Adaptive redaction

You can use adaptive redaction to allow email or web traffic to be delivered (or displayed) with detected words, phrases or expressions replaced with * characters. Adaptive redaction is a powerful and flexible way to ensure sensitive information is protected without holding or blocking communications.

Tell me about...

• How redaction works with Clearswift Gateway

  Redaction is performed by a Redact Text content rule. The content rule:

  • Scans content for terms and expressions matching items on a Lexical Expression List.

  If the rule is triggered, the Gateway:

  • Attempts to redact the content appropriately and applies the What To Do? actions.

  The Redact Text content rule applies a different set of What To Do? actions for the following conditions:

  • On successful redaction- for example, Perform no action (email) or Continue to the next rule (web).

    Successful redaction occurs if the modified version of the content no longer exceeds the lexical expression list threshold. This occurs if the 'heavier' terms in the original communication have been replaced with **** and the content is now safe to be delivered or displayed.

    Why would I want to 'Perform no action' if redaction has been successful?

    The Perform no action disposal action instructs the Gateway to consider the next content rule in the policy route. Redaction will be applied as specified by the policy, but no further actions as a result of this content rule will be taken.

  • On unsuccessful redaction - for example, Deliver the Message (email) or Block the Communication using the Block page for Redaction Failure (web).

    Unsuccessful redaction occurs if the modified version of the content would still be sufficient to exceed the lexical expression list threshold, even if the terms were redacted. For example, if your expression list contains an Instant expression with Redact set to No, redaction will always be unsuccessful.

    Redaction is also unsuccessful if content is detected in media types which are not supported by the Redact Text content rule.

    Show me: How can redaction be unsuccessful?

    • An expression list is configured with the following weighted expressions and a threshold of 10. The list is applied to a Redact Text content rule.

      

    • The content rule detects a message:

      FAO: 007
      
      The confidential information you requested regarding Project SecretStop has been classified Top Secret, and cannot be released to you at this time.
      
      In confidence,
      
      M.

    • The combined weight of the detected expressions (+ 4 + Instant + 5 + 6 + 2) is greater than the threshold (10).

    • Redaction is attempted. Only the redactable terms are affected.

      FAO: 007
      
      The confidential information you requested regarding Project ********** has been classified *** ******, and cannot be released to you at this time.
      
      In confidence,
      
      M.

      The remaining non-redactable terms are counted by the content rule.

      confidential (4) + classified (5) + In confidence (2) = 11.

    • Redaction is unsuccessful as the remaining content still exceeds the threshold.

      Typically, the message would be blocked or held.

      Redaction can only be successful if the combined weight of detected non-redactable terms is lower than the lexical expression threshold.

• Configuring lexical expressions for redaction

  The Redact Text content rule relies on well-configured lexical expression lists.

  Guidelines on preparing lexical expression lists for redaction:

  • Group lexical expressions in sensible lists.
  • Only redactable lexical expressions can be redacted. Redactable expressions are indicated by Yes in the Redact column.
  • Use heavier or Instant weighting for lexical expressions you want to be redactable.
  • You cannot change the weight of expressions in a managed list.
  • You can redact any lexical expression, including credit card numbers, identity numbers and predefined expressions.

  See About Lexical Expressions for more information.

• Which file types support adaptive redaction?

  Redaction is supported by the following media types. You can select Which Media Types you want to scan.

  Media Type	Extensions
  HTML	.htm .html
  Microsoft Word document (2007+)	.docx .docm .dotx .dotm
  Microsoft Excel spreadsheet (2007+)	.xlsx .xlsm .xltx
  Microsoft PowerPoint presentation (2007+)	.pptx .pptm .potx .ppsx .ppsm .thmx
  Adobe PDF (portable document format)	.pdf
  Metadata in GIF, JPEG, and PNG images	.gif .jpg .png
  Rich Text Format encoded document	.rtf
  Notepad/Plain text	.txt
  LibreOffice Calc document	.ods
  LibreOffice Draw document	.odg
  LibreOffice Impress document	.odp
  LibreOffice Master document	.odm
  LibreOffice Math document	.odf
  LibreOffice Writer document	.odf

  Redaction is not supported for Microsoft Office 97-2003 documents with the extensions .doc, .xls or .ppt. Content in these documents can be detected but redaction is always unsuccessful.

  Use a Redact Text content rule in a policy route with a Detect Lexical Expression rule, which uses the same expression list. The Detect Lexical Expression rule must exclude any document types that have been selected for the Redact Text rule.

• Redacting documents and attachments

  You can select which parts of a document or attachment you want to redact. For example, you can:

  • Scan body
  • Scan header and footer
  • Scan properties
  • Scan comments

  PDF document properties can be detected but cannot be successfully redacted. Comments in PDF documents can not be detected or redacted.

