DLP to scale up without any performance downgrade.

• For more information

  • https://docs.fortinet.com/document/fortiadc/8.0.0/administration-guide/251493/data-loss-prevention

To deploy Data Loss Prevention, follow the workflow below:

1. Configure the DLP Dictionary to define the collection of data type entries to use in the DLP Sensor.

2. Configure the DLP Sensor to define which dictionary to check.

3. Configure the Sensitive Data Type to define the type of pattern that DLP is trying to match.

4. Configure the DLP Policy to define the rules for matching a sensor or sensitive data type.

5. Apply the DLP Policy to a WAF profile.

FortiGuard DLP service

• This service allow FortiADC to download DLP signatures directly from FortiGuard to enrich the FortiADC DLP signature data types.

  • It uses a customizable database of more than 500 predefined data patterns and policies

  • It has database of predefined DLP patterns such as data types, dictionaries, and sensors.

• If the HTTP payload or files passing through FortiADC contain data that matches the patterns defined in these dictionaries, FortiADC will initiate specified actions to safeguard the data.

• Note:

  • To check the version of FortiGuard DLP database

    • System > FortiGuard > Data Loss Prevention (DLP)

Configure the DLP Dictionary to define the collection of data type entries to use in the DLP Sensor

• A DLP dictionary defines the patterns of data. The term "pattern" denotes a set of attributes specific to a given data type

• E.g.,

  • Credit card numbers constitute numeric data that follow either the 14-digit or 16-digit patterns associated with credit cards. If the data adheres to these patterns, FortiADC will identify it as a match.

• Predefined DLP Dictionary object & FortiGuard Data Types

  • https://www.fortiguard.com/encyclopedia?type=dlp&ots_type=&title_cve=&telemetry=all

• Setting in FortiADC (Web Applicatin Firewall > Data Loss Prevention > DLP Dictionary)

• config security waf dlp-dictionary

config security waf dlp-dictionary
    edit <name>
        set match-type {any|all}
        set description <string>
        config entries
            edit <name>
                set status {enable|disable}
                set fg-data-type {uk-iban|can-natl_id-sin|luhn-algo|can-natl_id-prox|can-pass|usa-pass-1|usa-pass-2|uk-pass|aus-pass|fra-pass|jpn-pass|can-health_service|can-phin|glb-cc-amex|glb-cc-bcgl|glb-cc-cabl|glb-cc-dinr|glb-cc-inst|glb-cc-jcb|glb-cc-kloc|glb-cc-lasr|glb-cc-maes|glb-cc-solo|glb-cc-disc|glb-cc-mc|glb-cc-visa|glb-cc-vsmc|usa-natl_id-ssn|can-dl-ab|can-dl-bc|can-dl-mb|can-dl-nb|can-dl-nl-2|can-dl-nl-1|can-dl-nt|can-dl-nu|can-dl-pe-1|can-dl-pe-2|can-dl-qc|can-dl-sk|can-dl-yt|usa-dl-al|usa-dl-ak|usa-dl-az|usa-dl-ar|usa-dl-co|usa-dl-ct|usa-dl-de|usa-dl-dc|usa-dl-fl|usa-dl-ga|usa-dl-hi|usa-dl-id|usa-dl-il|usa-dl-in|usa-dl-ia|usa-dl-ks|usa-dl-ky|usa-dl-la|usa-dl-me|usa-dl-md|usa-dl-ma|usa-dl-mi|usa-dl-mn|usa-dl-ms|usa-dl-mo|usa-dl-ne|usa-dl-nv|usa-dl-nh|usa-dl-nj|usa-dl-nm|usa-dl-ny|usa-dl-nc|usa-dl-oh|usa-dl-ok|usa-dl-or|usa-dl-pa|usa-dl-ri|usa-dl-sc|usa-dl-sd|usa-dl-tn|usa-dl-tx|usa-dl-ut|usa-dl-vt|usa-dl-va|usa-dl-wv|usa-dl-wi|usa-dl-wy|can-bank_account|usa-natl_id-prox|can-dl-ns|can-dl-on|usa-dl-ca|jpn-swift|usa-swift|usa-dl-nd|usa-dl-wa|uk-swift|deu-swift|fra-swift|aus-swift|chn-swift|can-sin}
                set repeat {enable|disable}
            next
        end
    next
end

• status - Enable it if you intend to apply this data type

• Repeat - Enable this option if you want to match data exclusively when it appears multiple times. With this option enabled, you can specify the times of occurrence in the DLP Sensor settings.

