Find card numbers on a file share, cut the false positives, and triage the hits

applied · 50 min · Objective 3.4

Task

Build a simple data-at-rest DLP scan for a file share: find candidate payment card numbers by pattern, then remove false positives with the Luhn checksum that every real card number passes. Measure the false-positive rate before and after tuning, and write up the true finding as an incident triage record.

Steps

  1. Create /srv/share with twenty text files. Put three published test card numbers in two of them, and in others put sixteen-digit strings that are not card numbers, such as order references, serial numbers and phone-number-like digit runs. About one random sixteen-digit number in ten happens to pass the Luhn check, so once your v2 scan exists, confirm each lookalike fails it -- and replace any that passes, or the tuned scan will rightly report it too.
  2. Write lab/dlp/scan-v1.sh that reports every file and match of sixteen digits, optionally in groups of four separated by spaces or hyphens. Save its output to lab/dlp/v1.txt.
  3. Write lab/dlp/scan-v2.sh that does the same but keeps only matches passing the Luhn check, implemented in awk. Save its output to lab/dlp/v2.txt.
  4. Record in lab/dlp/tuning.txt the lines v1_hits:, v2_hits: and true_positives:.
  5. Write lab/dlp/triage.txt for the file containing test card numbers: what was found, where, its classification, who can read the share, and the action you would take.

Verify

These checks run in a POSIX shell: Terminal on macOS or Linux, and on Windows Git Bash (it comes with Git for Windows) or WSL. A stock Windows PowerShell or Command Prompt has no awk or grep, so there the first line fails.

wc -l < lab/dlp/v1.txt
wc -l < lab/dlp/v2.txt
grep -c '4111' lab/dlp/v2.txt
awk -F': ' '/^v1_hits/ {a=$2} /^v2_hits/ {b=$2} END {print "false positives removed: "a-b; exit !(b<a)}' lab/dlp/tuning.txt
grep -Eic 'restricted|confidential|move|remove|access' lab/dlp/triage.txt

The first scan finds more matches than the second, the tuned scan still finds the test card numbers, and the tuning file shows the false positives removed, so the fourth command exits zero. The second scan should report exactly the three test numbers: tuning that also drops a true positive has traded one failure for a worse one.

Notes

Commercial DLP combines the same ideas -- patterns, checksums, keywords near the match, and document fingerprints -- and applies them in motion and in use as well as at rest.

This is an independent study companion for CompTIA Server+ SK0-005 and is not produced by or endorsed by CompTIA.