Open with table of contents

Adaptive redaction

You can use adaptive redaction to allow email traffic to be delivered (or displayed) with detected words, phrases or expressions replaced with * characters. Adaptive redaction is a powerful and flexible way to ensure sensitive information is protected without holding or blocking communications.

Tell me about...

• How redaction works with Clearswift ARgon for Email

  Redaction is performed by a Redact Text content rule. The content rule:

  • Scans content for terms and expressions matching items on a Lexical Expression List.

  If the rule is triggered, the ARgon Server:

  • Attempts to redact the content appropriately and applies the What To Do? actions.

  The Redact Text content rule applies a different set of What To Do? actions for the following conditions:

  • On successful redaction- for example, Perform no action (email)

    Successful redaction occurs if the modified version of the content no longer exceeds the lexical expression list threshold. This occurs if the 'heavier' terms in the original communication have been replaced with **** and the content is now safe to be delivered or displayed.

    Why would I want to 'Perform no action' if redaction has been successful?

    The Perform no action disposal action instructs the ARgon Server to consider the next content rule in the policy route. Redaction will be applied as specified by the policy, but no further actions as a result of this content rule will be taken.

  • On unsuccessful redaction - for example, Deliver the Message (email)

    Unsuccessful redaction occurs if the modified version of the content would still be sufficient to exceed the lexical expression list threshold, even if the terms were redacted. For example, if your expression list contains an Instant expression with Redact set to No, redaction will always be unsuccessful.

    Redaction is also unsuccessful if content is detected in media types which are not supported by the Redact Text content rule.

    Show me: How can redaction be unsuccessful?

    • An expression list is configured with the following weighted expressions and a threshold of 10. The list is applied to a Redact Text content rule.

      

    • The content rule detects a message:

      FAO: 007
      
      The confidential information you requested regarding Project SecretStop has been classified Top Secret, and cannot be released to you at this time.
      
      In confidence,
      
      M.

    • The combined weight of the detected expressions (+ 4 + Instant + 5 + 6 + 2) is greater than the threshold (10).

    • Redaction is attempted. Only the redactable terms are affected.

      FAO: 007
      
      The confidential information you requested regarding Project ********** has been classified *** ******, and cannot be released to you at this time.
      
      In confidence,
      
      M.

      The remaining non-redactable terms are counted by the content rule.

      confidential (4) + classified (5) + In confidence (2) = 11.

    • Redaction is unsuccessful as the remaining content still exceeds the threshold.

      Typically, the message would be blocked or held.

      Redaction can only be successful if the combined weight of detected non-redactable terms is lower than the lexical expression threshold.

• Configuring lexical expressions for redaction

  The Redact Text content rule relies on well-configured lexical expression lists.

  Guidelines on preparing lexical expression lists for redaction:

  • Group lexical expressions in sensible lists.
  • Only redactable lexical expressions can be redacted. Redactable expressions are indicated by Yes in the Redact column.
  • Use heavier or Instant weighting for lexical expressions you want to be redactable.
  • You cannot change the weight of expressions in a managed list.
  • You can redact any lexical expression, including credit card numbers, identity numbers and predefined expressions.

  See About Lexical Expressions for more information.

• Which file types support adaptive redaction?

  Redaction is supported by the following media types. You can select Which Media Types you want to scan.

  Media Type	Extensions
  HTML	.htm .html
  Microsoft Word document (2007+)	.docx .docm .dotx .dotm
  Microsoft Excel spreadsheet (2007+)	.xlsx .xlsm .xltx
  Microsoft PowerPoint presentation (2007+)	.pptx .pptm .potx .ppsx .ppsm .thmx
  Adobe PDF (portable document format)	.pdf
  Rich Text Format encoded document	.rtf
  Notepad/Plain text	.txt
  LibreOffice Calc document	.ods
  LibreOffice Draw document	.odg
  LibreOffice Impress document	.odp
  LibreOffice Master document	.odm
  LibreOffice Math document	.odf
  LibreOffice Writer document	.odf

  Redaction is not supported for Microsoft Office 97-2003 documents with the extensions .doc, .xls or .ppt. Content in these documents can be detected but redaction is always unsuccessful.

  Use a Redact Text content rule in a policy route with a Detect Lexical Expression rule, which uses the same expression list. The Detect Lexical Expression rule must exclude any document types that have been selected for the Redact Text rule.

• Redacting documents and attachments

  You can select which parts of a document or attachment you want to redact. For example, you can:

  • Scan body
  • Scan header and footer
  • Scan properties
  • Scan comments

  PDF document properties can be detected but cannot be successfully redacted. Comments in PDF documents can not be detected or redacted.

