Data Filtering Best Practices

Two signatures exist for data filtering:

• Credit Card: the device will look for 16 digit numbers and will run thru a hash algorithm. It must match the hash algorithm before detecting this as a Credit Card number. This method has less false positive.
• Social Security Number: is detected as any 9 digit number, regardless of format. This is prone to false positive.

It is important to determine which types of documents in which to look for credit card and social security numbers.

Attached to this document are two Doc files that can be used to test the policy. One has fake social security numbers and the other fake credit card numbers.

Set up a profile to detect the two key words and trigger an alert. The second condition -- if the device sees any file that has 10 nine-digit numbers or 10 Credit Card numbers or a combination of both that total to 10.

1. Set up the custom Data Patterns.
2. Set up the data pattern profile.
3. Set up the data pattern in the security profile.

The custom data pattern is set the following way:

• Set the weight of the custom data pattern to 10.
• Set the social security and credit card to 1 (see screenshot below).
  
• Set the Data Filtering profile to trigger on 10 (see screenshot below).

• Add this profile to the security rule. This rule will look for the data pattern and alert on the above condition.  This should prevent some of the false detection.

Monitor Data Filter Log

The green arrow next to a log entry is a packet capture of the single packet that triggered the data filtering.

To protect the data contained in the packetcaptures, Dta Protection can be enabled which password protects all the packetcaptures. The password can be set from the Device > Setup > Content-ID > Manage Data Protection

Note: Attached to this KB document are two test files that can be used to confirm that the policy is working.