Enterprise DLP
Create a Security Policy Rule for ChatGPT
Table of Contents
Create a Security Policy Rule for ChatGPT
Use
Enterprise Data Loss Prevention (E-DLP)
in a Security policy rule to prevent exfiltration of
sensitive data to ChatGPT.Where Can I Use This? | What Do I Need? |
---|---|
|
Or any of the following licenses that include the Enterprise DLP
license
|
Use
Enterprise Data Loss Prevention (E-DLP)
to prevent exfiltration of sensitive data to ChatGPT. in a
new or existing Security policy rule.() If you would rather block access to ChatGPT on your network, you
can do so from the ). Using the
SaaS Security
onlySaaS Security
Applications dashboard (Manage
Configuration
Security Services
SaaS Application Management
Discovered Apps
Applications
SaaS Security
Application dashboard to
Block Access
allows you to quickly generate a policy rule
recommendation, rather than manually creating one on your own. () Support for non-file based HTTP/2 traffic
inspection is required to successfully prevent exfiltration to ChatGPT. Your
Strata Cloud Manager
and SaaS Security
Strata Cloud Manager
tenant must be running Software Version 10.2.3 or later
release.() Support for non-file based HTTP/2 traffic
inspection is required to successfully prevent exfiltration to ChatGPT. You must
upgrade
Panorama
Panorama
and all managed firewalls to PAN-OS 10.2.3 or later
release. Additionally, you must upgrade the Panorama
plugin for Enterprise DLP
to 3.0.2 or later release.Strata Cloud Manager
Strata Cloud Manager
Create a security policy rule to prevent exfiltration of sensitive data to ChatGPT
for
Prisma Access (Managed by Strata Cloud Manager)
on Strata Cloud Manager
.- Log intoStrata Cloud Manager.
- Selectand create the decryption profile and policy rule required to enableManageConfigurationNGFW and Prisma AccessSecurity ServicesDecryptionEnterprise DLPonStrata Cloud Manager.Do not enableStrip ALPNin the decryption profile.Enterprise DLPcannot inspect egress traffic to ChatGPT if you remove application-layer protocol negotiation (ALPN) headers from decrypted traffic.
- (Optional) Create a data pattern.Create a custom regex data pattern to define your own match criteria. You can skip this step if you plan to use predefined or existing data patterns to define match criteria in your data filtering profile.
- Create a data profile or use an existing data profile.
- Selectand in the Actions column,ManageConfigurationData Loss PreventionDLP RulesEditthe DLP rule.
- EnableNon-File Based Match Criteria.DLP rules configured for non-file detection are required to prevent exfiltration of sensitive data to ChatGPT. You can further modify the DLP rule to enforce your organization’s data security standards. The DLP rule has an identical name as the data profile from which it was automatically created.You can keepFile Based Matched Criteriaenabled or disable as needed. Enabling this setting has no impact on detection of egress traffic to ChatGPT as long asNon-File Based Match Criteriais enabled.
- Modify theActionandLog Severity.
- Modify the rest of the DLP rule as needed.
- Save.
- Create a Shared Profile Group for theEnterprise DLPdata filtering profile.
- SelectandManageConfigurationNGFW and Prisma AccessSecurity ServicesProfile GroupsAdd Profile Group.
- Enter a descriptiveNamefor the Profile Group.
- For the Data Loss Prevention Profile, select theEnterprise DLPdata profile.
- Add any other additional profiles as needed.
- Savethe profile group.
- Create a Security policy and attach the Profile Group.Alternatively, you can selectto create or add ChatGPT to a Web Security Policy. You can skip this step if you create a Web Security Policy for ChatGPT.ManageConfigurationNGFW and Prisma AccessSecurity ServicesWeb Security
- SelectandManageConfigurationSecurity ServicesSecurity PolicyAdd Rule.You can also update an existing Security policy to attach a Profile Group forEnterprise DLPfiltering.
- In the Applications, Services, and URLs section,Add Applicationsto search for and selectopenai-chatgpt.
- Navigate to the Action and Advanced Inspection section, and select theProfile Groupyou created in the previous step.
- Configure the Security policy as needed.TheActionyou specify in the data profile determines whether egress traffic to ChatGPT is blocked. The Security policy ruleActiondoes not impact whether matched traffic is blocked.For example, you configured the data filtering profile toBlockmatching egress traffic but configure the Security policy ruleActiontoAllow. In this scenario, the matching egress traffic to ChatGPT is blocked.
- Savethe Security policy.
- Push your data filtering profile.
- Push ConfigandPush.
- Select (enable)Remote NetworksandMobile Users.
- Push.
SaaS Security
SaaS Security
Create a security policy rule to prevent exfiltration of sensitive data to ChatGPT
for
SaaS Security
on Strata Cloud Manager
.- Log intoStrata Cloud Manager.
- Selectand create the decryption profile and policy rule required to enableManageConfigurationNGFW and Prisma AccessSecurity ServicesDecryptionEnterprise DLPonStrata Cloud Manager.Do not enableStrip ALPNin the decryption profile.Enterprise DLPcannot inspect egress traffic to ChatGPT if you remove application-layer protocol negotiation (ALPN) headers from decrypted traffic.
- (Optional) Create a data pattern.Create a custom regex data pattern to define your own match criteria. You can skip this step if you plan to use predefined or existing data patterns to define match criteria in your data filtering profile.
- Create a data profile or use an existing data profile.
- Selectand in the Actions column,ManageConfigurationData Loss PreventionDLP RulesEditthe DLP rule.
