Scanning for sensitive data leakage in API endpoints (7.6.1)

The ML-based API Protection module now supports the scanning sensitive data leakage in API endpoints. This new enhancement adds another layer of identification and visibility into potential exposure of sensitive information in API requests and responses.

This feature has two key components:

• Built-in Sensitive Data Detection: FortiWeb scans API requests and responses for specific data types, including personal data, files, and more, providing instant detection and highlighting of sensitive information.

• Integration with FortiGuard Data Loss Prevention (DLP) Service: With ML-based API Protection integrating with FortiGuard’s extensive, customizable database of over 500 predefined data patterns and policies, it simplifies DLP deployment and enhances API protection. The FortiGuard DLP service database is continuously updated to incorporate the latest in network security intelligence, ensuring up-to-date data protection. Note that the DLP service scan is applied to API responses only.

  This requires subscription to FortiGuard DLP service (part of the FortiWeb Enterprise Bundle).

Enabling the FortiGuard DLP service

The FortiGuard DLP service is already supported by the Data Loss Prevention module. If you have enabled the FortiGuard DLP service within this module, no further action is needed.

If not, you can contact Fortinet sales team to purchase a separate FortiGuard DLP service license, or a bundled license which combines the FortiGuard DLP service and FortiGuard Advanced Bot Protection service.

Update FortiGuard DLP database

1. Register your license at the Fortinet Customer Service & Support website: https://support.fortinet.com. For information on how to register, see this article.
2. Log in to FortiWeb. Go to System > Config > FortiGuard. Check the status of the FortiGuard DLP service license.
   
   
3. The system will automatically update the DLP database from FortiGuard. If it's not up-to-date, click Update Now under the FortiWeb Update Service Options section on the System > Config > FortiGuard page, or you can run the following command.
   # execute update dldb

The following command is for enabling or disabling FortiGuard DLP service database update. It's by default enabled. config system fortiguard set update-dldb {enable | disable} end

How does the DLP service work in ML-based API Protection

FortiWeb automatically scans API responses for Data Loss Prevention (DLP) violations. This process runs automatically and does not require any DLP configuration within the ML-based API protection settings.

The DLP service scans for the following data types (including but not limited to) in API response.

If a DLP violation is detected on a specific API path, FortiWeb highlights the corresponding warnings in orange for easy identification.

In addition to the DLP service, the ML-based API Protection feature has its own sensitive data type scan for both API request and response. It scans for the following data types:

• Address: Country/region, zip code.

• Automotive: Vehicle Identification Number.

• Financial info: Credit card number.

• Personal info: Phone number, email address, passport number, Social Security Number (SSN), and driver license number.

• Internet: Host name, IPv4, and IPv6 addresses.

• File: Image file.

• Time: Date.

• ID: UUID

When any of these data types are detected in an API request or response, FortiWeb highlights them in blue for quick identification.