• Encryption and protected documents

  There are a number of ways to restrict access and control of a particular document. For example, a Microsoft Word document could be read-only, password encrypted or stored in a password-restricted zip folder. The ARgon Server can redact documents that are accessible, even if they have been restricted from editing by the original user.

  Redaction can be successful, even if:

  • The file is read-only
  • The document is 'marked as final'
  • The file is contained within nested zip folders

  Redaction is automatically unsuccessful if:

  • The document is signed with a digital signature

  Redaction is not attempted if:

  • The document is encrypted or protected from opening by a password.
  • The document is contained within a password-restricted zip folder.
• Applying the Redact Text content rule to a policy route

  The policy engine attempts to apply redaction content rules as a priority, regardless of their position on the policy route. See How Policy is Applied to Routes for more information.

How do I...

• Build a Redact Text content rule?

  A Redact Text content rule is used to detect lexical expressions and attempt redaction.

  Only lexical expressions which are enabled to Redact in a Lexical Expression List will be available for redaction.

  1. Define a Lexical Expression List to include your sensitive information. Show me

     From the Policy Center Home page, click Lexical Expressions. The Manage Lexical Expression Lists page displays all the lexical expression lists available. Click New to create an expression list, or select an existing list and click Edit.

     See the topic About Lexical Expressions to find out more about using Lexical Expressions.

  2. Create a content rule using the Redact Text content rule template. Show me

     1. From the Policy Center Home page click Content Rules to display the Manage Content Rules page.
     2. Click New.
     3. Select Redact Text from the list of content rule templates.
     4. Change the Overview details (the Name of the content rule and any relevant Notes) by clicking Click here to change these settings.
     5. Click Save.
  3. Configure the What To Look For? conditions to detect matching expressions. Show me

     1. In the Lexical Expression section, click Click here to change these settings.

     2. Select which parts of the conversation you want to scan.

        You cannot apply redaction to specific message headers other than the subject line.

     3. Select the Expression list you want the content rule to use as a reference.

        This is the Lexical Expression List you created or edited in step 1.

     4. Select a Trigger value for your expression list. This determines how the content rule measures the weight of detected expressions.

        Always select Greater than or equal. This ensures that the rule will trigger if the threshold is matched or exceeded.

     5. Select Document options to indicate which parts of documents you want to scan. Click Save.

  4. Configure the remaining What To Look For? conditions. Show me

     1. Select Which Media Types you want the ARgon Server to look for. Click Click here to change these settings.

        You can select individual document types using the Detectable Types window to select which file types you want to detect.

        Select the Documents check box in the Detectable Types window to select all document formats.

     2. Click Save.
     3. Add a Size Restriction. Click Click here to change these settings.
     4. Select Enable the Size Restriction if required. You can enter a maximum or minimum size restriction. Enter a value in KB and select or more or or less. Click Save.

     5. Select the Direction To Apply the content rule by clicking Click here to change these settings. You can specify whether the detected items are entering the company, leaving the company, or either entering or leaving the company. Click Save.

  5. Configure the What To Do? actions if redaction is successful. Show me

     1. Use the On Successful Redaction section to select the appropriate Disposal Action (email) or Primary Action (web).

     2. Click Save.

     3. Add any What Else To Do? actions by clicking New.

        To find out more about configuring actions, see About What To Do? Actions

     4. Click Save.

  6. Configure the What To Do? actions if redaction is unsuccessful. Show me

     1. Use the On Unsuccessful Redaction section to select the appropriate Disposal Action (email) or Primary Action (web).

     2. Click Save.

     3. Add any What Else To Do? actions by clicking New.

        To find out more about configuring actions, see About What To Do? Actions

     4. Click Save.

  7. Apply Configuration.

     The content rule can now be applied to a policy route.

• Build a Detect Lexical Expression content rule to use with redaction?

  A Detect Lexical Expression content rule can be used to provide an extra layer of security, blocking or holding content which has not been successfully redacted.

  1. Define a Lexical Expression List. Show me

     Only lexical expressions which are configured as Redactable in a Lexical Expression List will be available for redaction.

     From the Policy Center Home page, click Lexical Expressions. The Manage Lexical Expression Lists page displays all the lexical expression lists available. Click New to create an expression list, or select an existing list and click Edit.

     See the topic About Lexical Expressions to find out more about using Lexical Expressions.

