Adaptive redaction

With Adaptive Redaction you can detect and manage sensitive data from information that flows through your Secure Email Gateway. For example, detected words, phrases or expressions from emails are replaced with * before being delivered or displayed. Adaptive redaction can apply to documents, attachments and media types. Adaptive redaction is a powerful and flexible way to ensure sensitive information is protected without holding or blocking communications.

Tell me about...

• How redaction works with Secure Email Gateway

  Redaction is performed by the Redact Text content rule. The content rule:

  • Scans content for terms and expressions matching items on a Lexical Expression List.

  If the rule is triggered, the Gateway:

  • Attempts to redact the content appropriately and applies the What To Do? actions.

  The Redact Text content rule applies a different set of What To Do? actions for the following conditions:

  • On successful redaction- for example, Perform no action (email) or Continue to the next rule (web).

    Successful redaction occurs if the modified version of the content no longer exceeds the lexical expression list threshold. This occurs if the 'heavier' terms in the original communication have been replaced with **** and the content is now safe to be delivered or displayed.

    Why would I want to 'Perform no action' if redaction has been successful?

    The Perform no action disposal action instructs Secure Email Gateway to consider the next content rule in the policy route. Redaction will be applied as specified by the policy, but no further actions as a result of this content rule will be taken.

  • On unsuccessful redaction - for example, Deliver the Message (email) or Block the Communication using the Block page for Redaction Failure (web).

    Unsuccessful redaction occurs if the modified version of the content would still be sufficient to exceed the lexical expression list threshold, even if the terms were redacted. For example, if your expression list contains an Instant expression with Redact set to No, redaction will always be unsuccessful.

    Redaction is also unsuccessful if content is detected in media types which are not supported by the Redact Text content rule.

    Show me: How can redaction be unsuccessful?

    • An expression list is configured with the following weighted expressions and a threshold of 10. The list is applied to the Redact Text content rule.

      

    • The content rule detects a message:

      FAO: 007
      
      The confidential information you requested regarding Project SecretStop has been classified Top Secret, and cannot be released to you at this time.
      
      In confidence,
      
      M.

    • The combined weight of the detected expressions (+ 4 + Instant + 5 + 6 + 2) is greater than the threshold (10).

    • Redaction is attempted. Only the redactable terms are affected.

      FAO: 007
      
      The confidential information you requested regarding Project ********** has been classified *** ******, and cannot be released to you at this time.
      
      In confidence,
      
      M.

      The remaining non-redactable terms are counted by the content rule.

      confidential (4) + classified (5) + In confidence (2) = 11.

    • Redaction is unsuccessful as the remaining content still exceeds the threshold.

      Typically, the message would be blocked or held.

      Redaction can only be successful if the combined weight of detected non-redactable terms is lower than the lexical expression threshold.

• Configuring lexical expressions for redaction

  The Redact Text content rule relies on well-configured lexical expression lists.

  Guidelines on preparing lexical expression lists for redaction:

  • Group lexical expressions in sensible lists.
  • Only redactable lexical expressions can be redacted. Redactable expressions are indicated by Yes in the Redact column.
  • Use heavier or Instant weighting for lexical expressions you want to be redactable.
  • You cannot change the weight of expressions in a managed list.
  • You can redact any lexical expression, including credit card numbers, identity numbers and predefined expressions.

  See About Lexical Expressions for more information.

• Redaction with Email and Web Gateways

  You can redact content in:

  Email Gateway

  • Email messages including the body text and subject line
  • File attachments

  Web Gateway

  • Downloaded web content
  • Downloaded or uploaded files
• Which file types support adaptive redaction?

  Redaction is supported by the following media types. You can select Which Media Types you want to scan.

  Media Type	Extensions
  HTML	.htm .html
  Microsoft Word document (2007+)	.docx .docm .dotx .dotm
  Microsoft Excel spreadsheet (2007+)	.xlsx .xlsm .xltx
  Microsoft PowerPoint presentation (2007+)	.pptx .pptm .potx .ppsx .ppsm .thmx
  Adobe PDF (portable document format)	.pdf
  Metadata in GIF, JPEG, and PNG images	.gif .jpg .png
  Rich Text Format encoded document	.rtf
  Notepad/Plain text	.txt
  LibreOffice Calc document	.ods
  LibreOffice Draw document	.odg
  LibreOffice Impress document	.odp
  LibreOffice Master document	.odm
  LibreOffice Math document	.odf
  LibreOffice Writer document	.odf

  Redaction is not supported for Microsoft Office 97-2003 documents with the extensions .doc, .xls or .ppt. Content in these documents can be detected but redaction is always unsuccessful.

