How to Configure DLP Rules in Proofpoint

Data Loss Prevention (DLP) in Proofpoint helps organizations prevent sensitive information from leaving via email. DLP rules scan outbound (and optionally inbound) messages for patterns matching credit cards, social security numbers, protected health information, and custom data patterns.

Prerequisites

Before configuring DLP rules, ensure you have:

• Administrator access to Proofpoint with DLP permissions
• DLP feature enabled in your subscription
• Clear data classification policy defining what data to protect
• Compliance requirements documented (PCI-DSS, HIPAA, GDPR, etc.)
• Stakeholder approval for DLP enforcement actions

Understanding Proofpoint DLP Architecture

Proofpoint DLP uses multiple detection methods:

Step 1: Access DLP Configuration

1. Log in to the Proofpoint Admin Console
2. Navigate to Security Settings or Data Loss Prevention
3. Click on DLP Policies or Content Filtering
4. You'll see existing policies and options to create new ones

Step 2: Create a DLP Policy

Basic Policy Setup

1. Click New Policy or Create DLP Rule
2. Enter a descriptive Policy Name (e.g., "PCI-DSS Credit Card Protection")
3. Add a Description explaining the policy purpose
4. Select Direction: Outbound (most common for DLP)
5. Set Scope: Company, Group, or specific users
6. Click Continue

Configure Detection Criteria

Define what sensitive data to detect:

Using Smart Identifiers (Pre-built Patterns)

1. In the detection section, click Add Smart Identifier
2. Select from available identifiers:

3. Set the Minimum Match Count (e.g., trigger if 3+ credit cards found)
4. Click Add to include in the policy

Using Custom Dictionaries

Create keyword lists for industry-specific detection:

1. Navigate to DLP > Dictionaries
2. Click Create Dictionary
3. Enter a Name (e.g., "Confidential Project Keywords")
4. Add keywords, one per line:

Project Apollo
Classified
Internal Use Only
Do Not Distribute
Patent Pending

5. Click Save
6. Return to your DLP policy and add the dictionary as a detection criterion

Using Regular Expressions

For custom patterns like internal account numbers:

1. Click Add Custom Pattern or Regular Expression
2. Enter your regex pattern:

# Example: Internal Account Number (ACT-XXXXXX)
ACT-[0-9]{6}

# Example: Employee ID (EMP followed by 5 digits)
EMP[0-9]{5}

3. Test the pattern with sample data
4. Add to your policy

Combine Detection Criteria

Use AND/OR logic to reduce false positives:

Example: Credit Card Policy with Reduced False Positives

Trigger when:
  Credit Card Number detected
  AND
  (Dictionary match: "payment", "invoice", "charge", "billing")
  AND
  Attachment present

This prevents triggering on random number strings that happen to match credit card patterns.

Step 3: Configure DLP Actions

Define what happens when sensitive data is detected:

Primary Actions

Secondary Actions

Recommended Action Combinations

High Risk (Block + Notify):

Primary: Block
Secondary: Notify Sender, Notify Compliance Officer
Use for: SSN, large credit card batches, HIPAA data

Medium Risk (Encrypt + Log):

Primary: Encrypt automatically
Secondary: Log event, Notify Sender
Use for: Financial data to authorized external parties

Low Risk (Allow + Monitor):

Primary: Allow
Secondary: Log event only
Use for: Initial monitoring phase, false positive analysis

Step 4: Configure Policy Exceptions

Not all sensitive data transfers are violations:

Recipient Exceptions

Whitelist trusted recipients:

1. In the policy, find Exceptions section
2. Add trusted domains or addresses:

@trustedbank.com
[email protected]
[email protected]

Sender Exceptions

Exempt specific users or groups:

# Users authorized to send sensitive data
[email protected]
[email protected]

Content Exceptions

Exclude specific document types or patterns:

# Exclude redacted documents
Attachment name contains: "_REDACTED"
Subject contains: "[APPROVED]"

Step 5: Enable Encryption for DLP

Automatic encryption for sensitive outbound emails:

