Tagging and auditing sensitive information in a database environment
Access to sensitive information in a database can be restricted to improve security and enable efficient auditing. A security engine receives a request from a requesting entity to access data in the database and determines that the requested data includes sensitive information. In response to the requesting entity being authorized to access the data, the security engine retrieves the requested data from the database and modifies the retrieved data by modifying metadata of the retrieved data to include a tag indicating that the retrieved data includes sensitive information. The security engine provides the modified data to the requesting entity and modifies a data access log to identify each attempted access to the modified data. When sensitive data is requested, an interface can include an obscuring element, requiring a user to manually select the element to view the data, enabling the logging of the explicit access request by the user.
1 . A method comprising:
providing, by a security engine, access to data from a database requested by a requesting entity, wherein the security engine determines if the accessed data includes sensitive information or non-sensitive information based at least in part on a format of the accessed data, wherein the security engine, in response to determining that the accessed data includes non-sensitive information, accesses and displays the non-sensitive information within a corresponding set of data fields in a graphical user interface and, in response to determining that the accessed data includes sensitive information, modifies the accessed data to include a tag within metadata of the accessed data indicating that the accessed data includes sensitive information and responsive to determining the requesting entity is not authorized to access the modified data, preventing the requesting entity from accessing the data;
providing, by the security engine, the modified data to a client device of the requesting entity, the client device different from the security engine and the database, the client device configured to display selectable obscuring interface elements completely covering each of a plurality of data fields corresponding to the modified data wherein each selectable obscuring interface element, when selected, is removed such that the modified data is displayed within the corresponding data field if the requesting entity is authorized to view the modified data, and wherein all additional selectable obscuring elements that the requesting entity has not selected and that correspond to modified data that the requesting entity is authorized to view are also removed without being selected by the requesting entity such that the modified data corresponding to the additional selectable obscuring elements becomes visible and all selectable obscuring elements that correspond to modified data that the requesting entity is not authorized to view are not removed; and
receiving, by the security engine, a notification from the client device in response to a request from each of a plurality of accessing entities to access the modified data from the client device, wherein the client device provides the notification to the security engine in response to detecting the tag within the modified data when access is requested by each of the accessing entities, the security engine configured to modify a data access log based on the received notification to include 1) an identification of which selectable obscuring interface elements are selected by the requesting entity, 2) a personnel identification associated with the requesting entity, and 3) an authorization level associated with the requesting entity.
2 . The method of claim 1 , wherein the metadata of the accessed data comprises at least one of: a category of data, a type of data, a format of data, a sensitivity of data, and a required authorization level.
3 . The method of claim 1 , wherein the modified data access log identifies at least one of:
a user account associated with the requesting entity;
a hardware identifier for a device used by the requesting entity to access the modified data;
a software identifier for software used by the requesting entity to access the modified data; and
information indicating whether the attempt to access the modified data was successful.
4 . The method of claim 1 , wherein the modified data access log identifies one or more of: a web page used to access the modified data, a form used to access the modified data, and one or more fields displayed by a device of the requesting entity associated with the modified data.
5 . The method of claim 1 , wherein the sensitive information is personally identifiable information (PII).
6 . The method of claim 1 , wherein portions of the database including sensitive information are defined by a data security policy.
7 . The method of claim 1 , further comprising:
responsive to receiving a request from an auditing entity to audit the modified data access log for information associated with a potential data breach, accessing, by the security engine, access data associated with the potential data breach from the modified data access log; and
responsive to determining that the auditing entity is authorized to audit the modified data access log, providing, by the security engine, the accessed information to the auditing entity.
8 . The method of claim 7 , further comprising modifying, by the security engine, the data access log to identify the request to audit the modified data access log by the auditing entity.
9 . The method of claim 1 , further comprising:
responsive to determining that the requested data is not stored in one or more database columns corresponding to sensitive information, providing, by the security engine, the requested data from the database to the requesting entity.
10 . The method of claim 1 , further comprising:
in response to the requesting entity being unauthorized to access the data, modifying, by the security engine, the data access log to identify the request from the requesting entity to access the data in the database and to indicate that the requesting entity is not authorized to access the data.
