Publicly Shared HR Files and a Noisy DLP Rule
Litware has 1,200 users on Microsoft 365 and Google Workspace. A CASB API scan finds 3,400 files with public links; 200 contain national ID numbers. The DLP team created a Gateway HTTP DLP profile with a regex for nine consecutive digits. It blocks uploads to any SaaS app, but generates about 60 false positives per day because ticket numbers such as INC123456789 match. Finance has threatened to bypass WARP to close month-end. The CISO wants to stop public exposure within 30 days, reduce false positives, and keep an audit trail. The company has no TLS inspection on finance sites and uses a single IdP. CASB remediation is partly manual. They ask whether to rely on API CASB, inline DLP, or both, and how to sequence the work.
1. Recommend whether to use API CASB, inline DLP, or both. Explain what each can and cannot see.
Read the worked answer
Use both, with different roles. API CASB connects to Microsoft 365 and Google Workspace and discovers data at rest, including public links, without TLS inspection. It is the right tool to enumerate the 3,400 public files and the 200 with ID numbers. Inline Gateway DLP inspects uploads from WARP clients and can prevent egress, but it needs TLS inspection for content inspection and only sees traffic that traverses WARP. Start with API CASB to quantify and remediate exposure, and run inline DLP in log-only mode to learn traffic patterns. Do not let finance bypass WARP; create a logged break-glass exception if month-end requires it. Sequence: discovery, targeted remediation, DLP tuning, then enforcement.
2. The nine-digit regex matches ticket numbers. How would you reduce false positives without missing real national IDs?
Read the worked answer
The regex matches ticket numbers because nine digits appear inside alphanumeric strings. Add boundaries so the match is not adjacent to letters, validate the national ID format or checksum if one exists, and require nearby context such as national ID, ID number, or employee identifier. Exclude known ticket prefixes such as INC and REQ with a pre-filter, and separate HR files from general SaaS uploads. Run the revised profile in log-only mode for two weeks, sample false positives with file owners, and test against a corpus of tickets and real IDs. Use confidence thresholds and a narrow block rule for high-confidence matches, with a lower-confidence rule that alerts. Review the rule after each tuning cycle and record why exceptions exist.
3. Design a 30-day remediation plan for the 200 publicly shared files containing ID numbers.
Read the worked answer
Prioritize by exposure and sensitivity: public link plus national ID plus external share first. Use CASB findings to identify owners and file locations, then notify owners with a deadline and a specific action such as removing the public link, restricting to the organization, or deleting the file. Where CASB remediation is manual, create tickets and verify with a re-scan. Apply sensitivity labels and default sharing policies in Microsoft 365 and Google Workspace so new files do not repeat the pattern. For files that must be shared externally, require expiring links and DLP on download. Track a daily burn-down of the 200 files, report residual risk, and keep an audit trail of owner actions and approved exceptions. Do not bulk-delete without owner review.