  Use the Redact Text content rule in a policy route with a Detect Lexical Expression rule, which uses the same expression list. The Detect Lexical Expression rule must exclude any document types that have been selected for the Redact Text rule.

• Redacting documents and attachments

  You can select which parts of a document or attachment you want to redact. For example, you can:

  • Scan body
  • Scan header and footer
  • Scan properties
  • Scan comments

  PDF document properties can be detected but cannot be successfully redacted. Comments in PDF documents can not be detected or redacted.

• Redacting images

  You can configure Secure Email Gateway to redact text extracted from images, by selecting Scan text extracted from images (OCR) in the Redact Text content rule.

  The Gateway uses OCR (Optical Character Recognition) technology to extract and scan text from images, optionally including QR codes and barcodes. Any detected text content will then be replaced with a black bar.

  The Gateway also redacts meta data properties contained within GIF, JPEG, and PNG images.

  You can configure the OCR settings from System > Gateway Settings > Policy Engine Settings. See Advanced and OCR for more information.

• Encryption and protected documents

  There are a number of ways to restrict access and control of a particular document. For example, a Microsoft Word document could be read-only, password encrypted or stored in a password-restricted zip folder. The Gateway can redact documents that are accessible, even if they have been restricted from editing by the original user.

  Redaction can be successful, even if:

  • The file is read-only
  • The document is 'marked as final'
  • The file is contained within nested zip folders

  Redaction is automatically unsuccessful if:

  • The document is signed with a digital signature A digitally-signed message proves to the recipient that you, not an imposter, signed the contents of the message, and that the contents have not been altered in transit.

  Redaction is not attempted if:

  • The document is encrypted or protected from opening by a password.
  • The document is contained within a password-restricted zip folder.
• Applying the Redact Text content rule to a policy route

  The policy engine attempts to apply redaction content rules as a priority, regardless of their position on the policy route. See How Policy is Applied to Routes for more information.

• Redaction and Social Media

  Some social networking sites use dynamic scripts to protect personal data. It is recommended that redaction is not applied to social networking websites such as Facebook or Google Mail as the effectiveness of applying these features cannot be guaranteed.

How do I...

• Build the Redact Text content rule?

  The Redact Text content rule is used to detect lexical expressions and attempt redaction.

  Only lexical expressions which are enabled to Redact in a Lexical Expression List will be available for redaction.

  1. Define a Lexical Expression List to include your sensitive information. Show me

     1. Navigate to Policy > Policy References > Lexical Expressions. The Lexical Expressions page is displayed.

     2. Select the Lexical Expression Lists tab. All the existing lexical expression lists are displayed.

     3. Click New, or select a list and click Edit. An editing page for the lexical expression list is displayed.

     4. Define the lexical expression list as required.

     See Lexical Expressions for more information.

  2. Create a content rule using the Redact Text content rule template. Show me

     1. Navigate to Policy > Manage Policy Definition > Content Rules. The Manage Content Rules page is displayed.

     2. In the Content Rules panel, click New. The Add a Content Rule dialog is displayed.

     3. From the list of content rule templates, select Redact Text. An editing page for the new content rule is displayed.

     4. In the Overview panel, click Click here to change these settings. Edit the Name and Notes of the content rule as required, and click Save.

  3. Configure the What To Look For? conditions to detect matching expressions. Show me

     1. In the Lexical Expression section, click Click here to change these settings.

     2. Select which parts of the conversation you want to scan.

        You cannot apply redaction to specific message headers other than the subject line.

     3. Select the Expression list you want the content rule to use as a reference.

        This is the Lexical Expression List you created or edited in step 1.

     4. Select a Trigger value for your expression list. This determines how the content rule measures the weight of detected expressions.

        Always select Greater than or equal. This ensures that the rule will trigger if the threshold is matched or exceeded.

     5. Select Document options to indicate which parts of documents you want to scan. Click Save.

  4. Configure the remaining What To Look For? conditions. Show me

     1. Select Which Media Types you want the Gateway to look for. Click Click here to change these settings.

        You can select individual document types using the Detectable Types window to select which file types you want to detect.

        Click Save.

        Select the Documents check box in the Detectable Types window to select all document formats.

