Technical Tip: How to configure FortiMail DLP to detect Malaysian Identity Card Numbers

Description

This article describes how to configure FortiMail Data Loss Prevention (DLP) to detect Malaysian identity card numbers in email messages and attachments.

Scope

FortiMail.

Solution

FortiMail DLP can use user-defined sensitive data, including regular expressions, to identify specific information in email traffic.

For example, a Malaysian identity card number can be detected using a pattern matching the commonly used format:

YYMMDD-SS-####

Note:

The regular expression should be adjusted according to the organization's actual identity-card format and detection requirements.

1. Create the Scan rule:

Go to:

Data Loss Prevention -> Rule & Profile -> Rule.

Select the appropriate pattern type, such as Regular Expression.

Enter the regular expression for the identity card number.

For example: \b\d{6}-\d{2}-\d{4}\b.

Save the configuration.

FortiMail supports user-defined sensitive data, such as words, phrases, and regular expressions.

2. Create a DLP Rule:

Go to: Data Loss Prevention -> Rule & Profile -> Profile, select 'New', enter a name.

Under Conditions, select New, and configure the condition to check for the previously created sensitive data.

Select the email portion to inspect, such as:

• Body.

• Attachment.

• Body and attachment.

Select the required action, save the rule.

FortiMail DLP rules can specify which part of an email should be checked, including email bodies and attachments.

3. Apply the DLP profile to the policy.