• Redacting images

  You can configure the Gateway to redact text in image files by selecting Scan text extracted from images (OCR) in a Redact Text content rule. This content rule uses OCR (Optical Character Recognition) technology to modify images, replacing any detected text content with a black bar.

  The Gateway also redacts meta data properties contained within GIF, JPEG, and PNG images.

  Applying Scan extracted images (OCR) to inbound web traffic can have a significant impact on the performance of your Gateway. Clearswift recommends applying OCR to outbound traffic only.

• Encryption and protected documents

  There are a number of ways to restrict access and control of a particular document. For example, a Microsoft Word document could be read-only, password encrypted or stored in a password-restricted zip folder. The Gateway can redact documents that are accessible, even if they have been restricted from editing by the original user.

  Redaction can be successful, even if:

  • The file is read-only
  • The document is 'marked as final'
  • The file is contained within nested zip folders

  Redaction is automatically unsuccessful if:

  • The document is signed with a digital signature A digitally-signed message proves to the recipient that you, not an imposter, signed the contents of the message, and that the contents have not been altered in transit.

  Redaction is not attempted if:

  • The document is encrypted or protected from opening by a password.
  • The document is contained within a password-restricted zip folder.
• Applying the Redact Text content rule to a policy route

  The policy engine attempts to apply redaction content rules as a priority, regardless of their position on the policy route. See How Policy is Applied to Routes for more information.

• Redaction and Social Media

  Some social networking sites use dynamic scripts to protect personal data. It is recommended that redaction is not applied to social networking web sites such as Facebook or Google Mail as the effectiveness of applying these features cannot be guaranteed.

How do I...

• Build a Redact Text content rule?

  A Redact Text content rule is used to detect lexical expressions and attempt redaction.

  Only lexical expressions which are enabled to Redact in a Lexical Expression List will be available for redaction.

  1. Define a Lexical Expression List to include your sensitive information. Show me

     From the Policy Center Home page, click Lexical Expressions. The Manage Lexical Expression Lists page displays all the lexical expression lists available. Click New to create an expression list, or select an existing list and click Edit.

     See the topic About Lexical Expressions to find out more about using Lexical Expressions.

  2. Create a content rule using the Redact Text content rule template. Show me

     1. From the Policy Center Home page click Content Rules to display the Manage Content Rules page.
     2. Click New.
     3. Select Redact Text from the list of content rule templates.
     4. Change the Overview details (the Name of the content rule and any relevant Notes) by clicking Click here to change these settings.
     5. Click Save.
  3. Configure the What To Look For? conditions to detect matching expressions. Show me

     1. In the Lexical Expression section, click Click here to change these settings.

     2. Select which parts of the conversation you want to scan.

        You cannot apply redaction to specific message headers other than the subject line.

     3. Select the Expression list you want the content rule to use as a reference.

        This is the Lexical Expression List you created or edited in step 1.

     4. Select a Trigger value for your expression list. This determines how the content rule measures the weight of detected expressions.

        Always select Greater than or equal. This ensures that the rule will trigger if the threshold is matched or exceeded.

     5. Select Document options to indicate which parts of documents you want to scan. Click Save.

  4. Configure the remaining What To Look For? conditions. Show me

     1. Select Which Media Types you want the Gateway to look for. Click Click here to change these settings.

        You can select individual document types using the Detectable Types window to select which file types you want to detect.

        Click Save.

        Select the Documents check box in the Detectable Types window to select all document formats.

     2. Add a Size Restriction. Click Click here to change these settings.
     3. Select Enable the Size Restriction if required. You can enter a maximum or minimum size restriction. Enter a value in KB and select or more or or less. Click Save.

     4. Select the Direction To Apply the content rule by clicking Click here to change these settings. You can specify whether the detected items are entering the company, leaving the company, or either entering or leaving the company. Click Save.

     5. Configure Scan text extracted from images (OCR) to detect sensitive content in image files.

        If you select this option, OCR will apply to images regardless of which Detectable Types are selected.

  5. Configure the What To Do? actions if redaction is successful. Show me

     1. Use the On Successful Redaction section to select the appropriate Disposal Action (email) or Primary Action (web).

     2. Click Save.

     3. Add any What Else To Do? actions by clicking New.

        To find out more about configuring actions, see About What To Do? Actions

     4. Click Save.

  6. Configure the What To Do? actions if redaction is unsuccessful. Show me

     1. Use the On Unsuccessful Redaction section to select the appropriate Disposal Action (email) or Primary Action (web).

     2. Click Save.

     3. Add any What Else To Do? actions by clicking New.

        To find out more about configuring actions, see About What To Do? Actions

     4. Click Save.

  7. Apply Configuration.

     The content rule can now be applied to a policy route.

