Agentless Sensitive Data Detection for Managed Cloud Databases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for detecting sensitive data in cloud computing environments are cumbersome and inefficient, leading to frustration for administrators due to overwhelming information and dynamic data storage, making it difficult to monitor and visualize sensitive data exposure.
Innovation Solution
An agentless method for detecting sensitive data involves generating a snapshot from a managed database service, deploying a virtual instance, querying the database management system (DBMS) to classify data, and representing the data and classification in a security graph stored in a graph database, allowing for a reduced and visualized display of sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional network visibility solutions are used to monitor sensitive data, then comprehensive information about network elements is provided, but the information is overwhelming and difficult for human operators to process
Solution Approach 1:
The patent extracts only the critical information about sensitive data from the overwhelming network visibility data. Instead of showing all network elements, it specifically identifies and extracts information about databases containing sensitive data, their locations, and access patterns, presenting only this extracted information to operators.
Solution Approach 2:
The patent segments the overwhelming network visibility information into distinct, manageable components: sensitive data identification, database location information, access pattern analysis, and risk assessment. This segmentation allows operators to process information in discrete, manageable units rather than facing a monolithic data stream.
2Reliability
If administrators manually monitor sensitive data across multiple cloud environments, then comprehensive monitoring coverage is achieved, but the complexity and time required increases significantly
Solution Approach 1:
The patent creates a universal monitoring system that can operate across multiple cloud environments (AWS, Azure, GCP, on-premises) using a single platform. The system performs multiple functions including data classification, access monitoring, anomaly detection, and alerting within one unified system, eliminating the need for separate monitoring solutions for each cloud environment.
Solution Approach 2:
The patent introduces an intermediary classification system that sits between the diverse cloud database environments and the monitoring interface. This intermediary layer standardizes data from different cloud providers into a common format, enabling unified monitoring without requiring complex environment-specific configurations.
3Reliability
If detailed classification and visualization of sensitive data is implemented, then exposure risks are reduced, but compute resources are consumed
Solution Approach 1:
The patent applies partial action by focusing classification and monitoring efforts only on data identified as sensitive, rather than analyzing all data uniformly. The system performs detailed classification only where needed based on initial screening, reducing overall compute resource consumption while maintaining security for critical data.
Solution Approach 2:
The patent performs preliminary classification to identify sensitive data before implementing detailed monitoring and visualization. This preliminary action filters the data set, so that resource-intensive detailed analysis and visualization are applied only to identified sensitive data rather than all data, optimizing compute resource usage.
Data Source
AI summary
A system and method for agentless detection of sensitive data in a cloud computing environment includes generating a snapshot from a managed database service, the snapshot including a plurality of data files stored in a bucket on a cloud computing environment; deploying a virtual instance based on the snapshot to generate a database, the database including a database management system (DBMS); querying the DBMS to fetch data from the database; classifying the fetched data, wherein the fetched data is classified as sensitive data or non-sensitive data; and generating a node on a security graph stored in a graph database to represent the fetched data and the classification thereof, wherein the security graph includes a representation of the cloud computing environment.