This check is disabled by default. To enable it, run the checks enable command: liquibase checks enable --check-name=SensitiveInfoCheck

• If you don't already have a Checks settings file created, this message will appear:

WARNING: No default checks-settings file detected. Would you like to create and automatically use 'liquibase.checks-settings.conf' ? [1] Yes, create and use default check-settings file in the current working directory [2] Yes, create and use default check-settings file at a path I will specify [3] Just create default check-settings file in the CWD, do not use, and exit command [n] No, do not create default check-settings file, and exit command

Choose option one or two, depending on where you want your Checks settings file to be located.

If you already have an existing Checks settings file, this message will appear:

ALERT: A valid Liquibase Checks Settings file already exists at '[path/to/liquibase.checks-settings.conf]'. Do you want to: [O] Overwrite the existing file [C] Continue using the existing file

Choose either option to add the new check to the Checks settings file you want to use. If you get an error message that states: One or more specified checks not found: 'sensitiveInfoCheck'.

• Update the file to 5.1+ by running the command below to ensure the SensitiveInfoCheck appears on the list of checks. liquibase checks show --auto-update=ON

• Run the command in step 1 again.

In this step, we will choose a Phileas Identifier to flag which personal information the check triggers. We recommend that you name your check based on the type of identifier that you want to flag, so that you know what sensitive information is being committed. If you are flagging multiple identifiers, ensure the title reflects all of them. The table below can help you group your identifiers into bundles to facilitate the search for specific items in your database.

Examples:

• If you only want an individual identifier to trigger, you could name it: SSN_SensitiveInfoCheck to flag that Social Security Numbers exist in your changelog.

• If you want to flag a bundle of identifiers, you could name it: Financial_Info_SensitiveInfoCheck to flag that any financial information such as credit card numbers or routing numbers exist in your changelog.

• If you want to flag all identifiers, you could name it: AllSensitiveInfoCheck to flag that any identifiers exist in your changelog.

The example message appears in the terminal.

Example message

The check 'SensitiveInfoCheck' can not be enabled directly because one or more fields does not have a default value. Create a copy of this check and initiate the customization workflow. Give your check a short name for easier identification (up to 64 alpha-numeric characters only) [SensitiveInfoCheck1]:

Once you add the desired name of the copied check in the CLI, Liquibase will make a copy of the SensitiveInfoCheck, and you will see the example output appear in the terminal.

Example output

New check 'SSNSensitiveInfoCheck' created from 'SensitiveInfoCheck'

Personal Information

Contact Information

Location Data

Financial Information

Government IDs

Medical Information

Network Information

Other Identifiers

This message will appear in the terminal: Set the Severity to return a code of 0-4 when triggered. (options: 'INFO'|0, 'MINOR'|1, 'MAJOR'|2, 'CRITICAL'|3, 'BLOCKER'|4)? [INFO]:

In this example, we will set the severity to 0.

This message will appear in the terminal: Set 'IDENTIFIERS' as a comma-separated list of identifier types (options: SSN, ZIP_CODE, CREDIT_CARD, EMAIL_ADDRESS, PHONE_NUMBER, PHONE_NUMBER_EXTENSION, IP_ADDRESS, MAC_ADDRESS, FIRST_NAME, SURNAME, AGE, DATE, CITY, STATE, STATE_ABBREVIATION, COUNTY, STREET_ADDRESS, BANK_ROUTING_NUMBER, BITCOIN_ADDRESS, CURRENCY, DRIVERS_LICENSE, HOSPITAL, HOSPITAL_ABBREVIATION, IBAN_CODE, PASSPORT_NUMBER, PHYSICIAN_NAME, TRACKING_NUMBER, URL, VIN, IDENTIFIER):

In this example, we will check for SSN in our changelog by typing SSN into the CLI and pressing enter. If you want to set the identifier to any of the checks that are in the Optional additional identifier configurations table below, be aware there are optional configurations you will need to set to use these identifiers successfully. Note: This policy check must include one or multiple identifiers. Use a comma-separated list to specify more than one. If you choose to flag multiple identifiers, we recommend grouping them by category, such as Financial Information or Location Data. It is easier to manage and analyze them this way instead of flagging all of them at once.

Optional additional identifier configurations

If you choose one of the identifiers below, please note that you will have configuration options to select from.

You will see the default message in the terminal. The default message pinpoints the location of the detected SSN, which is usually all you need. You can customize it later to show more or less detail if you prefer.

Set 'MESSAGE' [Policy violation: raw {filter_type} detected in {stmt_type} at statement #{statement_number}, line {line_number}, positions {start}-{end}.{file_line_info}]:

Press Enter to save the message formatting.

Results

The command is enabled successfully. Customization complete. Review the table below to confirm your changes. +-----------------------+-----------+--------+----------+----------+--------------------------------+--------------------------------+ | Short Name | Scope | Type | Status | Severity | Customization | Description | +-----------------------+-----------+--------+----------+----------+--------------------------------+--------------------------------+ | SensitiveInfoCheck | changelog | sql, | disabled | 0 | IDENTIFIERS = null | This check triggers when PII | | | | xml, | | | MESSAGE = Policy violation: | (Personally Identifiable | | | | yaml, | | | raw {filter_type} detected in | Information) or PHI (Protected | | | | json | | | {stmt_type} at statement | Health Information) are | | | | | | | #{statement_number}, line | detected in changelogs or in | | | | | | | {line_number}, positions | your database. Copy this check | | | | | | | {start}-{end}.{file_line_info} | to configure the subset of | | | | | | | | 'identifiers' you wish to | | | | | | | | detect. | +-----------------------+-----------+--------+----------+----------+--------------------------------+--------------------------------+ | SSNSensitiveInfoCheck | changelog | sql, | enabled | 0 | IDENTIFIERS = SSN | This check triggers when PII | | | | xml, | | | MESSAGE = Policy violation: | (Personally Identifiable | | | | yaml, | | | raw {filter_type} detected in | Information) or PHI (Protected | | | | json | | | {stmt_type} at statement | Health Information) are | | | | | | | #{statement_number}, line | detected in changelogs or in | | | | | | | {line_number}, positions | your database. Copy this check | | | | | | | {start}-{end}.{file_line_info} | to configure the subset of | | | | | | | | 'identifiers' you wish to | | | | | | | | detect. | +-----------------------+-----------+--------+----------+----------+--------------------------------+--------------------------------+ Liquibase command 'checks enable' was executed successfully.

After enabling and customizing the SensitiveInfoCheck, run it against your changelog to detect the identifiers you've configured. Your customized check is stored in your checks settings file.

To run checks with a custom settings file, use the --checks-settings-file parameter. If you don't specify this parameter, Liquibase uses the default liquibase.checks-settings.conf file. You can also use the --changelog-file flag to target a specific changelog.

Checks settings file example: liquibase checks run --checks-settings-file=path_to_my_file_name.yaml

Checks settings file and specific changelog file example: liquibase checks run --checks-settings-file=<path_to_my_file_name>.yaml --changelogfile --<your_changelog_here>.sql

Note: Be sure to replace path_to_my_file_name.yaml with the path to the settings file where you included the new policy check. Also be sure to replace your_changelog_here with your real changelog name.

Example output - No violation

Example output - Check violation found Notice that the customized SSNSensitiveInfoCheck flagged two violations, and their messages tell you where the violation occurred.CHANGELOG CHECKS ---------------- Checks completed validation of the changelog and found the following issues:Check Name: Sensitive Info Check| PII and PHI Check (SSNSensitiveInfoCheck) Changeset ID: raw Changeset Filepath: changelogIncludeAllIdentifiers.sql Check Severity: INFO (Return code: 0) Message: Policy violation: raw SSN detected in INSERT at statement #1, line 1, positions 63-74.Check Name: Sensitive Info Check| PII and PHI Check (SSNSensitiveInfoCheck) Changeset ID: raw Changeset Filepath: changelogIncludeAllIdentifiers.sql Check Severity: INFO (Return code: 0) Message: Policy violation: raw SSN detected in INSERT at statement #25, line 2, positions 10-19.Changesets Validated: in changelogIncludeAllIdentifiers.sql ID: raw; Author: includeAllChecks run against each changeset: Sensitive Info Check| PII and PHI Check (Short names: SSNSensitiveInfoCheck)

When the check finds an item flagged by the customized SensitiveInfoCheck in the changelog, you will see an output similar to this from the terminal:

CHANGELOG CHECKS ---------------- Checks completed validation of the changelog and found the following issues: Check Name: Sensitive Info Check| PII and PHI Check (SSNSensitiveInfoCheck) Changeset ID: raw Changeset Filepath: changelogIncludeAllIdentifiers.sql Check Severity: INFO (Return code: 0) Message: Policy violation: raw SSN detected in INSERT at statement #1, line 1, positions 63-74. Check Name: Sensitive Info Check| PII and PHI Check (SSNSensitiveInfoCheck) Changeset ID: raw Changeset Filepath: changelogIncludeAllIdentifiers.sql Check Severity: INFO (Return code: 0) Message: Policy violation: raw SSN detected in INSERT at statement #25, line 2, positions 10-19. Changesets Validated: in changelogIncludeAllIdentifiers.sql ID: raw; Author: includeAll Checks run against each changeset: Sensitive Info Check| PII and PHI Check (Short names: SSNSensitiveInfoCheck)

Notice that the customized SSNSensitiveInfoCheck flagged two violations and their messages tell you where the violation occurred.