• Build a Detect Lexical Expression content rule to use with redaction?

  A Detect Lexical Expression content rule can be used to provide an extra layer of security, blocking or holding content which has not been successfully redacted.

  1. Define a Lexical Expression List. Show me

     Only lexical expressions which are configured as Redactable in a Lexical Expression List will be available for redaction.

     From the Policy Center Home page, click Lexical Expressions. The Manage Lexical Expression Lists page displays all the lexical expression lists available. Click New to create an expression list, or select an existing list and click Edit.

     See the topic About Lexical Expressions to find out more about using Lexical Expressions.

  2. Create a content rule using the Detect Lexical Expression content rule template. Show me

     1. From the Policy Center Home page click Content Rules to display the Manage Content Rules page.
     2. Click New.
     3. Select Detect Lexical Expression from the list of content rule templates.
     4. Change the Overview details (the Name of the content rule and any relevant Notes) by clicking Click here to change these settings.
     5. Click Save.
  3. Configure the What To Look For? conditions to detect matching expressions. Show me

     1. In the Lexical Expression section, click Click here to change these settings.

     2. Select which parts of the conversation you want to scan.

        Do not select The message body or The subject line if you are using this content rule in conjunction with a Redact Text content rule.

     3. Select the Expression list you want the content rule to use as a reference.

        This is the Lexical Expression List you created or edited in step 1.

     4. Select a Trigger value for your expression list. This determines how the content rule measures the weight of detected expressions.

        Always select Greater than or equal. This ensures that the rule will trigger if the threshold is matched or exceeded.

     5. Select Document options to indicate which parts of documents you want to scan. Click Save.

        Scan embedded script can have a significant impact if applied to an outbound social media policy route. For example, users of Facebook or Google Mail might find their access irreversibly disrupted if a lexical expression is detected within an instant message.

  4. Configure the remaining What To Look For? conditions. Show me

     1. Select Which Media Types you want the Gateway to look for. Click Click here to change these settings.

        You can select individual document types using the Detectable Types window to select which file types you want to detect.

        You must exclude any document types which have been selected for the Redact Text content rule in the policy route.

     2. Click Save.
     3. Add a Size Restriction. Click Click here to change these settings.
     4. Select Enable the Size Restriction if required. You can enter a maximum or minimum size restriction. Enter a value in KB and select or more or or less. Click Save.

     5. Select the Direction To Apply the content rule by clicking Click here to change these settings. You can specify whether the detected items are entering the company, leaving the company, or either entering or leaving the company. Click Save.

  5. Configure the What To Do? actions. Show me

     1. Change the What to Do? actions of the content rule to determine what happens when the content rule is triggered. Click Click here to change these settings. Select a Disposal Action (email) or a Primary Action (web).

     2. Click Save.

  6. Apply Configuration.

     The content rule can now be applied to a policy route.

• Bypass redaction for signed documents?

  You can configure the Gateway to bypass the Redact Text content rule when it encounters a signed document.

  Configure a Redact Text content rule and add the Bypass Rule What to Look For? clause by selecting the Bypass Rule for signed documents check box.

Show me...

• Example 1. Hide confidential information

  I want to prevent specific terms and phrases leaving my organization, unless they have been appropriately redacted.

  1. Create an expression list to detect classified terms. In this scenario, the threshold is set to 10.

     See Create a Lexical Expression List to find out how to do this.

     

  2. Configure a Redact Text content rule which scans content for matching expressions using this expression list. Set the What To Do? actions as follows:

     • On successful redaction .... Deliver the message

     • On unsuccessful redaction ... Hold the message

  3. Apply the content rule to a policy route.

     See About Policy Routes for more information.

  What happens when a message is detected?

  • The Gateway detects the text:

    Dear M,
    
    The information you provided for Codename: SecretStop appears to be encrypted. Is this still classified as confidential? Please advise,
    
    James
    

  • The combined weight of the detected expressions is greater than the threshold and redaction will be attempted:

    Dear M,
    
    The information you provided for ********: ********** appears to be encrypted. Is this still classified as confidential? Please advise,
    
    James
    

  • The remaining matching expressions are counted = +5 +4 = 9.

    Redaction is successful as the remaining content is not sufficient to outweigh the threshold.

    The redacted message text is delivered.

    If the modified message contained terms which still exceeded the threshold, the redaction would be considered unsuccessful and the corresponding action (Hold the message) would be performed.

• Example 2. Redaction attempted with weighted expressions

  I want to apply redaction to weighted lexical expressions.

  1. Create an expression list to detect classified terms. The threshold is set to 10.

     See Create a Lexical Expression List to find out more.

