觸發DLP違規以測試ESA上的HIPAA策略
簡介
本文檔介紹在思科郵件安全裝置(ESA)的傳出郵件策略上啟用DLP後，如何測試Health Insurance Portability and Accountability Act (HIPAA)資料丟失防範(DLP)。
觸發DLP違規以測試HIPAA策略
本文提供一些真實內容，這些內容已經過修改以保護人員，以根據ESA上的DLP策略進行測試。此資訊旨在觸發HIPAA和面向經濟和臨床健康的健康資訊科技(HITECH) DLP策略，並觸發其他DLP策略，如社會安全號碼(SSN)、CA AB-1298、CA SB-1386等。當您透過ESA傳送測試電子郵件或使用跟蹤工具時，請使用這些資訊。
Procedure Notes
Progress Notes
Archie M Johnson Tue Jun 30, 2009 10:31 AM Pended
June 30, 2009
Patient Name: Gina, Lucas DOB: 01/23/1945
Telephone #: (559) 221-2345
SS#: [[[PLACE SSN HERE]]]
--------------------------------------------------------------------------------
Insurance: UHC
How was the patient referred to the office: *** ({:20})
Is a family member currently being seen by the requested physician? {YES/NO:63}
If yes, what is the family members name : ***
Previous PCP / Medical Group? ***
Physician Requested: Dr. ***
REASON:
1) Get established, no current problems: {YES/NO:63}
2) Chronic Issues: {YES/NO:63}
3) Specific Problems: {YES/NO:63}
Description of specific problem and/or chronic conditions:
{OPMED SYMPTOMS:11123} the problem started {1-10:5044} {Time Units:10300}.
Any Medications that may need a refill? {YES/NO:63}
Current medications: ***
--------------------------------------------------------------------------------
Archie M Johnson
Community Health Program Assistant Chief
Family Practice & Community Medicine
(559) 221-1234
Lucas Gina Wed Jul 8, 2009 10:37 AM Pended
ELECTIVE NEUROLOGICAL SURGERY
HISTORY & PHYSICAL
CHIEF COMPLAINT: No chief complaint on file.
HISTORY OF PRESENT ILLNESS: Mary A Xxtestfbonilla is a ***
Past Medical History
Diagnosis Date
• Other Deficiency of Cell-Mediated Immunity
Def of cell-med immunity
• Erythema Multiforme
• Allergic Rhinitis, Cause Unspecified
Allergic rhinitis
• Unspecified Osteoporosis 12/8/2005
DEXA scan - 2003
• Esophageal Reflux 12/8/2005
priolosec, protonix didn't work, lost weight
• Primary Hypercoagulable State
MUTATION FACTOR V LEIDEN
• Unspecified Glaucoma 1/06
• OPIOID PAIN MANAGEMENT 1/24/2007
Patient is on opioid contract - see letter 1/24/2007
• Chickenpox with Other Specified Complications 2002
驗證
根據您為DLP策略設定的郵件操作，您的結果會有所不同。透過GUI檢視以下內容為配置並確認裝置的操作：Mail Policies > DLP Policy Customizations > Message Actions。
在本示例中，Default Action被設定為將DLP違規隔離到策略隔離，並且還會修改帶有字首「[DLP VIOLATION]」的郵件主題行。
當您以測試電子郵件的形式傳送先前內容時，mail_logs應顯示類似如下內容：
Wed Jul 30 11:07:14 2014 Info: New SMTP ICID 656 interface Management (172.16.6.165)
address 172.16.6.1 reverse dns host unknown verified no
Wed Jul 30 11:07:14 2014 Info: ICID 656 RELAY SG RELAY_SG match 172.16.6.1 SBRS
not enabled
Wed Jul 30 11:07:14 2014 Info: Start MID 212 ICID 656
Wed Jul 30 11:07:14 2014 Info: MID 212 ICID 656 From: <my_user@gmail.com>
Wed Jul 30 11:07:14 2014 Info: MID 212 ICID 656 RID 0 To: <test_person@cisco.com>
Wed Jul 30 11:07:14 2014 Info: MID 212 Message-ID
'<A85EA7D1-D02B-468D-9819-692D552A7571@gmail.com>'
Wed Jul 30 11:07:14 2014 Info: MID 212 Subject 'My DLP test'
Wed Jul 30 11:07:14 2014 Info: MID 212 ready 2398 bytes from <my_user@gmail.com>
Wed Jul 30 11:07:14 2014 Info: MID 212 matched all recipients for per-recipient
policy DEFAULT in the outbound table
Wed Jul 30 11:07:16 2014 Info: MID 212 interim verdict using engine: CASE spam
negative
Wed Jul 30 11:07:16 2014 Info: MID 212 using engine: CASE spam negative
Wed Jul 30 11:07:16 2014 Info: MID 212 interim AV verdict using Sophos CLEAN
Wed Jul 30 11:07:16 2014 Info: MID 212 antivirus negative
Wed Jul 30 11:07:16 2014 Info: MID 212 Outbreak Filters: verdict negative
Wed Jul 30 11:07:16 2014 Info: MID 212 DLP violation
Wed Jul 30 11:07:16 2014 Info: MID 212 quarantined to "Policy" (DLP violation)
Wed Jul 30 11:08:16 2014 Info: ICID 656 close
使用跟蹤工具時，如果在郵件正文中使用以前的內容，您應該會看到類似以下影象列出的結果：
疑難排解
確保您已從GUI中的Mail Policies > DLP Policy Manager > Add DLP Policy...中選擇所需的DLP策略。
檢查增加的DLP策略，並確保您已指定內容匹配分類器且正規表示式模式有效。另外，請確保已配置AND match with related words or phrase部分。分類器是DLP引擎的檢測元件。它們可以組合使用或單獨使用，以辨識敏感內容。
如果沒有看到基於內容的DLP觸發器，請同時檢視郵件策略>傳出郵件策略> DLP，並確保您已啟用所需的DLP策略。
相關資訊
修訂記錄
| 修訂 | 發佈日期 | 意見 |
|---|---|---|
1.0 |
05-Aug-2014 |
初始版本 |
意見