     2. Add a Size Restriction. Click Click here to change these settings.
     3. Select Enable the Size Restriction if required. You can enter a maximum or minimum size restriction. Enter a value in KB and select or more or or less. Click Save.

     4. Select the Direction To Apply the content rule by clicking Click here to change these settings. You can specify whether the detected items are entering the company, leaving the company, or either entering or leaving the company. Click Save.

     5. Configure Scan text extracted from images (OCR) to detect sensitive content in image files.

        If you select this option, OCR will apply to images regardless of which Detectable Types are selected.

  5. Configure the What To Do? actions if redaction is successful. Show me

     1. Use the On Successful Redaction section to select the appropriate Disposal Action (email) or Primary Action (web).

     2. Click Save.

     3. Add any What Else To Do? actions by clicking New.

        See What To Do? actions to find out more about configuring actions.

     4. Click Save.

  6. Configure the What To Do? actions if redaction is unsuccessful. Show me

     1. Use the On Unsuccessful Redaction section to select the appropriate Disposal Action (email) or Primary Action (web).

     2. Click Save.

     3. Add any What Else To Do? actions by clicking New.

        See What To Do? actions to find out more about configuring actions.

     4. Click Save.

  7. Apply Configuration.

     The content rule can now be applied to a policy route.

• Build a Detect Lexical Expression content rule to use with redaction?

  A Detect Lexical Expression content rule can be used to provide an extra layer of security, blocking or holding content which has not been successfully redacted.

  1. Define a Lexical Expression List. Show me

     Only lexical expressions which are configured as Redactable in a Lexical Expression List will be available for redaction.

     1. Navigate to Policy > Policy References > Lexical Expressions. The Lexical Expressions page is displayed.

     2. Select the Lexical Expression Lists tab. All the existing lexical expression lists are displayed.

     3. Click New, or select a list and click Edit. An editing page for the lexical expression list is displayed.

     4. Define the lexical expression list as required.

     See Lexical Expressions for more information.

  2. Create a content rule using the Detect lexical expression content rule template. Show me

     1. Navigate to Policy > Manage Policy Definition > Content Rules. The Manage Content Rules page is displayed.

     2. In the Content Rules panel, click New. The Add a Content Rule dialog is displayed.

     3. From the list of content rule templates, select Detect lexical expression. An editing page for the new content rule is displayed.

     4. In the Overview panel, click Click here to change these settings. Edit the Name and Notes of the content rule as required, and click Save.

  3. Configure the What To Look For? conditions to detect matching expressions. Show me

     1. In the Lexical Expression section, click Click here to change these settings.

     2. Select which parts of the conversation you want to scan.

        Do not select The message body or The subject line if you are using this content rule in conjunction with the Redact Text content rule.

     3. Select the Expression list you want the content rule to use as a reference.

        This is the Lexical Expression List you created or edited in step 1.

     4. Select a Trigger value for your expression list. This determines how the content rule measures the weight of detected expressions.

        Always select Greater than or equal. This ensures that the rule will trigger if the threshold is matched or exceeded.

     5. Select Document options to indicate which parts of documents you want to scan. Click Save.

        Scan embedded script can have a significant impact if applied to an outbound social media policy route. For example, users of Facebook or Google Mail might find their access irreversibly disrupted if a lexical expression is detected within an instant message.

  4. Configure the remaining What To Look For? conditions. Show me

     1. Select Which Media Types you want the Gateway to look for. Click Click here to change these settings.

        You can select individual document types using the Detectable Types window to select which file types you want to detect.

        You must exclude any document types which have been selected for the Redact Text content rule in the policy route.

     2. Click Save.
     3. Add a Size Restriction. Click Click here to change these settings.
     4. Select Enable the Size Restriction if required. You can enter a maximum or minimum size restriction. Enter a value in KB and select or more or or less. Click Save.

     5. Select the Direction To Apply the content rule by clicking Click here to change these settings. You can specify whether the detected items are entering the company, leaving the company, or either entering or leaving the company. Click Save.

  5. Configure the What To Do? actions. Show me

     1. Change the What to Do? actions of the content rule to determine what happens when the content rule is triggered. Click Click here to change these settings. Select a Disposal Action (email) or a Primary Action (web).

     2. Click Save.

  6. Apply Configuration.

     The content rule can now be applied to a policy route.

• Bypass redaction for signed documents?

  You can configure the Gateway to bypass the Redact Text content rule when it encounters a signed document.

