After you add a website to Web Application Firewall (WAF), you can enable the data leakage prevention feature for the website. The feature filters content such as abnormal pages and keywords returned from servers, and masks sensitive information such as ID card numbers, phone numbers, bank card numbers, and sensitive words. WAF then returns the masked information or default response pages.

Notice The data leakage prevention feature can process only data that is in the formats that are used in the Chinese mainland. The data includes ID card numbers, phone numbers, and bank card numbers.

Prerequisites

  • A WAF instance is purchased. The instance meets the following requirements:
    • If the instance resides in the Chinese mainland, the instance must run the Pro edition or higher.
    • If the instance resides outside the Chinese mainland, the instance must run the Business edition or higher.

    For more information, see Purchase a WAF instance.

  • Your website is added to WAF.

    For more information, see Tutorial.

Background information

WAF supports the data leakage prevention feature to comply with the following regulations required by the Cybersecurity Law of the People's Republic of China: Network operators shall adopt technological and other necessary measures to ensure the security of the personal information they collect, and prevent information leaks, damage or loss. In scenarios in which information leak, damage, or loss occurs, the network operators must take remedial measures at the earliest opportunity, notify users in a timely manner, and report the matter to the authority in compliance with the regulations. The data leakage prevention feature masks sensitive information such as phone numbers, ID card numbers, and bank card numbers in website content and triggers alerts when sensitive information is detected. You can also use the feature to block responses that contain a specific HTTP status code.

Features

Information maintained by a website may be leaked in the following scenarios: unauthorized access to a URL, such as unauthorized access to the backend management system, horizontal and vertical privilege escalation, and malicious crawlers that retrieve sensitive information from web pages. To prevent leaks of common sensitive information, the data leakage prevention feature provides the following capabilities:
  • Detects and identifies personal information on web pages, masks the information, and triggers alerts to protect website data. Personal information includes but is not limited to ID card numbers, phone numbers, and bank card numbers.
    Notice The data leakage prevention feature can process only data that is in the formats that are used in the Chinese mainland. The data includes ID card numbers, phone numbers, and bank card numbers.
  • Masks sensitive server information, including web applications used by the website, the operating system, and the version of the server.
  • Maintains a library that contains banned and sensitive keywords to detect and mask banned or sensitive website content, and trigger alerts.
How the data leakage prevention feature works

The feature detects whether a web page contains sensitive information, such as ID card numbers, phone numbers, and bank card numbers, based on the specified protection rules. If a rule is matched, WAF triggers alerts or masks the information based on the specified rule. The feature masks sensitive information by using asterisks (*).

The feature allows you to set Content-Type to text/*, image/*, or application/* to protect web applications, native applications, and APIs.

Procedure

  1. Log on to the WAF console.
  2. In the top navigation bar, select the resource group and region to which the WAF instance belongs. The region can be Mainland China or International.
  3. In the left-side navigation pane, choose Protection Settings > Website Protection.
  4. In the upper part of the Website Protection page, select the domain name for which you want to configure a whitelist. Switch Domain Name
  5. Click the Web Security tab and find the Anti Sensitive Information Leakage section. Then, turn on Status and click Settings.
    Notice
    • Before you configure protection rules, enable the data leakage prevention feature.
    • After the data leakage prevention feature is enabled, the feature checks all requests that are destined for your website. To allow the requests that match a whitelist rule to pass the check, you can configure the whitelist rule for Data Security. For more information, see Configure a whitelist for Data Security.
    Data Leakage Prevention
  6. Create a data leakage prevention rule.
    1. On the Anti Sensitive Information Leakage page, click Add Rule.
    2. In the Create Rule dialog box, configure the following parameters. Create Rule
      Parameter Description
      Rule name The name of the rule that you want to create.
      Matching conditions The types of information that you want to detect. Select a value from the drop-down list. Valid values:
      • Status Code: 400, 401, 402, 403, 404, 500, 501, 502, 503, 504, 405-499, and 505-599
      • Sensitive Info: ID Card, Credit Card, Telephone No., and Default Sensitive Word
      Notice The data leakage prevention feature can process only data that is in the formats that are used in the Chinese mainland. The data includes ID card numbers, phone numbers, and bank card numbers.

      You can select multiple values for Status Code and Sensitive Info.

      If you select and, you can specify the URL that you want to check. This way, WAF scans for sensitive information only on the specified page.

      Matching Action The action that you want to perform on the sensitive information that is detected.
      • If you set the match condition to Status Code, the following actions are supported:
        • Warn: triggers alerts when sensitive information is detected.
        • Block: blocks requests and returns the default page. This indicates that the requested website is blocked.
      • If you set the match condition to Sensitive Info, the following actions are supported:
        • Warn: triggers alerts when sensitive information is detected.
        • Sensitive information filtering: masks sensitive information in responses.
      Sample configurations
      • Mask sensitive information: Web pages may contain sensitive information, such as phone numbers and ID card numbers. You can create rules to mask sensitive information or trigger alerts when sensitive information is detected. The following example shows how to create a rule that masks phone numbers and ID card numbers.
        • Matching conditions: ID Card and Telephone No.
        • Matching Action: Sensitive information filtering
        After this rule takes effect, all phone numbers and ID card numbers on the website are masked.
        Notice Phone numbers that must be provided to the public for business affairs, such as customer service and product hotlines, may also be masked by data leakage prevention rules.
      • Block responses that contain specific HTTP status codes: You can create a rule to block or generate alerts when specific HTTP status codes are detected to prevent leaks of sensitive server information. The following example shows how to create a rule that blocks the HTTP 404 status code.
        • Matching conditions: 404
        • Matching Action: Block

        After this rule takes effect, if the requested page does not exist, the specified page that indicates that the requested website is blocked is returned.

      • Mask specific sensitive information on specific pages: You can create rules to mask sensitive information or generate alerts when specific sensitive information, such as phone numbers or ID card numbers, is detected on specific pages. The following example shows how to create a rule that masks ID card numbers on the pages whose URLs contain admin.php.
        • Matching conditions: ID card numbers on pages whose URLs contain admin.php
        • Matching Action: Sensitive information filtering

        After this rule takes effect, the ID card numbers on the pages whose URLs contain admin.php are masked.

    3. Click Confirm.
      After you create a data leakage prevention rule, the rule automatically takes effect. You can view new rules, and modify or delete rules in the rule list based on your business requirements.

What to do next

After you enable the data leakage prevention feature, you can view the log data of the filtered or blocked requests that match data leakage prevention rules. To view the log data, go to the Security Report page, choose Web Security > Data Leakage Prevention, and view the relevant security report. For more information, see View Security Reports.