Data Loss Prevention

 View Only

  • 1.  Making a DCM policy to detect 1337 speak and format arrangements

    Posted Feb 14, 2019 10:28 AM

    I'm new to DLP so I'm sorry if this is an obvious solution.

    How would one go about making a DCM policy that detects when the word "Top Secret Document" is detected if it's spelled in a similar fashion to "70P S3cre37" or "Topsec retdocum ent"?



  • 2.  RE: Making a DCM policy to detect 1337 speak and format arrangements

    Posted Feb 19, 2019 06:01 AM

    Hi Mr Lima

     

    How are you getting on with this?

     

    If my solution worked, can you please mark as the resolution?

     

    Thanks

     

    Chris



  • 3.  RE: Making a DCM policy to detect 1337 speak and format arrangements
    Best Answer

    Posted Feb 19, 2019 06:04 AM

    Hi MrLima

     

    Off the top of my head, I'd possibly suggest your data identifiers contain regex (pattern matching) that accounts for various combinations of leet speak that you can think of.

     

    You can also try adding optional validators to your data identifiers that specify required (or excluded) keywords. i.e you can set in optional validators that the keywords you're looking for can include the leet speak variations.

     

    Have a look in Manage>Policies>Data Identifiers and play about in there. I've attached a screenshot to show the screen you're looking for, using credit cards as an example screen.

     

    I'm confident that this should be possible. I think the only limitation is our imagination on different combinations to include.

    Please mark as the solution if appropriate.

     

    Thanks

     

    Chris