  2. Create a content rule using the Detect Lexical Expression content rule template. Show me

     1. From the Policy Center Home page click Content Rules to display the Manage Content Rules page.
     2. Click New.
     3. Select Detect Lexical Expression from the list of content rule templates.
     4. Change the Overview details (the Name of the content rule and any relevant Notes) by clicking Click here to change these settings.
     5. Click Save.
  3. Configure the What To Look For? conditions to detect matching expressions. Show me

     1. In the Lexical Expression section, click Click here to change these settings.

     2. Select which parts of the conversation you want to scan.

        Do not select The message body or The subject line if you are using this content rule in conjunction with a Redact Text content rule.

     3. Select the Expression list you want the content rule to use as a reference.

        This is the Lexical Expression List you created or edited in step 1.

     4. Select a Trigger value for your expression list. This determines how the content rule measures the weight of detected expressions.

        Always select Greater than or equal. This ensures that the rule will trigger if the threshold is matched or exceeded.

     5. Select Document options to indicate which parts of documents you want to scan. Click Save.

        Scan embedded script can have a significant impact if applied to an outbound social media policy route. For example, users of Facebook or Google Mail might find their access irreversibly disrupted if a lexical expression is detected within an instant message.

  4. Configure the remaining What To Look For? conditions. Show me

     1. Select Which Media Types you want the ARgon Server to look for. Click Click here to change these settings.

        You can select individual document types using the Detectable Types window to select which file types you want to detect.

        You must exclude any document types which have been selected for the Redact Text content rule in the policy route.

     2. Click Save.
     3. Add a Size Restriction. Click Click here to change these settings.
     4. Select Enable the Size Restriction if required. You can enter a maximum or minimum size restriction. Enter a value in KB and select or more or or less. Click Save.

     5. Select the Direction To Apply the content rule by clicking Click here to change these settings. You can specify whether the detected items are entering the company, leaving the company, or either entering or leaving the company. Click Save.

  5. Configure the What To Do? actions. Show me

     1. Change the What to Do? actions of the content rule to determine what happens when the content rule is triggered. Click Click here to change these settings. Select a Disposal Action (email) or a Primary Action (web).

     2. Click Save.

  6. Apply Configuration.

     The content rule can now be applied to a policy route.

Show me...

• Example 1. Hide confidential information

  I want to prevent specific terms and phrases leaving my organization, unless they have been appropriately redacted.

  1. Create an expression list to detect classified terms. In this scenario, the threshold is set to 10.

     See Create a Lexical Expression List to find out how to do this.

     

  2. Configure a Redact Text content rule which scans content for matching expressions using this expression list. Set the What To Do? actions as follows:

     • On successful redaction .... Deliver the message

     • On unsuccessful redaction ... Hold the message

  3. Apply the content rule to a policy route.

     See About Policy Routes for more information.

  What happens when a message is detected?

  • The ARgon Server detects the text:

    Dear M,
    
    The information you provided for Codename: SecretStop appears to be encrypted. Is this still classified as confidential? Please advise,
    
    James
    

  • The combined weight of the detected expressions is greater than the threshold and redaction will be attempted:

    Dear M,
    
    The information you provided for ********: ********** appears to be encrypted. Is this still classified as confidential? Please advise,
    
    James
    

  • The remaining matching expressions are counted = +5 +4 = 9.

    Redaction is successful as the remaining content is not sufficient to outweigh the threshold.

    The redacted message text is delivered.

    If the modified message contained terms which still exceeded the threshold, the redaction would be considered unsuccessful and the corresponding action (Hold the message) would be performed.

• Example 2. Redaction attempted with weighted expressions

  I want to apply redaction to weighted lexical expressions.

  1. Create an expression list to detect classified terms. The threshold is set to 10.

     See Create a Lexical Expression List to find out more.

     

  2. Build a Redact Text content rule which scans content for matching expressions.

  3. Apply the content rule to a policy route.

     See About Policy Routes for more information.

  What happens when the ARgon Server detects a message?

  • The ARgon Server detects the text:

    Dear Mr Bond,
    
    Thank you for the top secret information you sent us in confidence. Your help will be invaluable to the success of our operation.
    
    Agent X. ,

  • The expressions in red are detected and counted = +6 +2 = 8. This is not sufficient to trigger the content rule.

    • Redaction is not attempted
    • The original message is delivered

    When creating or editing lexical expressions, give them high or Instant weightings if you also want them to be redactable.

• Example 3. Redaction of a Managed List

  I want to apply redaction to any outward communication containing English or Japanese swear words.

  Profanities are stored in Managed Lists. Managed Lists must be copied before they can be configured as redactable.

