​

Discover Sensitive Data & Compliance

Objective

This document provides instructions on how to set up and manage sensitive data policies for visibility of compliance in the API inventory.

Prerequisites

Configuration

  • Create a sensitive data discovery
  • Configure relevant compliance frameworks for their organization
  • Disable built-in sensitive data detections
  • Add custom sensitive data detections
  • Assign the discovery to a Load balancer

The result of this configuration will allow you to see which API endpoints contain sensitive data. The sensitive data identified is governed by the your selected compliance frameworks (i.e. HIPAA, GDPR, PCI-DSS, etc.).

Step 1: Log into Console and create a new Sensitive Data Discovery.

  • Log into Console.

  • Click Web App & API Protection.

Figure: Console Homepage

Figure: Console Homepage

  • Confirm the correct namespace is selected.

  • Select Manage > API Management > Sensitive Data Discovery.

Figure: Sensitive Data Discovery

Figure: Sensitive Data Discovery

  • Click Add Sensitive Data Discovery.
Figure: Select Compliance Frameworks

Figure: Select Compliance Frameworks

  • In the Name field, enter a name for the new discovery.

  • Optionally, select a label and enter a description.

  • Select compliance framework(s) you wish to follow (GDPR, HIPAA, PCI-DSS, etc.)

Figure: Disabled Sensitive Data Types

Figure: Disabled Sensitive Data Types

  • If there are data types in compliance frameworks you have selected, and you don't want them labeled as sensitive data, you can add them to the Disabled Built-In Sensitive Data Types list. For each such item,

    • Click Add Item
    • Select a sensitive data type from the new drop-down list.

  • If you require custom data types, then click Configure under Defined Custom Sensitive Data Types to start building a list. For each such item,

    • Click Add Item
    • Select a previously defined custom sensitive data type from the new drop-down list. If you need to create a new one, you can click Add Item from the drop-down list or follow Step 2 below.
    • Click Apply when you have finished building the list.

  • Click Save and Exit to save your new discovery.

Step 2: Create a Custom Sensitive Data Type.

  • Navigate to Security > API Management > Data Types

  • Click Add Data Type.

Figure: New Compliance Data Type

Figure: New Compliance Data Type

  • In the Name field, enter a name for the new data type.

  • Optionally, select a label and enter a description.

  • Click Configure under Data Type Rules to start building a rule list. For each rule you want to create,

    • Click Add Item.
    • Specify the Detection Rule: From the Pattern Choice menu, select how to search for the Data Type. You can search by Key Pattern, Value Pattern, or Key-Value Pattern. For each of these options, you can match by exact value or using regular expressions (regex) using the menu options provided.
    • Click Apply to complete rule creation.
    • Click Apply to save the list of Data Type Rules.

  • Make sure Mark as Sensitive Data is checked to enable vulnerability detection.

  • Check the Mark as PII checkbox if your data type is for personal identifiable information.

  • Use the Relevant Compliances drop-down menu to select compliances that enforce this data type.

  • Click Save and Exit to save the data type.

Step 3: Configure Load Balancer.

  • Navigate to Manage > Load Balancers > HTTP Load Balancers

  • Select ...>Manage Configuration for your load balancer to view its configuration. Next select Edit Configuration in the upper right corner to edit its configuration.

  • Scroll down to the API Protection section.

Figure: Select Sensitive Data discovery

Figure: Select Sensitive Data discovery

  • In the Sensitive Data Discovery drop-down menu, select either Default or Custom.

    • For Custom, select an existing discovery or click Add Item from the Specify Sensitive Data Discovery drop-down menu. See Step 1 above for information on creating a new Sensitive Data Discovery.

  • Click Save and Exit to save changes to the load balancer.

Step 4: View Compliant API Endpoints In Inventory.

  • Navigate to Overview > Security.

  • Scroll to the bottom and click the name of your load balancer in the Application Delivery section. This will bring up the security dashboard for that load balancer.

  • Click the API Endpoints tab.

Figure: API Endpoints Tab

Figure: API Endpoints Tab

  • Click the gear icon ( ⚙ ) above the endpoint table to change which column data is shown in the table. Make sure that API Compliance is selected to see which compliance framework(s) govern each API endpoint.
Figure: Enable the API Compliance Column

Figure: Enable the API Compliance Column

  • Now the compliance framework(s) governing an endpoint will be show, if applicable.
Figure: Show the API Compliance Column

Figure: Show the API Compliance Column

Concepts

API References

On this page: