Data leak detection

Use cases

Cloud Firewall can detect the following types of sensitive data in outbound traffic from your public-facing assets:

• AccessKey ID

• Passport number (Chinese mainland)

• Debit card number

• ID card number (Hong Kong, China)

• Exit-Entry Permit for Travelling to and from Hong Kong and Macao number

• ID card number (Chinese mainland)

• Military ID number

• Private key

In the data leak detection section of the IPS configuration page, you can view the data types that Cloud Firewall can detect. You can customize which data types to enable for detection based on your business requirements. Currently, detected sensitive data traffic is not automatically blocked. You can configure Cloud Firewall access control policies to proactively block the traffic.

Enable sensitive data leak detection

Configure data leak detection for cloud assets

You must first enable data leak detection for your assets. Cloud Firewall then inspects outbound traffic from these assets to the internet for sensitive data.

This feature supports plaintext protocols, such as HTTP, but not encrypted protocols, such as HTTPS.

1. Log on to the Cloud Firewall console. In the left-side navigation pane, choose Detection & Response > Data Loss Prevention.

2. In the upper-right corner of the Data Loss Prevention page, click Asset Configuration.

3. Find the target public asset and in the Actions column, click Enable Data Leak Detection.

4. In the Asset Configuration panel, click Daily Limit on Detected Traffic in the upper-right corner of the list. In the dialog box that appears, set a daily limit for traffic processing.

   Note

   • The limit you set must be within the specified range and cannot be less than the traffic already processed for the day.

   • To determine an appropriate limit, you can refer to your outbound request traffic. You can view the outbound request traffic of the last seven days in the Asset Configuration panel.

View or configure detected sensitive data types

Sensitive data statistics

The sensitive data statistics section displays information based on the time range you select, helping you understand data leak activity on your assets.

The distribution area for leaked sensitive data types shows the distribution of leaked sensitive data, which helps you audit asset behavior and prevent business losses.

The sensitive data statistics area includes three key metrics: Number of sensitive data leak events, Assets with Data Leaks Found, and Total Detected Outbound Traffic. The page also includes a Distribution of Leaking Assets and Destination IPs area, which ranks the top 5 leaking assets and top 5 destination IPs. The event list at the bottom can be filtered by criteria such as risk level, sensitivity level, data type, region, and source IP. The list displays information for each leak event, including the time of occurrence, event name, sensitive data type, amount of sensitive data, risk level, source IP, destination IP, traffic size, and protection status.

Leaked data details

Click View Details to open the Data Leak Details panel, where you can find details about the leak, risk payload, sensitive data list, and event list. The panel also provides a threat intelligence profile for the destination IP or domain, helping you determine if the address receiving the sensitive data is safe.

For each leak event, Cloud Firewall provides recommended actions, such as configuring an access control policy to prevent similar incidents. You can evaluate your business needs and take action to reduce the risk of data leaks.

Bill management