All Products
Search
Document Center

Web Application Firewall:Configure data leakage prevention

Last Updated:Jun 08, 2023

After you add a website to Web Application Firewall (WAF), you can enable the data leakage prevention feature for the website. The data leakage prevention feature filters content such as abnormal pages and keywords that are returned from servers, and masks sensitive information such as ID card numbers, mobile phone numbers, bank card numbers, and sensitive words. WAF then returns the masked information or default response pages.

Important

Data leakage prevention can process only data that is in the formats that are used in the Chinese mainland, such as Chinese ID numbers, phone numbers and bank numbers.

Prerequisites

  • A WAF instance that meets the following requirements is purchased:

    • If the instance resides in the Chinese Mainland, the instance must run the Pro edition or higher.

    • If the instance resides outside the Outside Chinese Mainland, the instance must run the Business edition or higher.

  • Your website is added to WAF. For more information, see Tutorials.

Background information

WAF supports the data leakage prevention feature to comply with the following regulations required by the Cybersecurity Law of the People's Republic of China: Network operators shall adopt technological and other necessary measures to ensure the security of the personal information they collect and prevent information leaks, damage, or loss. If data is leaked, damaged, or lost, network operators must take remedial measures at the earliest opportunity, notify users in a timely manner, and report the matter to the authority in compliance with the regulations. Data leakage prevention masks sensitive information such as phone numbers, ID card numbers, and bank card numbers in website content and triggers alerts upon the detection of sensitive information. You can also use data leakage prevention to block responses that contain specific HTTP status codes.

Features

Information maintained by a website may be leaked in the following scenarios: unauthorized access to a URL such as unauthorized access to the backend management system, horizontal and vertical privilege escalation, and malicious crawlers that retrieve sensitive information from web pages. To help prevent leaks for common sensitive information, the data leakage prevention feature provides the following capabilities:

  • Detects and identifies personal information on web pages, masks information, and triggers alerts to protect website data. Personal information includes but is not limited to ID card numbers, phone numbers, and bank card numbers.

    Important

    Data leakage prevention can process only data that is in the formats that are used in the Chinese mainland, such as Chinese ID numbers, phone numbers and bank numbers.

  • Masks sensitive server information, including web applications used by the website, the operating system, and the version of the server.

  • Maintains a library that contains banned and sensitive keywords to detect and mask banned or sensitive website content, and trigger alerts.

How the data leakage prevention feature works

The feature detects whether a web page contains sensitive information, such as ID card numbers, mobile phone numbers, and bank card numbers, based on the specified protection rules. If a rule is matched, WAF triggers alerts or masks the information based on the specified rule. The feature replaces sensitive information with asterisks (*).

The feature allows you to set Content-Type to text/*, image/*, or application/* to protect web applications, native applications, and APIs.

Procedure

  1. Log on to the WAF console. In the top navigation bar, select the resource group and the region in which your WAF instance is deployed. The region can be Chinese Mainland or Outside Chinese Mainland.

  2. In the left-side navigation pane, choose Protection Settings > Website Protection.

  3. In the upper part of the Website Protection page, select the domain name for which you want to configure data leakage prevention. Switch Domain Name

  4. Click the Web Security tab and find the Data Leakage Prevention section. Then, turn on Status and click Settings.

    Important
    • Before you configure protection rules, enable the data leakage prevention feature.

    • After the data leakage prevention feature is enabled, the feature checks requests that are sent to your website. You can configure a data security whitelist rule to allow specific requests to pass checks. For more information, see Configure a whitelist for Data Security.

  5. Create a data leakage prevention rule.

    1. On the Data Leakage Prevention page, click Add Rule.

    2. In the Create Rule dialog box, configure the following parameters.

      Parameter

      Description

      Rule name

      The name of the rule that you want to create.

      Matching conditions

      The type of information that you want to detect. Valid values:

      • Status Code: 400, 401, 402, 403, 404, 405-499, 500, 501, 502, 503, 504, and 505-599

      • Sensitive Info: ID Card, Credit Card, Telephone No., and Default Sensitive Word

      Important

      Data leakage prevention can process only data that is in the formats that are used in the Chinese mainland, such as Chinese ID numbers, phone numbers and bank numbers.

      You can select multiple values for Status Code and Sensitive Info.

      If you select and, you can specify the URL that you want to detect. This way, WAF detects sensitive information only on the specified page.

      Matching Action

      The action that you want to perform on the sensitive information that is detected.

      • When you set the match condition to Status Code, the following actions are supported:

        • Warn: triggers alerts when the sensitive information is detected.

        • Block: blocks requests and returns the default page that indicates that the requested website is blocked.

      • If you set the match condition to Sensitive Info, the following actions are supported:

        • Warn: triggers alerts when the sensitive information is detected.

        • Sensitive information filtering: masks sensitive information in responses.

      Sample configurations

      • Mask sensitive information: Web pages may contain sensitive information, such as phone numbers and ID card numbers. You can create rules to mask sensitive information or trigger alerts when sensitive information is detected. The following example shows how to create a rule that masks mobile phone numbers and ID card numbers.

        • Matching conditions: ID Card and Telephone No.

        • Matching Action: Sensitive information filtering

        After this rule takes effect, all phone numbers and ID card numbers on the website are masked.

        Important

        Mobile phone numbers that must be provided to the public for business affairs, such as customer service and product hotlines, may also be masked by data leakage prevention rules.

      • Block responses that contain specific HTTP status codes: You can create a rule to block or generate alerts when specific HTTP status codes are detected to prevent leaks of sensitive server information. The following example shows how to create a rule that blocks the HTTP 404 status code.

        • Matching conditions: 404

        • Matching Action: Block

        After this rule takes effect, if the requested page does not exist, the specified page that indicates that the requested website is blocked is returned.

      • Masks specific sensitive information on specific pages: You can create rules to mask sensitive information or generate alerts when specific sensitive information, such as phone numbers or ID card numbers, is detected on specific pages. The following example shows how to create a rule that masks ID card numbers on the pages whose URLs contain admin.php.

        • Matching conditions: ID card numbers on pages whose URLs contain admin.php

        • Matching Action: Sensitive information filtering

        After this rule takes effect, the ID card numbers on the pages whose URLs contain admin.php are masked.

    3. Click Confirm.

      After you create a data leakage prevention rule, the rule automatically takes effect. You can view, modify, or delete rules in the rule list based on your business requirements.

What to do next

After you enable the data leakage prevention feature, you can view the log data of the filtered or blocked requests that match data leakage prevention rules. To view the log data, go to the Security Report page. On the Web Security tab, click Data Leakage Prevention. Then, view the relevant security report. For more information, see View security reports.