Data scan sampling control for data discovery and posture management
The disclosed technology receives a control input identifying a sampling criterion for classifying a data store storing a set of data objects in a computing environment as corresponding to a target data type and deploys one or more scanners configured to select a representative subset of data objects, from the set of data objects, based on the sampling criterion. A scanner result generated by the one or more scanners is received that represents detected instances, in the representative subset of data objects, of one or more pre-defined data patterns of the target data type. A classification result is generated based on a comparison of the number of detected instances of the one or more pre-defined data patterns to a threshold. The classification result represents a classification of the data store as having correspondence to the target data type. A computing action is performed based on the classification result.
1. A computer-implemented method comprising:
receiving a control input identifying a sampling criterion for classifying a data store in a computing environment as corresponding to a target data type, the data store storing a set of data objects;
deploying one or more scanners configured to select a representative subset of data objects, from the set of data objects, to scan based on the sampling criterion, the representative subset of data objects comprising some, but not all, of the set of data objects;
receiving a scanner result, generated by the one or more scanners, that represents a set of detected instances, in the representative subset of data objects, of one or more pre-defined data patterns of the target data type;
determining a number of instances in the set of detected instances;
comparing the number of instances to a number threshold; and
in response to determining the number of instances satisfies the number threshold,
generating a classification result representing a classification of the data store as having correspondence to the target data type; and
performing a computing action based on the classification result.
2. The computer-implemented method of claim 1 , wherein determining the number of instances satisfies the number threshold comprises determining that the number of instances meets or exceeds the number threshold.
3. The computer-implemented method of claim 1 , wherein the target data type comprises one or more of a sensitive data type or a private data type, and the classification result indicates that the data store includes at least the number threshold of the one or more of a sensitive data type or a private data type.
4. The computer-implemented method of claim 1 , wherein the control input is based on a user selection received through a user interface display.
5. The computer-implemented method of claim 1 , wherein the control input is programmatically generated based on one or more of a characteristic of the data store or a previous scan of the data store.
6. The computer-implemented method of claim 1 , wherein the one or more scanners are configured, based on the sampling criterion, to randomly select the representative subset of data objects from the set of data objects.
7. The computer-implemented method of claim 6 , wherein a number of data objects in the representative subset of data objects is selected based on an indication of a target error margin.
8. The computer-implemented method of claim 1 , wherein the one or more scanners are configured, based on the sampling criterion, to perform directory-based sampling based on a directory structure in the data store.
9. The computer-implemented method of claim 1 , wherein the one or more scanners are configured, based on the sampling criterion, to select the representative subset of data objects from the set of data objects based on metadata of the set of data objects, the metadata comprising one or more of object type, object tags, or object size.
10. The computer-implemented method of claim 1 , wherein the one or more scanners are configured, based on the sampling criterion, to select the representative subset of data objects from the set of data objects based on timestamps associated with the set of data objects.
11. The computer-implemented method of claim 1 , wherein the sampling criterion comprises an exclusion criterion, wherein the one or more scanners are configured to exclude data items from the representative subset of data objects based on the exclusion criterion.
12. The computer-implemented method of claim 1 , wherein the one or more scanners are configured, based on the sampling criterion, to select the representative subset of data objects from the set of data objects based on a target risk signature.
13. A computing system comprising:
at least one processor; and
memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
receive a control input identifying a sampling criterion for classifying a data store in a computing environment as corresponding to a target data type, the data store storing a set of data objects;
deploy one or more scanners configured to select a representative subset of data objects, from the set of data objects, to scan based on the sampling criterion, the representative subset of data objects comprising some, but not all, of the set of data objects;
receive a scanner result generated by the one or more scanners that represents detected instances, in the representative subset of data objects, of one or more pre-defined data patterns of the target data type;
determine a number of instances in the set of detected instances;
compare the number of instances to a number threshold; and
in response to a determination that the number of instances satisfies the number threshold,
generate a classification result representing a classification of the data store as having correspondence to the target data type; and
perform a computing action based on the classification result.
14. The computing system of claim 13 , wherein the target data type comprises one or more of a sensitive data type or a private data type, and the classification result indicates that the data store includes at least the number threshold of the one or more of a sensitive data type or a private data type.
15. The computing system of claim 13 , wherein the sampling criterion comprises at least one of:
a random sampling of the set of data objects from the data store;
a directory-based sampling of the set of data objects that is based on a directory structure in the data store; or
a metadata-based sampling of the set of data objects that is based on metadata of the set of data objects, the metadata comprising one or more of object type, object tags, or object size.
16. A computing system comprising:
at least one processor;
memory storing instructions executable by the at least one processor, wherein the instructions, when executed, provide:
a scan criterion generation component configured to generate a scan criterion for classifying a data store in a computing environment as corresponding to a target data type, the data store storing a set of data objects;
a scanner deployment component configured to:
deploy one or more scanners configured to select a representative subset of data objects, from the set of data objects, to scan based on the scan criterion, the representative subset of data objects comprising some, but not all, of the set of data objects, and
receive a scanner result generated by the one or more scanners that represents detected instances, in the representative subset of data objects, of one or more pre-defined data patterns of the target data type; and
an action generator component configured to:
determine a number of instances in the set of detected instances;
compare the number of instances to a number threshold;
in response to a determination that the number of instances satisfies the number threshold,
generate a classification result representing a classification of the data store as having correspondence to the target data type, and
perform a computing action based on the classification result.
17. The computing system of claim 16 , wherein the scan criterion comprises at least one of:
a random sampling of the set of data objects from the data store;
a directory-based sampling of the set of data objects that is based on a directory structure in the data store; or
a metadata-based sampling of the set of data objects that is based on metadata of the set of data objects, the metadata comprising one or more of object type, object tags, or object size.
18. The computer-implemented method of claim 1 , wherein the one or more scanners are configured to scan the representative subset of data objects for instances of a plurality of different pre-defined data patterns, the computer-implemented method further comprising:
identifying one or more data patterns, of the plurality of different pre-defined data patterns, that have a number of instances that satisfy the number threshold; and
generating the classification result based on the identified one or more data patterns.
19. The computer-implemented method of claim 1 , wherein the sampling criterion comprises a first sampling criterion, and the representative subset of data objects comprises a first representative subset of data objects, the computer-implemented method further comprising:
identifying a switching criterion; and
in response to the switching criterion, configuring the one or more scanners to select a second representative subset of data objects, different from the first representative subset of data objects, based on a second sampling criterion, and scan the second representative subset of data objects for instances of the one or more pre-defined data patterns.
20. The computer-implemented method of claim 1 , and further comprising:
selecting the number threshold based on a number of data objects in the data store.