11 . The method of claim 1 , further comprising:
responsive to determining that the modified data has been accessed by an unauthorized entity, by the security engine, sending a notification identifying the unauthorized access to a user.
12 . The method of claim 1 , further comprising:
determining that the modified data has been accessed by an unauthorized accessing entity that is unauthorized to access the modified data; and
responsive to the determining that the modified data has been accessed by the unauthorized entity, preventing, by the security engine, the unauthorized entity from subsequently accessing the modified data.
13 . A non-transitory computer readable storage medium storing executable instructions that, when executed by one or more processors, cause the processor to perform steps comprising:
providing, by a security engine, access to data from a database requested by a requesting entity, wherein the security engine determines if the accessed data includes sensitive information or non-sensitive information based at least in part on a format of the accessed data, wherein the security engine, in response to determining that the accessed data includes non-sensitive information, accesses and displays the non-sensitive information within a corresponding data field in a graphical user interface and, in response to determining that the accessed data includes sensitive information, modifies the accessed data to include a tag within metadata of the accessed data indicating that the accessed data includes sensitive information and responsive to determining the requesting entity is not authorized to access the modified data, preventing the requesting entity from accessing the data;
providing, by the security engine, the modified data to a client device of the requesting entity, the client device different from the security engine and the database, the client device configured to display selectable obscuring interface elements completely covering each of a plurality of data fields corresponding to the modified data wherein each selectable obscuring interface element, when selected, is removed such that the modified data is displayed within the corresponding data field if the requesting entity is authorized to view the modified data, and wherein all additional selectable obscuring elements that the requesting entity has not selected and that correspond to modified data that the requesting entity is authorized to view are also removed without being selected by the requesting entity such that the modified data corresponding to the additional selectable obscuring elements becomes visible and all selectable obscuring elements that correspond to modified data that the requesting entity is not authorized to view are not removed; and
receiving, by the security engine, a notification from the client device in response to a request from each of a plurality of accessing entities to access the modified data from the client device, wherein the client device provides the notification to the security engine in response to detecting the tag within the modified data when access is requested by each of the accessing entities, the security engine configured to modify a data access log based on the received notification to include 1) an identification of which selectable obscuring interface elements are selected by the requesting entity, 2) a personnel identification associated with the requesting entity, and 3) an authorization level associated with the requesting entity.
14 . The non-transitory computer readable storage medium of claim 13 , wherein the sensitive information is personally identifiable information (PII).
15 . The non-transitory computer readable storage medium of claim 13 , wherein the steps further comprise:
responsive to receiving a request from an auditing entity to audit the modified data access log for information associated with a potential data breach, accessing, by the security engine, access data associated with the potential data breach from the modified data access log; and
responsive to determining that the auditing entity is authorized to audit the modified data access log, providing, by the security engine, the accessed information to the auditing entity.
16 . The non-transitory computer readable storage medium of claim 13 , wherein the steps further comprise modifying, by the security engine, the data access log to identify the request to audit the modified data access log by the auditing entity.
17 . The non-transitory computer readable storage medium of claim 2 , wherein the metadata of the retrieved data comprises at least one of: a category of data, a type of data, a format of data, a sensitivity of data, and a required authorization level.
18 . The non-transitory computer readable storage medium of claim 13 , wherein the modified data access log identifies at least one of:
a user account associated with the requesting entity;
a hardware identifier for a device used by the requesting entity to access the modified data;
a software identifier for software used by the requesting entity to access the modified data; and
information indicating whether the attempt to access the modified data was successful.
19 . The non-transitory computer readable storage medium of claim 13 , wherein the modified data access log further one or more of: a web page used to access the modified data, a form used to access the modified data, and one or more fields displayed by a device of the requesting entity associated with the modified data.
20 . The non-transitory computer readable storage medium of claim 13 , wherein the steps further comprise:
in response to the requesting entity being unauthorized to access the data, modifying, by the security engine, the data access log to identify the request from the requesting entity to access the data in the database and to indicate that the requesting entity is not authorized to access the data.