Secure data handling discovery
Secure data handling discovery techniques model are implemented to discover access to secure data within an application. A dataflow model is generated for an application to describe a secure zone with respect to secure data. The dataflow model is then evaluated and updated when dataflows that exit the secure zone are detected. Classifications of the exits are received and used to update the dataflow model.
1. A system, comprising:
at least one processor; and
a memory, storing program instructions that when executed by the at least one processor, cause the at least one processor to implement a secure data handling discovery system, configured to:
detect an event that triggers evaluation of a dataflow model generated for secure data, wherein the dataflow model describes use and movement of the secure data across one or more computing resources;
evaluate the dataflow model for the secure data to detect a dataflow of the secure data that exits from a secure zone for the secure data;
provide, via an interface of the secure data handling discovery system, an indication of the detected dataflow of the secure data that exits from the secure zone;
receive, via the interface of the data handling discovery system, a classification of the detected dataflow that exits from the secure zone; and
update, by the secure data handling discovery system, the dataflow model with respect to the detected dataflow based on the classification of the detected dataflow.
2. The system of claim 1 , wherein the secure data handling discovery system is further configured to create the dataflow model for the secure data in response to a request to create the dataflow model received via the interface of the secure data handling system, wherein the request to create the dataflow model specifies an initial location for the secure data to generate an initial node in a dataflow graph as part of the dataflow model.
3. The system of claim 1 , wherein to evaluate the dataflow model, the secure data handling discovery system is configured to:
analyze application code maintained as part of the dataflow model to trace movement of the secure data between computing resources;
analyze a configuration of the one or more computing resources to determine permitted data movement; and
based on a dataflow graph maintained as part of the dataflow model, identify the detected dataflow according to the analysis of the application code and the analysis of the configuration of the one or more computing resources.
4. The system of claim 1 , wherein the evaluating is performed in response to adding in accordance with a request received via the interface of the secure data handling system, a new resource to the secure zone.
5. A method, comprising:
evaluating, by a secure data handling discovery system, a dataflow model generated by the secure data handling discovery system for secure data to detect a dataflow of the secure data that exits from a secure zone for the secure data, wherein the dataflow model describes use and movement of the secure data across one or more computing resources;
providing, via an interface of the secure data handling discovery system, an indication of the detected dataflow of the secure data that exits from the secure zone;
receiving, via the interface of the data handling discovery system, a classification of the detected dataflow that exits from the secure zone; and
updating, by the secure data handling discovery system, the dataflow model with respect to the detected dataflow based on the classification of the detected dataflow.
6. The method of claim 5 , wherein evaluating the dataflow model comprises:
analyzing application code maintained as part of the dataflow model to trace movement of the secure data between computing resources;
analyzing a configuration of the one or more computing resources to determine permitted data movement; and
based on a dataflow graph maintained as part of the dataflow model, identify the detected dataflow according to the analysis of the application code and the analysis of the configuration of the one or more computing resources.
7. The method of claim 5 , wherein the evaluating is performed in response to adding in accordance with a request received via the interface of the secure data handling system, a new resource to the secure zone.
8. The method of claim 5 , wherein the classification identifies a destination of the detected dataflow as part of the secure zone for the secure data.
9. The method of claim 5 , wherein the evaluating is performed in response to a development update to application code obtained by the secure data handling system.
10. The method of claim 5 , further comprising creating the dataflow model for the secure data in response to a request to create the dataflow model received via the interface of the secure data handling system, wherein the request to create the dataflow model specifies an initial location for the secure data to generate an initial node in a dataflow graph as part of the dataflow model.
11. The method of claim 5 , wherein the classification identifies the dataflow as an expected exit from the secure zone.
12. The method of claim 5 , wherein the evaluation identifies a second dataflow that exits from the secure zone, wherein the evaluation is performed again responsive to a request to perform the evaluation, and wherein the second dataflow is not detected after the second performance of the evaluation.
13. The method of claim 5 , wherein the one or more computing resources are implemented as part of one or more services offered by a provider network.
14. One or more non-transitory, computer-readable storage media, storing program instructions that when executed on or across one or more computing devices cause the one or more computing devices to implement:
responsive to a detected event:
causing a dataflow model generated by a secure data handling discovery system for secure data to be evaluated, wherein the evaluation detects a dataflow of the secure data that exits from a secure zone for the secure data, wherein the dataflow model describes use and movement of the secure data across one or more computing resources;
providing, via an interface of the secure data handling discovery system, an indication of the detected dataflow of the secure data that exits from the secure zone;
receiving, via the interface of the data handling discovery system, a classification of the detected dataflow that exits from the secure zone; and
updating, by the secure data handling discovery system, the dataflow model with respect to the detected dataflow based on the classification of the detected dataflow.
15. The one or more non-transitory, computer-readable storage media of claim 14 , wherein the classification identifies a destination of the detected dataflow as part of the secure zone for the secure data.
16. The one or more non-transitory, computer-readable storage media of claim 14 , wherein, in evaluating the dataflow model, the program instructions cause the one or more computing devices to implement:
analyzing application code maintained as part of the dataflow model to trace movement of the secure data between computing resources;
analyzing a configuration of the one or more computing resources to determine permitted data movement; and
based on a dataflow graph maintained as part of the dataflow model, identify the detected dataflow according to the analysis of the application code and the analysis of the configuration of the one or more computing resources.
17. The one or more non-transitory, computer-readable storage media of claim 14 , wherein the event is a deployment update.
18. The one or more non-transitory, computer-readable storage media of claim 14 , storing further instructions that when executed on or across the one or more computing devices, cause the one or more computing devices to implement creating the dataflow model for the secure data in response to a request to create the dataflow model received via the interface of the secure data handling system, wherein the request to create the dataflow model specifies an initial location for the secure data to generate an initial node in a dataflow graph as part of the dataflow model.
19. The one or more non-transitory, computer-readable storage media of claim 14 , wherein the evaluation is performed in response to adding in accordance with a request received via the interface of the secure data handling system, a new resource to the secure zone.
20. The one or more non-transitory, computer-readable storage media of claim 14 , wherein the one or more computing resources are implemented as part of one or more services offered by a provider network.