Forum Discussion
Nik_67256
Nimbostratus
NimbostratusData Gurad - Mask Data checkbox
Hello,
Wanted to confirm my understanding on Data guard (for ease one may answer in "Yes/No")
1) Does enabling "Masking Data" prevent the end users to view the cc/ssn data (i.e encodes it so they will see *****).
2) If i want none of my users to view the ssn/cc data (as there is a business justification/need), then do i allways ensure that the "Mask data" checkbox is enabled.
3) If i want some of my users(still to be identified) to view the ssn/cc data (as there is a business justification/need), then do i do the following steps:
a) Initially ensure mask data check box is switched off
b) Let the traffic policy builder learn on whats legitimate and whats not (based on a
continious traffic or a one-off traffic) / or manually accept or clear learnings
c) Accept traffic as legitimate, and clear the illegitimate ones on the learning screen
d) Once im sure of the traffic , Enable back the "Mask Data" - as it will now be applied to
traffic identified as illegitimate only.
1 Reply
hoolioCirrostratus
Hi Nik
1) Does enabling "Masking Data" prevent the end users to view the cc/ssn data (i.e encodes it so they will see *****).
ASM can either block the response or mask the data. Here's more detail from the online help:
* If the security policy’s enforcement mode is Transparent and the Mask Data check box is checked, the system encodes the sensitive data by returning asterisks to the client instead of the sensitive data. (The system also returns asterisks if the enforcement mode is Blocking, the Data Guard: Information leakage detected violation Block check box is cleared, and the Alarm check box is checked.)
* If the security policy’s enforcement mode is Blocking, and the Block check box for the Data Guard: Information leakage detected violation is checked, the system blocks the response.
2) If i want none of my users to view the ssn/cc data (as there is a business justification/need), then do i allways ensure that the "Mask data" checkbox is enabled.
Yes, you'd want to either block the full response or mask the data.
3) d) Once im sure of the traffic , Enable back the "Mask Data" - as it will now be applied to traffic identified as illegitimate only.
I don't think ASM masks or blocks responses with content that matches a data guard pattern based on other violations. If the response matches a pattern it will be masked or blocked, depending on the blocking settings for data guard.
The default GUI based config options for this don't allow you to make decisions on masking or blocking based on who the user is. If the application restricts access to specific URIs to allow only some users, you could define those URIs in the data guard list to not check.
Aaron
![\"F5](\"https://www.f5.com/content/dam/f5/f5-logo.svg\"){kind=logo}