- EnableNon-File Based Match Criteria.DLP rules configured for non-file detection are required to prevent exfiltration of sensitive data to ChatGPT. You can further modify the DLP rule to enforce your organization’s data security standards. The DLP rule has an identical name as the data profile from which it was automatically created.You can keepFile Based Matched Criteriaenabled or disable as needed. Enabling this setting has no impact on detection of egress traffic to ChatGPT as long asNon-File Based Match Criteriais enabled.
- Modify theActionandLog Severity.
- Modify the rest of the DLP rule as needed.
- Save.
- Selectto create a Security policy rule recommendation.ManageConfigurationSaaS SecurityDiscovered AppsPolicy RecommendationsA SaaS policy rule recommendation is required to leverage theEnterprise Data Loss Prevention (E-DLP)data profile inSaaS Security.
- In the Select Applications section, search for and selectChatGPT.
- In the Data Profile section, search for and select the data profile you enabled in the previous step.
- Configure the policy rule recommendation as needed.
- Save.
Panorama
Panorama
Create a security policy rule to prevent exfiltration of sensitive data to ChatGPT on
the
Panorama™ management server
.- UpgradePanorama, managed firewalls, and theEnterprise DLPplugin to the minimum required versions.
- Upgrade to PAN-OS 10.2.3 or later release.
- Upgrade the plugin to 3.0.2 or later release.
- Upgrade managed firewalls to PAN-OS 10.2.3 or later release.
- Log in to thePanoramaweb interface.
- Create the decryption policy rule required forEnterprise DLP.
- Selectand specify theObjectsDecryptionDecryption ProfileDevice Group.Adda new decryption profile. The default decryption profile configuration is all that is required forEnterprise DLPto inspect traffic.Do not enableStrip ALPNin the decryption profile.Enterprise DLPcannot inspect egress traffic to ChatGPT if you remove application-layer protocol negotiation (ALPN) headers from decrypted traffic.
- Selectand specify thePoliciesDecryptionDevice Group.Adda new decryption policy rule. SelectOptionsand assign the decryption profile.
- For theAction, selectDecrypt.
- Select theDecryption Profileyou created.
- ClickOK.
- Data filtering profiles configured for non-file detection are required to prevent exfiltration of sensitive data to ChatGPT. You can create a new data filtering profile or use existing data filtering profiles as needed. You can add any combination of custom or predefined data patterns to define the match criteria.
- Create a data profile onPanoramaor the DLP app on the Hub, or use an existing data profile.
- Attach the data filtering profile to a Security policy rule.
- Select.PoliciesSecurityYou can select an existing Security policy rule orAdda new Security policy rule.
- Configure theGeneralandSourceas needed.
- Configure theDestinationas needed.
- For theApplication,Addand search foropenai-chatgpt.Skip this step if your Security policy rule applies toAnyapplication. ChatGPT is automatically included for a Security policy rule that applies toAnyapplication.
- SelectActionsand configure the Profile Settings.SelectProfilesand select theData Filteringprofile you created in the previous step.If the data filtering profile is part of a Security Profile Group (), selectObjectsSecurity Profile GroupsGroupand select the Security Profile Group the data filtering profile is associated with.
- Configure the rest of the Security policy rule as needed.TheActionyou specify in the data filtering profile determines whether egress traffic to ChatGPT is blocked. The Security policy ruleActiondoes not impact whether matched traffic is blocked.For example, if you configured the data filtering profile toBlockmatching egress traffic but configure the Security policy ruleActiontoAllow, the matching egress traffic to ChatGPT will be blocked.
- ClickOK.
- Commit and push the new configuration to your managed firewalls to complete theEnterprise DLPplugin installation.This step is required forEnterprise DLPdata filtering profile names to appear in Data Filtering logs.TheCommit and Pushcommand isn’t recommended forEnterprise DLPconfiguration changes. Using theCommit and Pushcommand requires the additional and unnecessary overheard of manually selecting the impacted templates and managed firewalls in the Push Scope Selection.
- Full configuration push from Panorama
- SelectandCommitCommit toPanoramaCommit.
- SelectandCommitPush to DevicesEdit Selections.
- SelectDevice GroupsandInclude Device and Network Templates.
- ClickOK.
- Pushyour configuration changes to your managed firewalls that are usingEnterprise DLP.
- Partial configuration push from PanoramaYou must always include the temporary__dlpadministrator when performing a partial configuration push. This is required to keepPanoramaand the DLP cloud service in sync.For example, you have anadminPanoramaadmin user who is allowed to commit and push configuration changes. Theadminuser made changes to theEnterprise DLPconfiguration and only wants to commit and push these changes to managed firewalls. In this case, theadminuser is required to also select the__dlpuser in the partial commit and push operations.
- Select.CommitCommit toPanorama
- SelectCommit Changes Made Byand then click the current Panorama admin user to select additional admins to include in the partial commit.In this example, theadminuser is currently logged in and performing the commit operation. Theadminuser must clickadminand then select the__dlpuser. If there are additional configuration changes made by other Panorama admins they can be selected here as well.ClickOKto continue.
- Commit.
- Select.CommitPush to Devices
- SelectPush Changes Made Byand then click the current Panorama admin user to select additional admins to include in the partial push.In this example, theadminuser is currently logged in and performing the push operation. Theadminuser must clickadminand then select the__dlpuser. If there are additional configuration changes made by other Panorama admins they can be selected here as well.ClickOKto continue.
- SelectDevice GroupsandInclude Device and Network Templates.
- ClickOK.
- Pushyour configuration changes to your managed firewalls that are usingEnterprise DLP.