FortiMail DLP Standard Compliance & Fingerprint
From FortiMail documentation, one can read:
Sensitive data can be any of the following types:
Predefined: For your convenience, FortiMail comes with a list of predefined information types, such as credit card numbers and SIN numbers. To view the predefined sensitive data, go to Data Loss Prevention > Sensitive Data > Standard Compliance.
Indeed, I can find the list of pre-defined sensitive data and their names made clear what they match most of the time. However, I was wondering if it was possible to get details on how these default predefined sensitive data are actually configured. For instance, would "Illegal_Drugs" match drug names in any language? The same question applies to "Offensive_Words". If not, knowing the structure of these would help configure our own fingerprint.
Regarding fingerprint, the documentation states:
DLP document fingerprinting
One of the DLP techniques to detect sensitive data is fingerprinting (also called document fingerprinting). Most DLP techniques rely on you providing a characteristic of the file you want to detect, whether it’s the file type, the file name, or part of the file contents. Fingerprinting is different in that you provide the file itself. The FortiMail unit then generates a checksum fingerprint and stores it. The FortiMail unit generates a fingerprint for all email attachments, and compares it to all of the fingerprints stored in its fingerprint database. If a match is found, the configured action is taken.
Does that mean DLP document fingerprinting can detect that a part of a document being attached in the email or not? Let's say the document used to create the fingerprint is an .xlsx file of 50 company names. Would this match the exact same document being attached in the email or would it match any .xlsx document containing any single one of the company names? Is this just a matching on the file hash or an actual document fingerprinting?
