Caveats and Known Considerations of Data Loss Prevention (DLP) Scanning

Edit online

Secure Proxy supports Data Loss Prevention (DLP) scanning at the file or request level, where the entire file or request is scanned. Additionally, Secure Proxy provides a Preview Scanning feature. When enabled, this feature allows a small portion of data, starting from the beginning of the file or request, to be sent to the ICAP server. If no sensitive data is detected, the ICAP server requests Secure Proxy to send the remaining data for DLP scanning.

The following section describes implementation scenarios, caveats, and known considerations related to ICAP DLP scanning in Secure Proxy.

Caveats

  • Secure Proxy does not write data to disk in the DMZ. Storing large files or requests in memory before scanning could lead to an out-of-memory issue. To mitigate this, Secure Proxy limits the size of files or requests to scan using the Maximum Allowed File/Request Size parameter, which defaults to 1 MB.
  • Waiting for complete files or requests to be received and scanned may introduce additional transmission delays, potentially affecting performance. To address this, system timeout values may need to be increased.
  • All data buffers associated with a file or request transmission are streamed and sent to the ICAP server. These buffers are combined into a scanning unit at the ICAP server.
  • When ICAP virus scanning is enabled for the SFTP protocol, any detected virus is reported in the audit and log files, and the file transmission is immediately aborted.
  • If the total number of active ICAP sessions in Secure Proxy (across multiple SFTP adapters) exceeds the Maximum Allowed ICAP Sessions value in the ICAP Configuration, the file is sent to the backend server without scanning.
    • When a file is sent unscanned, a default .unscanned extension is appended to the file name. This extension can be customized in the Rename Unscanned Files tab.
    • If the ICAP server cannot be connected or an error occurs during scanning, the session will fail, or the file will be sent unscanned with the .unscanned or custom extension appended. Secure Proxy can be configured to handle ICAP server connection failures. In the ICAP Configuration, select Session Fails or Transfer File Unscanned to Backend for the In Case of ICAP Server Connection Failures field.
  • Secure Proxy buffers data up to the maximum size received from the client and sends it to the ICAP server for scanning. The ICAP server does not return the data after scanning; instead, Secure Proxy sends the cached data to the backend server. This increases memory requirements on the Secure Proxy Engine host, depending on expected concurrent sessions.
    Increase the heap memory allocated to Java for the Secure Proxy Engine based on the usage requirements. Adjust the MAXHEAP size to match the total file sizes transferred concurrently.
    • For example, if the maximum file size for scanning is 1 MB and you have two SFTP adapters, each with a maximum session limit of 100, increase the MAXHEAP parameter by 200 MB.
    • To modify the MAXHEAP parameter, see Modify Heap Size.

Known Considerations

All supported ICAP servers are enabled for secure connections to ensure privacy, confidentiality, and integrity.

  • If a scan fails, Secure Proxy terminates the session if sensitive data is detected and reported by the ICAP Server or DLP Scanner.

The following table describes ICAP Data Loss Prevention (DLP) scanning implementation scenarios over SFTP protocols and how it is handled via Secure Proxy.

Table 1. ICAP Data Loss Prevention (DLP) scan via Secure Proxy: implementation scenarios and their handling

Scenario Action
SFTP Protocol
An ICAP server connection error/response timeout occurs or an ICAP server returns an error Options available:
  • Fail the session with error
  • File is sent to the standard backend server without scan and .unscanned or custom extension string appended at the end of the file name
File exceed the maximum file size limit specified in the Secure Proxy CM GUI (ICAP configuration) File is sent to the standard outbound node with .unscanned or custom extension string appended at the end of the file name.
File fails ICAP Data Loss Prevention (DLP) scanning that is, a sensitive data is detected An audit log event is generated. The file is not sent to the backend server and the session is terminated.
The file name extension is outside the selected extensions for Data Loss Prevention (DLP) scanning The file is sent to the backend server bypassing sending to the ICAP server and an audit log is generated.