Cyberstudy
Supplementary — not from your PDF Intermediate ~35 min

Detect sensitive data with pattern matching

Build the core of a data loss prevention rule: regular expressions that find card-number-like and email patterns in a folder of test files.

Environment

Your own computer; PowerShell Select-String or grep -E. Create test files with made-up data.

Before you start

  • Read Data Loss Prevention (p.430), Email Data Loss Prevention (p.287) and Data Protection (p.428).

You will

  • Write detection patterns
  • Measure false positives
  • Choose DLP actions

Steps

  1. 1

    Create a dlp-test folder with four text files: one with the test card number 4111 1111 1111 1111, one with a fake email jane.doe@example.com, one with an order number 4111-2222 that isn't a card, and one clean file.

  2. 2

    Search for emails: Select-String -Path .\dlp-test\* -Pattern '[\w.+-]+@[\w-]+\.[\w.]+' (Linux: grep -rEo '[[:alnum:]._+-]+@[[:alnum:]-]+\.[[:alnum:].]+' dlp-test).

  3. 3

    Search for 16-digit card-like numbers: Select-String -Path .\dlp-test\* -Pattern '\b(?:\d[ -]?){15}\d\b'.

  4. 4

    Check whether your patterns catch the order number (a false positive) or miss anything (a false negative), and refine them.

  5. 5

    Real DLP adds checks like the Luhn checksum and keywords near the match. Write down why that reduces false positives.

  6. 6

    For each match type, decide the DLP action: log, warn the user, block, or quarantine.

Check your understanding

  • ?Why can't pattern matching alone catch everything?
  • ?What's the cost of a DLP rule with too many false positives?
  • ?Where would you enforce DLP: on the endpoint, on email, or in the cloud?