Intermediary Component for Sensitive Data Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for discovering sensitive data in complex enterprise applications are inefficient, often requiring tedious human effort and resulting in false positives or false negatives, and are blind to user requests and context, making real-time monitoring and protection challenging.
Innovation Solution
A system that uses a user-driven approach to map sensitive data flows across various data sources by analyzing user requests, data requests, and responses, generating a lineage to identify sensitive data locations and objects, and applying policies for control, with minimal human intervention and no false results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If batch scanning of data sources is performed using regular expression patterns, then sensitive data detection is attempted, but the process takes hours and produces hundreds of false positives requiring tedious manual cleansing
Solution Approach 1:
The patent introduces an intermediary component that acts as a bridge between user applications and data sources. This intermediary intercepts and monitors data flows, enabling real-time sensitive data detection without requiring batch scanning of entire data sources. The intermediary captures data requests and responses, allowing precise identification of sensitive data locations while eliminating the time-consuming manual cleansing process by providing accurate detection from the start.
Solution Approach 2:
The system performs preliminary action by establishing monitoring capabilities before sensitive data exposure incidents occur. The intermediary is deployed in advance to continuously monitor data flows between applications and data sources, enabling real-time detection and immediate response to sensitive data access events, rather than discovering issues after batch scanning completes hours later.
2Quantity of substance
If batch scanning with regular expressions is used, then sensitive data patterns are searched, but the process generates huge amounts of clutter and false positives that are hard to cleanse manually
Solution Approach 1:
The intermediary component provides contextual awareness of data flows, allowing it to distinguish between actual sensitive data and false positives. By monitoring the actual data requests and responses between applications and data sources, the system can accurately identify sensitive data based on its context and purpose, eliminating the need for manual cleansing of false positives while maintaining comprehensive data coverage.
Solution Approach 2:
The system changes the detection parameters from static regular expression patterns to dynamic, context-aware monitoring. Instead of using fixed patterns that generate false positives, the intermediary adapts its detection based on actual data flow patterns, user context, and application behavior, significantly reducing false positives while maintaining comprehensive coverage.
3Reliability
If Database Access Monitoring solutions are used, then data access is monitored, but the solution is blind to user requests, user responses and user context
Solution Approach 1:
The intermediary component is strategically positioned to capture complete user context information including user requests, application logic, data requests to sources, and user responses. This intermediary acts as a comprehensive monitoring point that preserves all contextual information, enabling reliable data access monitoring while maintaining full visibility into user actions and decisions.
Solution Approach 2:
The intermediary serves multiple functions simultaneously: it monitors data access, tracks user context, analyzes application logic, and identifies sensitive data flows. This multi-functional approach ensures comprehensive monitoring without losing any user context information, making the solution adaptable to various monitoring needs while maintaining complete visibility into user activities.
Data Source
AI summary
A plurality of users connect to an application sending requests over a transport and receiving responses from an application that contain sensitive data. For each user request, the application runs one or more data requests and commands to various data sources or other information systems which return the sensitive data. The application then processes the data and returns is to the user as is or processed based on some business logic. The application includes a run-time environment—where the application logic is executed.