Content Filter Order Causes Encryption Before DLP Quarantine
Northstar Retail has mail policies for Executives, Finance, and Default. Content filters are evaluated top-down: 1) 'Encrypt-Finance' (applies to Finance) action: encrypt and skip further filters; 2) 'Block-SSN' (applies to Default) action: quarantine; 3) 'DLP-PCI' (applies to Finance) action: quarantine and notify. A Finance analyst emails a 2 MB spreadsheet containing 350 customer SSNs and 120 card numbers to an external auditor. The message is encrypted, delivered, and no DLP incident appears. The compliance team wants SSNs to be quarantined for Finance but card numbers to be encrypted; it also wants the auditor to receive the file only through the encryption portal. The administrator proposes moving 'Block-SSN' above 'Encrypt-Finance'.
1. Why did the message get encrypted and delivered rather than quarantined, and why was no DLP incident recorded?
Read the worked answer
The first matching Finance filter, 'Encrypt-Finance', fired and its action included skipping further filters. That stopped evaluation before 'DLP-PCI' could run. The message was therefore encrypted and delivered. 'Block-SSN' did not apply because it is scoped to the Default policy, not Finance.
This is a policy-design problem, not an encryption failure. The filter order and the skip action combined to bypass the DLP control. The fact that the message contained both SSNs and card numbers is irrelevant once the first filter terminates processing.
To confirm, use message tracking and the content-filter match details for the message. Check which filter matched, which policy applied, and whether 'skip further filters' was set. Also verify that 'DLP-PCI' is assigned to the Finance policy and that its action is actually quarantine/notify, not monitor.
2. Redesign the filter order and actions so SSNs are quarantined for Finance, card numbers are encrypted, and the auditor receives files through the encryption portal.
Read the worked answer
Requirements conflict if one filter terminates processing before the other can inspect content. Separate the conditions and make precedence explicit:
- Create a Finance-scoped SSN quarantine filter above the encryption filter. Match the SSN pattern, action quarantine, and notify compliance. Do not let it skip to delivery.
- Create a card-number filter for Finance that applies encryption. It should match only when the SSN condition has not already quarantined the message. If the ESA supports combined conditions, require 'contains card number AND NOT contains SSN'.
- Keep 'Encrypt-Finance' as the action for approved external finance mail, but remove 'skip further filters' unless the business explicitly wants encryption to override DLP.
- Assign DLP-PCI to the Finance policy and verify its action and notification settings.
- Ensure the auditor path uses the encryption portal profile, not plain TLS encryption, if portal delivery is the requirement.
Test with four messages: SSN only, card only, both, and neither. Check message tracking, DLP incidents, and encryption portal delivery for each.