  Configure the Redact Text content rule and add the Bypass Rule What to Look For? clause by selecting the Bypass Rule for signed documents check box.

  Bypass Rule only affects signed documents. The Gateway will continue to apply unsuccessful redaction to signed messages, even when this check box is selected.

Show me...

• Example 1. Hide confidential information

  I want to prevent specific terms and phrases leaving my organization, unless they have been appropriately redacted.

  1. Create an expression list to detect classified terms. In this scenario, the threshold is set to 10.

     See Create a lexical expression for more information.

     

  2. Configure the Redact Text content rule which scans content for matching expressions using this expression list. Set the What To Do? actions as follows:

     • On successful redaction .... Deliver the message

     • On unsuccessful redaction ... Hold the message

  3. Apply the content rule to a policy route.

     See Policy Routes for more information.

  What happens when a message is detected?

  • The Gateway detects the text:

    Dear M,
    
    The information you provided for Codename: SecretStop appears to be encrypted. Is this still classified as confidential? Please advise,
    
    James
    

  • The combined weight of the detected expressions is greater than the threshold and redaction will be attempted:

    Dear M,
    
    The information you provided for ********: ********** appears to be encrypted. Is this still classified as confidential? Please advise,
    
    James
    

  • The remaining matching expressions are counted = +5 +4 = 9.

    Redaction is successful as the remaining content is not sufficient to outweigh the threshold.

    The redacted message text is delivered.

    If the modified message contained terms which still exceeded the threshold, the redaction would be considered unsuccessful and the corresponding action (Hold the message) would be performed.

• Example 2. Redaction attempted with weighted expressions

  I want to apply redaction to weighted lexical expressions.

  1. Create an expression list to detect classified terms. The threshold is set to 10.

     See Create a lexical expression for more information.

     

  2. Build the Redact Text content rule which scans content for matching expressions.

  3. Apply the content rule to a policy route.

     See Policy Routes for more information.

  What happens when the Gateway detects a message?

  • The Gateway detects the text:

    Dear Mr Bond,
    
    Thank you for the top secret information you sent us in confidence. Your help will be invaluable to the success of our operation.
    
    Agent X. ,

  • The expressions in red are detected and counted = +6 +2 = 8. This is not sufficient to trigger the content rule.

    • Redaction is not attempted
    • The original message is delivered

    When creating or editing lexical expressions, give them high or Instant weightings if you also want them to be redactable.

• Example 3. Redaction of a Managed List

  I want to apply redaction to any outward communication containing English or Japanese swear words.

  Profanities are stored in Managed Lists. Managed Lists must be copied before they can be configured as redactable.

  1. Copy the required Managed Lists. In this case, Swear Words: English and Swear Words: Japanese. Show me

     1. Click Policy > Lexical Expressions and select the Managed Lists tab.
     2. Select the lists you want to copy.

     3. Click Copy.

        The lists are copied to the Lexical Expressions tab and are indicated as new expression lists:

        Swear Words: English Copy

        Swear Words: Japanese Copy

     See About Lexical Expressions to find out more about managed lists and lexical expression lists.

  2. Set the expressions in each of your lists to Redact all. Show me

     1. Select the expression list and click Edit.
     2. In the Expressions section click Redact all.

  3. Build the Redact Text content rule which scans content for matching expressions.

  4. Apply the content rule to a policy route, for example from My Company to Everyone.

     See Policy Routes for more information.

• Example 4. Redact text in email attachments

  I want to prevent my client's name from being distributed accidentally by my sales team in any attached spreadsheets or Word documents. I want the Gateway to redact the client name and the company name from these attachments. I also want to be notified when this happens.

  1. Create an expression list called My Client with the appropriate expressions set to Redact.

     See Create a lexical expression for more information.

     

  2. Create the Redact Text content rule.

     Click Policy > Content Rules > New. Select Redact Text.

  3. In the What To Look For? section, configure the Lexical Expression clause to detect your expression list.

     • Scan: The attachments matching the conditions in the other clauses
     • Expression list: My Client
     • Trigger: Greater than or equal

     • Document options: Scan body, scan header and footer, and scan properties

     See What To Look For? clauses for more information.

  4. Configure Which Media Types you want to scan:

     • Include selected media types: Microsoft Word Document (DOCX) and Microsoft Excel Spreadsheet (XLSX)

     See What To Look For? clauses for more information.

