Cloud Firewall:Data Leak Detection

Supported editions and specifications

Cloud Firewall provides data leak detection for outbound traffic. After you enable the feature on the purchase page, you receive a default monthly free quota for traffic inspection: 100 GB for Premium Edition, 300 GB for Enterprise Edition, 500 GB for Ultimate Edition, and 100 GB for the pay-as-you-go edition. Traffic exceeding the free quota is charged at a post-paid rate of USD 0.02 per GB, with bills generated the next day. You can use a pay-as-you-go savings plan (pre-paid) to offset these costs. In the console, you can enable detection for specific assets.

For detailed instructions, see Enable data leak detection.

Supported sensitive data types

Cloud Firewall can inspect outbound traffic from your public-facing assets for potential data leaks, such as:

• AccessKeyId

• Passport number (Chinese mainland)

• Debit card number

• ID card number (Hong Kong, China)

• Exit-Entry Permit for Travelling to and from Hong Kong and Macao

• ID card number (Chinese mainland)

• Military ID number

• private key

You can view the data types that Cloud Firewall can identify on the IPS configuration page. You can customize which data types to enable based on your business requirements. Detected sensitive data traffic is not automatically blocked. You can configure a Cloud Firewall access control policy to block the traffic.

Prerequisites

You must enable the internet firewall. For instructions, see Enable the internet firewall.

Enable data leak detection

Configure assets for data leak detection

You must enable data leak detection on the assets that you want to monitor. Cloud Firewall then inspects the outbound traffic from these assets for sensitive data to help you identify data leak risks.

Detection is supported only for unencrypted protocols, such as HTTP. It is not supported for encrypted protocols, such as HTTPS.

1. Log on to the Cloud Firewall console. In the left-side navigation pane, choose Detection & Response > Data Loss Prevention.

2. On the Data Loss Prevention page, click Asset Configuration in the upper-right corner.

   

3. Find the public-facing asset that you want to monitor and click Enable Data Leak Detection in the Operation column.

   

4. In the Asset Configuration panel, click Daily Limit on Detected Traffic in the upper-right corner to set a daily inspection limit.

   Note

   • The limit must be within the specified range and cannot be less than the traffic already processed for the day.

   • To estimate an appropriate limit, you can review the outbound request traffic from the past seven days in the Asset Configuration panel.

   

View or configure sensitive data detection types

View data leak statistics

The sensitive data statistics area shows aggregated information for your selected time range, helping you understand the current state of sensitive data leaks from your assets.

The leaked sensitive data type distribution area shows the breakdown of leaks by type for the selected time range. This helps you audit asset behavior and prevent business losses.

Investigate data leak events

The events list displays data for your selected time range. Click View Details for an event to open the Data Leak Details panel. In this panel, you can review the Leaked Information, Risk Payload, Sensitive Data list, and event history. It also provides threat intelligence on the destination IP address or domain name to help you assess the destination's security.

Cloud Firewall provides remediation suggestions for each event, such as creating an access control policy to block similar leaks. Evaluate these suggestions based on your business needs to mitigate the risk of data exfiltration.

Bill management