     

  2. Build a Redact Text content rule which scans content for matching expressions.

  3. Apply the content rule to a policy route.

     See About Policy Routes for more information.

  What happens when the Gateway detects a message?

  • The Gateway detects the text:

    Dear Mr Bond,
    
    Thank you for the top secret information you sent us in confidence. Your help will be invaluable to the success of our operation.
    
    Agent X. ,

  • The expressions in red are detected and counted = +6 +2 = 8. This is not sufficient to trigger the content rule.

    • Redaction is not attempted
    • The original message is delivered

    When creating or editing lexical expressions, give them high or Instant weightings if you also want them to be redactable.

• Example 3. Redaction of a Managed List

  I want to apply redaction to any outward communication containing English or Japanese swear words.

  Profanities are stored in Managed Lists. Managed Lists must be copied before they can be configured as redactable.

  1. Copy the required Managed Lists. In this case, Swear Words: English and Swear Words: Japanese. Show me

     1. Click Policy > Lexical Expressions and select the Managed Lists tab.
     2. Select the lists you want to copy.

     3. Click Copy.

        The lists are copied to the Lexical Expressions tab and are indicated as new expression lists:

        Swear Words: English Copy

        Swear Words: Japanese Copy

     See About Lexical Expressions to find out more about managed lists and lexical expression lists.

  2. Set the expressions in each of your lists to Redact all. Show me

     1. Select the expression list and click Edit.
     2. In the Expressions section click Redact all.

  3. Build a Redact Text content rule which scans content for matching expressions.

  4. Apply the content rule to a policy route, for example from My Company to Everyone.

     See About Policy Routes for more information.

• Example 4. Redact Twitter updates

  I want to prevent my employees from mentioning my company name on Twitter. I want to redact this text from any updates and inform a manager every time someone attempts this.

  While adaptive redaction does not support downloads from script based networking sites such as Facebook or Gmail, Twitter uploads can be redacted.

  1. Create an expression list called My Company Names with the appropriate expressions set to Redact.

     See Create a Lexical Expression List to find out more.

     

  2. Create a Redact Text content rule.

     Click Policy > Content Rules > New. Select Redact Text.

  3. In the What To Look For? section, configure the Lexical Expression clause to detect your expression list.

     • Scan: Content
     • Expression list: My Company Names
     • Trigger: Greater than or equal

     • Document options: not applicable

     See About the What To Look For? clauses for more information.

  4. Configure the What To Do? actions to specify what happens if redaction is successful or unsuccessful. In this scenario, you might want the policy to do the following:

     On Successful Redaction	On Unsuccessful Redaction
     Allow the communication	Block the communication
     Generate an Inform	Generate an inform

     See What To Do? actions for more information.

  5. When you have configured the content rule, apply the configuration.

  6. Add the content rule to the policy routes which connect Everyone to Twitter.

     Click Policy > Web Policy Routes.

     See About Policy Routes for more information about how to create web policy routes and add a content rule.

  7. Apply the configuration.
• Example 5. Redact credit card numbers

  I want to redact any credit card numbers which are downloaded from financial sites.

  1. Create (or edit) an expression list containing a predefined entity, Credit Card Number with redaction enabled. Show me

     1. Click Policy > Lexical Expressions
     2. Click New or Edit to open an expression list.
     3. In the Expressions section, click New and select Predefined.
     4. Select Credit Card from the list of predefined entities.
     5. Set the If matched (weighting) score.
     6. Select Redact.
     7. Click Add.

     

     Credit cards numbers are redacted with the last four digits displayed in plain-text. For example, ***********3624.

     See Create a Lexical Expression List to find out more.

  2. Create a Redact Text content rule.

     Click Policy > Content Rules > New. Select Redact Text.

  3. In the What To Look For? section, configure the Lexical Expression clause to detect your expression list.

     • Scan: Content
     • Expression list: Your expression list name
     • Trigger: Greater than or equal

     • Document options: select all

     See About the What To Look For? clauses for more information.

  4. Select the Direction to Apply: entering the company.

  5. Configure the What To Do? actions to specify what happens if redaction is successful or unsuccessful. In this scenario, you might want the policy to do the following:

     On Successful Redaction	On Unsuccessful Redaction
     Allow the communication	Block the communication
     Perform no action	Generate an inform

     See What To Do? actions for more information.

  6. When you have configured the content rule, apply the configuration.

  7. Add the content rule to the policy routes which connect Everyone to Financial Sites (HTTPS).

     Click Policy > Web Policy Routes.

     See About Policy Routes for more information about how to create web policy routes and add a content rule.

  8. Apply the configuration.

See also...

• Sanitization
• Working with Lexical Expressions
• More about Content Rules
• What to Look For? Clauses
• What to Do? Actions
• Configuring a Policy Route