  5. Configure the What To Do? actions to specify what happens if redaction is successful or unsuccessful. In this scenario, you might want the policy to do the following:

     On Successful Redaction	On Unsuccessful Redaction
     Deliver the message as specified on the route	Hold in ... [message area]
     Generate an Inform	Generate an inform

     See What To Do? actions for more information.

  6. When you have configured the content rule, apply the configuration.

  7. Add the content rule to the policy route which connects your Sales Team to Anyone.

     Click Policy > Mail Policy Routes.

     Show me...

     

     See Policy Routes for more information about how to create web policy routes and add a content rule.

  8. Apply the configuration.
• Example 5. Redact a message and return a copy to the sender

  I want to redact certain words and phrases from messages sent from my organization. I also want to send a copy of the redacted message to the sender to indicate that the original message has been redacted and delivered.

  1. Create an expression list to detect classified terms. The threshold is set to 10.

     See Create a lexical expression for more information.

     

  2. Create the Redact Text content rule which scans content for matching expressions.

  3. Configure the What To Do? actions to deliver the message if redaction is successful.

     In this scenario, you might want to use the following configuration:

     On Successful Redaction	On Unsuccessful Redaction
     Deliver the message (as specified on the route)	Hold in ...
     Generate an inform (to message originator)	Generate an inform (to administrator)

  4. Apply the content rule to a policy route from My Company to Anyone.

     See Policy Routes for more information.

  What happens when the Gateway detects a message?

  • The Gateway detects the following text:

    007,
    The items you requested are now available as M has reclassified them from TOP SECRET to Confidential under regulation M3712.
    Yours, in confidence,
    Q.

  • The matching expressions are detected and counted = +6 +4 +2 =12.

    Redaction is applied to the redactable terms:

    007,
    The items you requested are now available as M has reclassified them from *** ****** to Confidential under regulation M3712.
    Yours, in confidence,
    Q.

  • The remaining matching expressions are counted = +4 +2 =6.

    Redaction is successful as the remaining content is not sufficient to outweigh the threshold.

    The redacted message is delivered.

    An inform message is sent to the message originator.

  • Another transmission is detected by the Gateway, this time with a .pdf attachment containing the following text:

    CONFIDENTIAL:
    Requested: Commander Bond, 02:00 hours for top secret involvement in operation SecretStop.
    Status: classified/confidential.

  • The matching expressions trigger the content rule. Redaction is attempted:

    CONFIDENTIAL:
    Requested: Commander Bond, 02:00 hours for *** ****** involvement in operation **********.
    Status: classified/confidential.

  • The remaining terms are counted = +4 +5 +4 =13.

    Redaction is unsuccessful.

    The original unredacted message is not delivered and is sent to a holding area.

    An inform is sent to the Server Administrator.

• Example 6. Redact text from images using OCR

  I want to prevent my client's name from being distributed accidentally in an email or an image attachment. I want the Gateway to use OCR technology to redact the client name or the company name from image attachments, as well as from anywhere in the message itself. I also want to be notified when redaction has been attempted.

  1. Create an expression list called My Client with the appropriate expressions set to Redact.

     See Create a lexical expression for more information.

     

  2. Create the Redact Text content rule.

     Click Policy > Content Rules > New. Select Redact Text.

  3. In the What To Look For? section, configure the Lexical Expression clause to detect your expression list.

     • Scan: The attachments matching the conditions in the other clauses
     • Expression list: My Client
     • Trigger: Greater than or equal

     • Document options: Scan body, scan header and footer, and scan properties

     See What To Look For? clauses for more information.

  4. Configure Which Media Types you want to scan:

     See What To Look For? clauses for more information.

  5. Configure Scan text extracted from images (OCR) to ensure the Gateway scans images for text.

     See Advanced and OCR for more information.

  6. Configure the What To Do? actions to specify what happens if redaction is successful or unsuccessful. In this scenario, you might want the policy to do the following:

     On Successful Redaction	On Unsuccessful Redaction
     Deliver the message as specified on the route	Hold in ... [message area]
     Generate an Inform	Generate an inform

     See What To Do? actions for more information.

  7. When you have configured the content rule, apply the configuration.

  8. Add the content rule to the policy route which connects your Sales Team to Anyone.

     Click Policy > Mail Policy Routes.

     Show me...

     

     See Policy Routes for more information about how to create web policy routes and add a content rule.

  9. Apply the configuration.

See also...

• Sanitization
• Lexical Expressions
• Content rules
• What To Look For? clauses
• What To Do? actions
• Policy Routes