Data Loss Prevention
The FortiADC Data Loss Prevention (DLP) module prevents sensitive data from leaving or entering your network by scanning for various patterns while inspecting traffic passing through the FortiADC. Data matching defined sensitive data patterns is blocked, logged, or allowed when it passes through the FortiADC.
The FortiADC DLP module has integrated with the FortiGuard DLP service, allowing FortiADC to download DLP signatures directly from FortiGuard to enrich the FortiADC DLP signature data types. For more information, see FortiGuard DLP service.
Alternatively, Data Loss Prevention can still function without the FortiGuard DLP service. You can still configure a DLP Policy to defend against data loss using only Sensitive Data Type.
The DLP module is configured based on the following components:
|
Component |
Description |
|---|---|
| DLP Policy |
Define rules for matching a sensor based on file content or an HTTP Payload, and the email protocol being used to attach files. It also allows you to choose the action to allow, log, or block the address. |
| Sensitive Data Type | Define the type of pattern that DLP is trying to match. For example, this can be a predefined type including credit card or US social security number (SSN), or you can use keyword, regular expression, or a hexadecimal value to match data. |
| DLP Sensor |
Define which dictionaries to check. You can match any or all dictionaries. It can also count the number of dictionary matches to trigger the sensor. Note: This DLP component requires the FortiGuard DLP service to be enabled. |
| DLP Dictionary |
Combine multiple data type entries to match all or any. When selecting a data type such as keyword, regex or hex, define the pattern that you are looking for. Note: This DLP component requires the FortiGuard DLP service to be enabled. |
In the backend, DLP uses Hyperscan to perform a one-parse algorithm for scanning multiple patterns. This allows DLP to scale up without any performance downgrade.
Basic configuration
To deploy Data Loss Prevention, follow the workflow below:
- Configure the DLP Dictionary to define the collection of data type entries to use in the DLP Sensor. For details, see Configuring a DLP Dictionary object.
- Configure the DLP Sensor to define which dictionary to check. For details, see Configuring a DLP Sensor object.
- Configure the Sensitive Data Type to define the type of pattern that DLP is trying to match. For details, see Configuring a Sensitive Data Type object.
- Configure the DLP Policy to define the rules for matching a sensor or sensitive data type. For details, see Configuring a DLP Policy.
- Apply the DLP Policy to a WAF profile. For details, see Configuring a WAF Profile.