Skip to main content

Sensitive data masking

Sensitive data masking limits risk to your organization and helps meet compliance requirements.

Data masking protects sensitive data in your applications by redacting it in vulnerability and attack reports that are sent to Contrast, syslog, or security log.

Contrast offers several categories of sensitive data, or data types, that are comprised of specific keywords that the agent automatically identifies and redacts in reports. A user with at least RulesAdmin permissions can manage sensitive data.

Contrast agents mask sensitive data in query parameters, request headers, cookies and body. Your agent identifies sensitive data by searching for specific keywords used in the input name. If the agent finds a match, it redacts the value for that input, and replaces it with a placeholder with the format contrast-redacted-{datatype}, where datatype is the category of sensitive data to which the keyword belongs.

Contrast agents do not mask individual fields in request bodies with a content type other than application/x-www-form-urlencoded; however, you can configure the agent to mask the entire request body. Contrast agents also do not mask data that appears in the data flow portion of a vulnerability report, if using Assess, or in the vector of an attack event, if using Protect.

Contrast agents also do not mask data that appears in the data flow portion of a vulnerability report, if using Assess. If using Protect, Contrast agents do not mask data that appears in the vector of an attack event by default, but you can enable masking for this data. See the section below for details.

Mask the entire HTTP request body

To mask the entire HTTP request body, enable the following configuration option for your agent by setting it in your agent's YAML configuration file or as an environment variable:

  • .NET Core and .NET Framework: application.sensitive_data_masking_policy.mask_http_body: true. Requires .NET Core agent 5.0.2 or later, or .NET Framework agent 51.5.2 or later.

  • Java: application.sensitive_data_masking_policy.mask_http_body=true. You can continue to use the legacy key agent.java.mask_http_body; however future support is subject to change. Requires Java agent 3.6.8 or later.

  • Node.js: application.sensitive_data_masking_policy.mask_http_body. You can continue to use the legacy key agent.node.mask_http_body; however future support is subject to change. Requires Node.js agent 5.0.0 or later.

  • Python: application.sensitive_data_masking_policy.mask_http_body: true. Requires Python agent 5.16.0 or later.

Whether you need to restart the agent after setting this option depends on how you set it:

  • Using a YAML file: .NET Core and .NET Framework do not require an agent restart to apply the change. Java, Node.js, and Python require an agent restart for settings to take effect.

  • Using an environment variable: all agents require a restart, regardless of language.

Note

Contrast agents make a best effort attempt to avoid printing sensitive data in Contrast log statements; however, it’s possible that sensitive data could appear in the Contrast log, if the log level is set to DEBUG or lower. Whenever possible, you should avoid setting production systems to log at DEBUG or lower. If a system that deals with sensitive data is set to log at DEBUG or lower, you should take steps to ensure that those logs are not being sent to an external system to avoid leaking any sensitive data.

For example, the following HTTP request sent by an agent as part of a vulnerability report shows two inputs that the agent identified as sensitive, as well as the placeholders it used to mask the values of the input before sending the report to Contrast, syslog server or security log.

PUT /employee/5 HTTP/1.1 
Host: yourdomain.com 
Content-Type: application/x-www-form-urlencoded 
Content-Length: 30 
apikey: contrast-redacted-authentication-info 

ssn=contrast-redacted-government-id&department=sales

In this case, the header value is masked because "apikey" matches a keyword in the "Authentication Info" data type, and the form parameter is redacted because "ssn" matches a keyword in the "Government ID" data type for your Contrast organization. (Keyword matches are case insensitive.)

Mask the attack vector

To mask the vector of a Protect attack event, enable the following configuration option for your agent by setting it in your agent's YAML configuration file or as an environment variable:

  • .NET Core and .NET Framework: application.sensitive_data_masking_policy.mask_attack_vector: true. Requires .NET Core agent 5.0.2 or later, or .NET Framework agent 51.5.2 or later.

  • Java: application.sensitive_data_masking_policy.mask_attack_vector=true. Requires Java agent 6.16.0 or later.

  • Python: application.sensitive_data_masking_policy.mask_attack_vector: true. Requires Python agent 10.11.0 or later.

Whether you need to restart the agent after setting this option depends on how you set it:

  • Using a YAML file: .NET Core and .NET Framework do not require an agent restart to apply the change. Java and Python require an agent restart for settings to take effect.

  • Using an environment variable: All agents require a restart, regardless of language.

In this section: