Question

A SaaS company routes production application traffic through a reverse proxy before it reaches a cloud-based customer support screen-sharing tool used by outsourced agents. During screen shares, agents can view live application pages that render customer national ID numbers and full payment card numbers. Legal confirms agents only need the last four digits of each value to verify identity. Which technical control at the reverse proxy layer best enforces the privacy requirement while keeping the support workflow functional?

Accepted Answer

Apply an inline data-transformation policy at the proxy that pattern-matches these identifiers in the response stream and masks all but the last four digits before content reaches the screen-sharing session

Answer

Encrypt the entire response payload with TLS between the proxy and the agent workstation so the identifiers cannot be intercepted in transit

Answer

Require agents to sign a confidentiality agreement and complete privacy awareness training before granting screen-sharing access

Answer

Log every screen-sharing session and retain recordings so any misuse of the exposed identifiers can be investigated after the fact