Sensitive data proxy

1 . A method comprising:

implementing a sensitive data proxy configured to prevent unintended traffic from a client system to a target domain, including:

receiving a request from the client system to establish the sensitive data proxy;

receiving a message from the client system intended for the target domain;

determining a security rule to apply to the message;

evaluating the message for compliance with the security rule;

applying a corrective action to the message to bring the message into compliance with the security rule; and

forwarding the message to the target domain based on the message being in compliance with the security rule.

2 . The method of claim 1 further comprising:

evaluating the message for compliance with the security rule includes determining whether the message includes sensitive data; and

applying the corrective action includes not forwarding the message with sensitive data to the target domain.

3 . The method of claim 2 further comprising:

applying the corrective action further includes redacting the sensitive data from the message; and

forwarding the message to the target domain after redacting the sensitive data.

4 . The method of claim 2 further comprising:

applying the corrective action further includes:

sending a notification to the client system regarding the sensitive data in the message;

receiving a response from the client system to authorize or reject the message;

forwarding the message to the target domain based on the response authorizing the message; and

not forwarding the message to the target domain based on the response rejecting the message.

5 . The method of claim 2 further comprising:

generating a certificate authority (CA) certificate for a private CA; and

providing the CA certificate to the client system.

6 . The method of claim 5 further comprising:

receiving an indication of the target domain from the client system; and

providing the client system with routing data directing the client system to route traffic intended for the target domain to the sensitive data proxy.

7 . The method of claim 6 further comprising:

generating an SSL (secure socket layer) certificate, corresponding to the target domain, signed by the private CA;

providing the SSL certificate to the client system to be verified via the CA certificate; and

decrypting the message based on the SSL certificate to evaluate the message.

8 . The method of claim 7 further comprising:

deploying the sensitive data proxy in a cloud environment.

9 . The method of claim 7 further comprising:

deploying the sensitive data proxy on premises at the client system.

10 . A system comprising:

a sensitive data proxy computing environment configured to prevent unintended traffic from a client system to a target domain, including:

generate a certificate authority (CA) certificate for a private CA;

provide the CA certificate to the client system;

receive a message from the client system intended for the target domain;

determine a security rule to apply to the message;

evaluate the message for compliance with the security rule;

apply a corrective action to the message to bring the message into compliance with the security rule; and

forward the message to the target domain based on the message being in compliance with the security rule.

11 . The system of claim 10 comprising the sensitive data proxy computing environment further configured to:

evaluate the message for compliance with the security rule, including determining whether the message includes sensitive data; and

apply the corrective action, including not forwarding the message with sensitive data to the target domain.

12 . The system of claim 11 comprising the sensitive data proxy computing environment further configured to:

apply the corrective action, further including redacting the sensitive data from the message; and

forward the message to the target domain after redacting the sensitive data.

13 . The system of claim 11 comprising the sensitive data proxy computing environment further configured to:

apply the corrective action, further including:

send a notification to the client system regarding the sensitive data in the message;

receive a response from the client system to authorize or reject the message;

forward the message to the target domain based on the response authorizing the message; and

not forward the message to the target domain based on the response rejecting the message.

14 . The system of claim 11 comprising the sensitive data proxy computing environment further configured to:

receive a request from the client system to establish the sensitive data proxy;

receive an indication of the target domain from the client system; and

provide the client system with routing data directing the client system to route traffic intended for the target domain to the sensitive data proxy.

15 . The system of claim 14 comprising the sensitive data proxy computing environment further configured to:

generate an SSL (secure socket layer) certificate, corresponding to the target domain, signed by the private CA;

provide the SSL certificate to the client system to be verified via the CA certificate; and

decrypt the message based on the SSL certificate to evaluate the message.

16 . The system of claim 10 comprising the sensitive data proxy computing environment further configured to:

deploy the sensitive data proxy computing environment in a cloud environment.

17 . A computer-readable storage medium storing instructions that, when executed, cause a processor to perform a method comprising:

implementing a sensitive data proxy configured to prevent unintended traffic from a client system to a target domain, including:

receiving a request from the client system to establish the sensitive data proxy;

generating a certificate authority (CA) certificate for a private CA;

providing the CA certificate to the client system;

receiving a message from the client system intended for the target domain;

determining a security rule to apply to the message;

evaluating the message for compliance with the security rule, including determining whether the message includes sensitive data;

applying a corrective action to the message to bring the message into compliance with the security rule, including not forwarding the message with sensitive data to the target domain; and

forwarding the message to the target domain based on the message being in compliance with the security rule.

18 . The computer-readable storage medium of claim 17 storing instructions that, when executed, cause the processor to perform the method further comprising:

applying the corrective action further includes redacting the sensitive data from the message; and

forwarding the message to the target domain after redacting the sensitive data.

19 . The computer-readable storage medium of claim 17 storing instructions that, when executed, cause the processor to perform the method further comprising:

applying the corrective action further includes:

sending a notification to the client system regarding the sensitive data in the message;

receiving a response from the client system to authorize or reject the message;

forwarding the message to the target domain based on the response authorizing the message; and

not forwarding the message to the target domain based on the response rejecting the message.

20 . The computer-readable storage medium of claim 17 storing instructions that, when executed, cause the processor to perform the method further comprising:

receiving an indication of the target domain from the client system;

providing the client system with routing data directing the client system to route traffic intended for the target domain to the sensitive data proxy;

generating an SSL (secure socket layer) certificate, corresponding to the target domain, signed by the private CA;

providing the SSL certificate to the client system to be verified via the CA certificate; and

decrypting the message based on the SSL certificate to evaluate the message.