Configure the DLP Sensor to define which dictionary to check

• A DLP Sensor defines which dictionaries to check. You can match any dictionary or all dictionaries. It can also count the number of dictionary matches to trigger the sensor.

• Setting in FortiADC (Web Applicatin Firewall > Data Loss Prevention > DLP Sensor)

• count - Specify the occurrence threshold for the dictionary match. The sensor will be triggered when the dictionary match reaches the specified number of times. Default: 1 Range: 1-255.

  • For example, if the dictionary applies to credit card numbers and the count is set to 4, the sensor will be triggered when credit card number occurs four times in the HTTP request or response.

• config security waf dlp-sensors

config security waf dlp-sensors
    edit <name>
        set match-type {any|all}
        set description <string>
        config entries
            edit <name>
                set status {enable|disable}
                set dlp-dictionary <datasource>
                set count <integer>
            next
        end
    next
end

Configure the Sensitive Data Type to define the type of pattern that DLP is trying to match

• A Sensitive Data Type object is referenced as part of the DLP policy to prevent information, damage and loss by specifying strings as sensitive data.

• Predefined Sensitive Data Type objects

• To define your own

  • Setting in FortiADC (Web Applicatin Firewall > Data Loss Prevention > Sensitive Data Type > Create New)

    • You must have a good understanding of Perl-compatible regular expressions (PCRE)

      • https://www.pcre.org/current/doc/html/index.html

• config security waf sensitive-data-type

config security waf sensitive-data-type
    edit <name>
        set regex <string>
        set description <string>
    next
end

Configure the DLP Policy to define the rules for matching a sensor or sensitive data type

• The Data Loss Prevention (DLP) feature allows the Web Application Firewall (WAF) to prevent information leaks, damage and loss. DLP provides desensitization and warning measures for sensitive information leaks on websites, such as SSN numbers and credit card information, as well as the leakage of sensitive keywords.

• You can create a DLP Policy to match a sensor based on file content or an HTTP Payload, and the email protocol being used to attach files. It also allows you to choose the action to allow, log, or block the IP address.

• Setting in FortiADC (Web Applicatin Firewall > Data Loss Prevention > DLP Policy)

• URI Pattern - Specify the URI Pattern in the Data Loss Prevention rules. Scanning and receiving an empty value means this rule is not working.

• Threshold - The rule will not take effect until the target data exceeds the threshold's specified value. This will not work if Masking is enabled.

• Masking - Enable masking to replace sensitive data with asterisks(*). Default is disable. When masking is enabled, all target data will be replaced by an asterisk(*) so the threshold value won’t take effect here. Masking only works when the action is alert. The connection will be rejected when the action is set as "deny" or "block," so no target data will be replaced.

• config security waf data-leak-prevention

config security waf data-leak-prevention
    edit <name>
        set status {enable|disable}
        set masking {enable|disable}
        set action {alert|deny|block|silent-deny|captcha|<datasource>}
        set severity {high|medium|low}
        config rule
            edit <name>
                set request-uri-pattern <string>
                set type {sdt|sensors}
                set sensor <datasource>
                set sensitive-data-type <datasource>
                set threshold <integer>
            next
        end
    next
end

Apply the DLP Policy to a WAF Profile

• Setting in FortiADC (Web Applicatin Firewall > WAF Profile)

Apply the WAF Profile to a Virtual Server

• Setting in FortiADC (Server Load Balance > Virtual Server > Security > WAF Profile)