This topic describes how to useSASE features, such as sensitive data detection, real-time blocking, transmission channel control, intelligent auditing, and permission management, to control code exfiltration and protect your core enterprise assets.
Use cases
To protect its core code assets while meeting various business needs, an enterprise categorizes these activities into three types:
-
Git channels: Strictly control code exfiltration through Git channels such as Codeup. You can add trusted code repositories to a whitelist. After a repository is added to the whitelist,SASE no longer controls outbound activity from that code repository.
-
Non-Git channels: Control code exfiltration from specified sources.
-
Other types: For code exfiltration from non-specified sources, SASE only generates audit records.
Features
You can use the following control measures to protect your data:
-
Git channel code control:
-
Block all: Block all outbound activities from code repositories on Git channels in real time.
-
Approval mechanism: High-risk exfiltration operations require an approval flow. The operations can run only after they are approved.
-
Audit records: SASE records all operations in audit logs to ensure traceability.
-
Code repository whitelist: Configure a whitelist for trusted code repositories on Git channels.
-
-
Non-Git channel code control:
-
Intelligent blocking: Block the exfiltration of code that is downloaded or exported from specified code repositories in real time.
-
Approval mechanism: Code exfiltration from specified code repositories requires an approval flow. The operations can run only after they are approved.
-
Audit records: SASE records all operations in audit logs to ensure traceability.
-
-
Other types of code: SASE only generates audit records.
Prerequisites
-
You have purchased the Data Protection edition ofSASE internet access. For more information, see Billing overview and Get started with SASE.
-
TheSASE app on your corporate endpoints is version 4.3.1 or later.
-
You have created a user group to which the policy applies. For more information, see Create a user group.
Configure an approval flow
When you configure a policy for code exfiltration, you can select an approval flow. Code exfiltration is allowed only after an approval is granted.
Log on to the Secure Access Service Edge console.
-
In the left-side navigation pane, choose and click Create Workflow.
-
In the Create Approval Workflow panel, configure the approval flow and click OK.
Enter a Workflow Name and Description. In the Approval Workflow section, set the approvers. You can set a minimum of 1 and a maximum of 5 approval nodes. In the Approval Permissions section, select the required permissions, such as File Exfiltration. Optional permissions include domain whitelist, domain blacklist, software disabling, file exfiltration, app uninstallation policy, and peripheral device control.
Configure code exfiltration policies
To achieve fine-grained, tiered control over code exfiltration, you need to configure different outbound policies based on the characteristics of each code type to meet its specific security requirements.
Git channel block policy
To ensure that code exfiltration from code repositories on Git channels is secure and controlled, use a real-time blocking mechanism to manage outbound operations. All outbound requests must go through an approval flow and can run only after approval. You can add trusted Git code repositories to a whitelist. After a repository is added to the whitelist,SASE no longer controls outbound activity from that code repository.
Configure a block policy
-
In the left-side navigation pane, choose . On the Outbound Transfer Management tab, click Create Policy.
-
Configure the following parameters, leave other parameters at their default values, and then click OK.
Parameter
Description
Policy Name
Enter a name for the policy.
Risk Level
Select Extremely High.
Action
Select Block and Notify.
Action
Select Block All.
Transmission Channel
Select Git.
Effective Scope
Select the user groups to which the policy applies. You can add multiple user groups.
Approval Process Configuration
Select Users can submit an application for approval.. From the Select Approval Workflow drop-down list, select your custom approval flow.
Prompt Display Configuration
Set the notification message for blocked code exfiltration. You can set messages in both Chinese and English.
Configure a channel whitelist
You can add code repositories from Git channels to a whitelist.SASE does not control outbound activities from whitelisted repositories.
-
In the left-side navigation pane, choose and click Add .
-
In the Add to Whitelist panel, enter the Code Repository URL for the Git channel and click OK .
Configure an outbound blocking policy for a specified channel
To implement an exfiltration policy for code repositories from a specified source, you must configure a Data Source and a file detection rule, and create an interception policy.
Step 1: Configure a data source
You can configure multiple data sources to centrally manage code repositories.
-
In the navigation pane on the left, choose , and click Create Application.
-
In the Create Application panel, configure the application as follows and click OK.
Configuration Item
Description
Application Name
Enter a name for the application.
Application Address
Specify the URL and file path of the code repository. Click Add to specify multiple addresses. For example:
-
URL: codeup.aliyun.com
-
Path: depot/project (project file path)
-
Step 2: Create a detection rule
Detection rules inspect code from custom data sources to control or block outbound operations.
-
On the tab, click .
-
In the Create Category dialog box, set the classification name and click OK.
-
Click . In the Create Rule panel, configure the settings as follows and click OK.
The configuration items include: Rule Name, Data Classification (select Custom/Custom), Sensitivity Level (select L4), and Rule Description. In the rule configuration area, click +Add Condition. Set the logical operator to AND. For the condition, set Data Source to Contains Any and select Web Application from the drop-down list.
Step 3: Create a code exfiltration blocking policy
-
In the navigation pane on the left, choose .
-
On the Outbound Transfer Management tab, click Create Policy.
-
In the Create Policy panel, configure the policy as follows. Leave the other settings at their default values and click OK.
Parameter
Description
Policy Name
Enter a name for the policy.
Risk Level
Select Extremely High.
Action
-
Action: Select Block and Notify.
-
Action: Select Intelligently Block.
Data Identification Rule Settings
Select the custom detection rule for the code data source.
Transmission Channel
Configure the transmission channels for detecting code exfiltration, as needed.
Effective Scope
Select the user groups to which the policy applies. You can add multiple user groups.
Approval Process Configuration
Select Users can submit an application for approval.. Then, in the Select Approval Workflow drop-down list, select a custom approval workflow.
Prompt Display Configuration
Set the notification message that is displayed when a file transfer is blocked. You can configure messages in both Chinese and English.
-
Configure an audit policy for other types of code exfiltration
The system only creates audit records for code exfiltration through non-Git or other unspecified channels.
-
In the navigation pane on the left, choose .
-
On the Outbound Transfer Management tab, click Create Policy.
-
In the Create Policy pane, configure the policy as follows. Keep the default settings for other parameters, and then click OK.
Parameter
Description
Policy Name
Enter a name for the policy.
Risk Level
Select Low.
Action
Action: Select Audit Only.
Data Identification Rule Settings
Select the detection rule for code from custom data sources.
Transmission Channel
Configure the transmission channels for detecting code exfiltration as needed.
Effective Scope
Set the user groups to which the policy applies. You can add multiple user groups.
Approval Process Configuration
Select Users can submit an application for approval.. Then, in the Select Approval Workflow drop-down list, select a custom approval workflow.
Prompt Display Configuration
Set the notification message for blocked file exfiltration. You can provide messages in both Chinese and English.
View audit logs
All outbound file transfers are logged. In Log Audit, you can view the transfer operations and the actions taken.
-
In the navigation pane on the left, choose .
-
On the Sensitive File Detection tab, search for logs of sensitive files sent by employees.
Click Details to view information for a specific file, such as its file details, key information, sensitive content, matched policies, endpoint, outbound channel, and account information.