1. Navigate to Security Settings > Email Encryption
2. Enable Policy-Based Encryption
3. Link encryption to your DLP policy:

When DLP Policy "PCI-DSS Protection" triggers:
  Action: Encrypt with Proofpoint Encryption
  Encryption type: Portal pickup
  Notification: Send secure message notification to recipient

Encryption Options

Step 6: Test DLP Policies

Before enforcing, test thoroughly:

Monitor-Only Mode

1. Create your DLP policy
2. Set primary action to Allow or Monitor Only
3. Enable all logging and notifications
4. Run for 1-2 weeks
5. Review logs for:
   • False positives (legitimate emails flagged)
   • False negatives (sensitive data not caught)
   • Volume of detections

Test with Sample Data

1. Create test emails containing:

   • Test credit card numbers (use standard test numbers: 4111111111111111)
   • Sample SSN patterns
   • Dictionary keywords

2. Send to test accounts

3. Verify detection and action

4. Adjust thresholds and patterns

Review and Refine

Based on testing:

• Add exceptions for false positives
• Strengthen patterns for missed detections
• Adjust minimum match counts
• Fine-tune notification recipients

Step 7: Deploy DLP Policies

Phased Rollout

1. Pilot Group (Week 1-2)

   • IT department only
   • Monitor mode with notifications
   • Gather feedback

2. Extended Pilot (Week 3-4)

   • Add Finance, HR, Legal
   • Enable soft enforcement (warn but allow)
   • Continue monitoring

3. Full Deployment (Week 5+)

   • Company-wide rollout
   • Full enforcement
   • Ongoing monitoring and refinement

User Communication

Notify users before enforcement:

Subject: New Email Security Policy - Sensitive Data Protection

Starting [date], our email system will automatically detect and protect sensitive data including credit card numbers, social security numbers, and confidential business information.

What this means for you:

• Emails containing sensitive data may be automatically encrypted
• You'll receive notifications if an email is blocked for review
• Legitimate business needs are supported with approved processes

To send sensitive data securely:

• Use the [SECURE] tag in your subject line for automatic encryption
• Contact [[email protected]] for bulk data transfer requests

Step 8: Monitor DLP Effectiveness

Key Metrics to Track

Regular Review Schedule

Troubleshooting DLP Issues

High False Positive Rate

Symptoms: Legitimate emails consistently flagged.

Solutions:

1. Review detection patterns for over-matching
2. Increase minimum match thresholds
3. Add recipient/sender exceptions
4. Combine detectors (require multiple matches)
5. Use more specific dictionaries

Sensitive Data Not Detected

Symptoms: Known sensitive content passes through.

Solutions:

1. Verify policy is enabled and active
2. Check policy scope includes affected users
3. Test Smart Identifiers with sample data
4. Add custom patterns for edge cases
5. Review attachment scanning settings

Encryption Failures

Symptoms: Messages flagged but not encrypted.

Solutions:

1. Verify encryption service is properly configured
2. Check encryption policy is linked to DLP rule
3. Test encryption with manual [SECURE] trigger
4. Review encryption logs for errors

Best Practices for DLP

1. Start with monitoring - Never enforce untested policies
2. Layer detection - Combine multiple detectors for accuracy
3. Document exceptions - Record why each exception exists
4. Train users - Explain DLP purpose and secure alternatives
5. Review regularly - Update policies as data types change
6. Integrate with HR - Align with employee data handling policies
7. Test continuously - Regular false positive testing

Compliance Mapping

Next Steps

After configuring DLP:

1. Set up email filtering - Configure filter policies
2. Manage quarantine - Handle DLP-quarantined messages
3. Configure URL Defense - Enable click-time protection
4. Manage sender lists - Safe senders and block lists

Additional Resources

• Proofpoint DLP Overview
• Proofpoint Enterprise DLP Datasheet
• Data Loss Prevention Best Practices

Need help implementing Proofpoint DLP? Inventive HQ provides expert data loss prevention consulting, policy development, and compliance alignment. Contact us for a free DLP assessment.