Module 6 — DLP (Data Loss Prevention)

Goal: Detect sensitive data (credit-card numbers, SSNs, API keys, source code, custom patterns) in web traffic and stop it from leaving to the wrong places.

⚠️ Plan check: If you don't have Enterprise, the DLP Profile option won't appear in your policies. Confirm your plan before starting.

🧭 The golden rule for DLP: monitor first, block second. You'll run in "log only" mode for a week or two to see what's really flowing, tune out false alarms, then turn on blocking. Rushing straight to Block causes a flood of false positives and angry users.

Part A — Choose what to detect (a profile)

A profile is a bundle of things to look for. Cloudflare ships ready-made ones.

1. 👉 Zero Trust → DLP → DLP Profiles.
2. 📺 What you'll see: A list of predefined profiles like Credentials and Secrets, Financial Information, Personal Identifiable Information (PII), Source Code.
3. 👉 Click a predefined profile to inspect it — e.g. Financial Information.
4. 📺 Inside, you'll see individual detection entries (Credit Card Number, IBAN, etc.), each toggleable.
5. 👉 For now, leave a predefined profile as-is — you'll reference it shortly.

(Optional) Build a custom profile

1. 👉 On the DLP Profiles page, click Create profile.
2. ⌨️ Name it (e.g. Acme Project Codenames).
3. 👉 Add entries — choose from:
   • Predefined detectors (reuse Cloudflare's patterns)
   • Custom regex (your own pattern, e.g. an employee-ID format EMP-\d{6})
   • Dictionaries / Exact Data Match (upload exact values to watch for)
4. 👉 Click Save.

Part B — Tune sensitivity (reduce false alarms)

Two dials control how trigger-happy DLP is. Set these on the profile/entry:

Also available under DLP → Settings:

• 👉 AI context analysis — turn On; a model judges surrounding context to improve accuracy.
• 👉 Optical Character Recognition (OCR) — turn On to detect sensitive text inside images (.jpg/.png, 4 KB–1 MB).

💡 Note: The PII Record profile is special — it only fires when 3 or more different PII types appear close together, which keeps it from flagging a single phone number.

Part C — Monitor first (log-only)

Create a policy that detects but allows, so you can see what's flowing without disrupting anyone.

1. 👉 Zero Trust → Gateway → Firewall Policies → HTTP → Add a policy.
2. ⌨️ Name: DLP MONITOR - financial data.
3. 👉 Rule: Selector DLP Profile → in → choose Financial Information.
4. 👉 Action: Allow (this still logs the detection).
5. 👉 Click Create policy.

Watch the results

1. 👉 After a day or two, go to Gateway → Logs → HTTP (filter by your DLP profile) — or DLP → Logs.
2. 📺 You'll see where sensitive data is being sent: which users, which destinations.
3. 👉 Tune: if a trusted internal app is constantly flagged, add a Do Not Scan policy for it, or raise the confidence to High.

✅ Checkpoint: You can see real detections, and you've tuned out the obvious false positives.

Part D — Enforce (the recommended two-policy pattern)

Now block the genuinely risky flows while keeping visibility on the rest. Cloudflare's recommended pattern is two policies:

Policy 1 — keep logging everything (low confidence, allow)

(This is your monitor policy from Part C — leave it running for ongoing visibility.)

Policy 2 — block the high-confidence, high-risk cases

1. 👉 Add a policy named DLP BLOCK - financial to personal storage.
2. 👉 Rules (combine with And):

   Selector	Operator	Value
   DLP Profile	in	Financial Information (set to High confidence)
   Destination Domain	in	dropbox.com, wetransfer.com, drive.google.com (personal storage)
   User Group	in	Finance (optional — scope to a team)

3. 👉 Action: Block.
4. 👉 Order it ABOVE the monitor policy (policies are top-down).
5. 👉 Click Create policy.

⚠️ Watch out: Always scope the block (by destination, app, or group). A broad "block all financial data everywhere" will flag legitimate internal tools and frustrate users.

Part E — Test it safely

1. 👉 On a pilot device, create a harmless test file containing a fake credit-card test number (e.g. the standard test number 4111 1111 1111 1111) — never use real data.
2. 👉 Try to upload it to one of the blocked destinations (e.g. a personal Dropbox).
3. 📺 What you'll see: The upload is blocked and a block page/notice appears.
4. 👉 Check Gateway → Logs: the event shows the matched DLP profile and confidence.

✅ Checkpoint: Sensitive test data is blocked to risky destinations, allowed (but logged) elsewhere, and visible in logs. 🎉

✅ Module 6 complete!

You now have:

• ✅ A DLP profile (predefined and/or custom) detecting sensitive data
• ✅ Sensitivity tuned (confidence, match count, AI context, OCR)
• ✅ A monitor policy for ongoing visibility
• ✅ A scoped block policy on high-risk destinations
• ✅ A verified safe test

Quick troubleshooting

👉 Next: Module 7 — AI Controls

You'll discover and govern AI tool usage like ChatGPT, Gemini, and Claude.