Adaptive Redaction

Adaptive Redaction is an alternate version of redaction whereby sensitive parts of a document are automatically removed based on policy. It is primarily used in next generation Data Loss Prevention (DLP) solutions.[1]

Content and Context

The policy is a set of rules based on content and on context.

Context can include:

  • Who is sending (or uploading) the information.
  • Who is receiving the information (including a web site if uploading or downloading).
  • The communication channel (e.g. email, web, copy to removable media).

Content can be 'visible' information, such as that you see on the screen. It can also be 'invisible' information such as that in document properties and revision history, and it can also be 'active' content which has been embedded in an electronic document, such as a macro.

Purpose

Adaptive Redaction is designed to alleviate "False Positive" events created with Data loss prevention software (DLP) security solutions.

False positives occur when a DLP policy triggers and prevents legitimate outgoing communication. In the majority of cases this is caused through oversight by the sender.

Examples

Sending unprotected credit card information outside an organization breaches the Payment Card Industry Data Security Standard (PCI DSS regulations). Many organizations accept credit card information through email, however a reply to an email containing such information would send out the prohibited information. This would cause a breach of policy. Adaptive Redaction can be used to remove just the credit card number but allow the email to be sent.

'Invisible' information can be found in documents and has created embarrassment for several governments.[2] [3]

gollark: If there was a programming language which I found satisfying to use, I would be significantly happier with programming.
gollark: I mind MANY programming languages.
gollark: I may want to work in generic engineering whatever instead of programming.
gollark: Solution: study and do something entirely unrelated in every way to programming.
gollark: Implement BASIC for arbitrary reasons?

See also

References
  1. "VESTERGAARD FRANDSEN A/S v BESTNET EUROPE LTD". Reports of Patent, Design and Trade Mark Cases. 130 (11): 894–905. 2013-10-28. doi:10.1093/rpc/rct060. ISSN 0080-1364.
  2. Federal police mistakenly publish metadata from criminal investigations
  3. How the Conservatives orchestrated the letter from business leaders - and got it wrong
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.