  1. Copy the required Managed Lists. In this case, Swear Words: English and Swear Words: Japanese. Show me

     1. Click Policy > Lexical Expressions and select the Managed Lists tab.
     2. Select the lists you want to copy.

     3. Click Copy.

        The lists are copied to the Lexical Expressions tab and are indicated as new expression lists:

        Swear Words: English Copy

        Swear Words: Japanese Copy

     See About Lexical Expressions to find out more about managed lists and lexical expression lists.

  2. Set the expressions in each of your lists to Redact all. Show me

     1. Select the expression list and click Edit.
     2. In the Expressions section click Redact all.

  3. Build a Redact Text content rule which scans content for matching expressions.

  4. Apply the content rule to a policy route, for example from My Company to Everyone.

     See About Policy Routes for more information.

• Example 4. Redact text in email attachments

  I want to prevent my client's name from being distributed accidentally by my sales team in any attached spreadsheets or Word documents. I want the ARgon Server to redact the client name and the company name from these attachments. I also want to be notified when this happens.

  1. Create an expression list called My Client with the appropriate expressions set to Redact.

     See Create a Lexical Expression List to find out more.

     

  2. Create a Redact Text content rule.

     Click Policy > Content Rules > New. Select Redact Text.

  3. In the What To Look For? section, configure the Lexical Expression clause to detect your expression list.

     • Scan: The attachments matching the conditions in the other clauses
     • Expression list: My Client
     • Trigger: Greater than or equal

     • Document options: Scan body, scan header and footer and scan properties

     See About the What To Look For? clauses for more information.

  4. Configure Which Media Types you want to scan:

     • Include selected media types: Microsoft Word Document (DOCX) and Microsoft Excel Spreadsheet (XLSX)

     See About the What To Look For? clauses for more information.

  5. Configure the What To Do? actions to specify what happens if redaction is successful or unsuccessful. In this scenario, you might want the policy to do the following:

     On Successful Redaction	On Unsuccessful Redaction
     Deliver the message as specified on the route	Hold in ... [message area]
     Generate an Inform	Generate an inform

     See What To Do? actions for more information.

  6. When you have configured the content rule, apply the configuration.

  7. Add the content rule to the policy route which connects your Sales Team to Anyone.

     Click Policy > Mail Policy Routes.

     Show me...

     

     See About Policy Routes for more information about how to create web policy routes and add a content rule.

  8. Apply the configuration.
• Example 5. Redact a message and return a copy to the sender

  I want to redact certain words and phrases from messages sent from my organization. I also want to send a copy of the redacted message to the sender to indicate that the original message has been redacted and delivered.

  1. Create an expression list to detect classified terms. The threshold is set to 10.

     See Create a Lexical Expression List to find out more.

     

  2. Create a Redact Text content rule which scans content for matching expressions.

  3. Configure the What To Do? actions to deliver the message if redaction is successful.

     In this scenario, you might want to use the following configuration:

     On Successful Redaction	On Unsuccessful Redaction
     Deliver the message (as specified on the route)	Hold in ...
     Generate an inform (to message originator)	Generate an inform (to administrator)

  4. Apply the content rule to a policy route from My Company to Anyone.

     See About Policy Routes for more information.

  What happens when the ARgon Server detects a message?

  • The ARgon Server detects the following text:

    007,
    The items you requested are now available as M has reclassified them from TOP SECRET to Confidential under regulation M3712.
    Yours, in confidence,
    Q.

  • The matching expressions are detected and counted = +6 +4 +2 =12.

    Redaction is applied to the redactable terms:

    007,
    The items you requested are now available as M has reclassified them from *** ****** to Confidential under regulation M3712.
    Yours, in confidence,
    Q.

  • The remaining matching expressions are counted = +4 +2 =6.

    Redaction is successful as the remaining content is not sufficient to outweigh the threshold.

    The redacted message is delivered.

    An inform message is sent to the message originator.

  • Another transmission is detected by the ARgon Server, this time with a .pdf attachment containing the following text:

    CONFIDENTIAL:
    Requested: Commander Bond, 02:00 hours for top secret involvement in operation SecretStop.
    Status: classified/confidential.

  • The matching expressions trigger the content rule. Redaction is attempted:

    CONFIDENTIAL:
    Requested: Commander Bond, 02:00 hours for *** ****** involvement in operation **********.
    Status: classified/confidential.

  • The remaining terms are counted = +4 +5 +4 =13.

    Redaction is unsuccessful.

    The original unredacted message is not delivered and is sent to a holding area.

    An inform is sent to the Server Administrator.

See also...

• Sanitization
• Working with Lexical Expressions
• More about Content Rules
• What to Look For? Clauses
• What to Do? Actions
• Configuring a Policy Route

© 1995–2018 Clearswift Ltd.