Systems and methods for securing data based on discovered relationships
Techniques for automatically discovering and protecting sensitive data are disclosed. In some embodiments, a set of data objects is searched for data matching a first set of one or more regular expressions and for metadata matching a second set of one or more regular expressions. A confidence score is then generated for a particular data objects in the set of data objects as a function of regular expressions in the first set of one or more regular expressions that match data stored in the particular data object and regular expression in the second set of one or more regular expressions that match metadata associated with the particular data object. One or more operations may be performed to protect sensitive data stored in the particular data object based, at least in part, on the confidence score.
1. A method comprising:
searching a set of data objects for data matching a first set of one or more regular expressions;
wherein the first set of one or more regular expressions include a generic regular expression and a set of one or more specific regular expressions that are associated with the generic regular expression;
generating a confidence score for a particular data object in the set of data objects as a function of regular expressions in the first set of one or more regular expressions that match data stored by the data object;
wherein generating the confidence score comprises:
matching the generic regular expression to data in the particular data object;
responsive to matching the generic regular expression, adjusting the confidence score to reflect a higher level of confidence that the particular data object includes sensitive data;
determining whether the set of one or more specific regular expressions match data from the particular data object, and
for each specific regular expression that matches data from the particular data object, adjusting the confidence score to reflect a higher level of confidence that the particular data object includes sensitive data; and
performing at least one operation to protect sensitive data stored in the particular data object based, at least in part, on the confidence score.
2. The method of claim 1 , wherein the confidence score is further generated as a function of contextual information associated with the data object, wherein the contextual information identifies a group category for the data object.
3. The method of claim 1 , wherein the confidence score is further generated as a function of security controls applied to the data object.
4. The method of claim 1 , wherein at least one regular expression in the first set of one or more regular expressions is associated with a first weight, wherein at least one regular expression in the first set of one or more regular expressions is associated with a second weight, and wherein the confidence score is further generated as a function of the first weight and the second weight.
5. The method of claim 1 , further comprising: identifying a sensitive data object that includes sensitive data; responsive to identifying the sensitive data object, generating at least one data regular expression and at least one metadata regular expression; wherein the at least one data regular expression is included in the first set of one or more regular expressions and the at least one metadata regular expression is included in a second set of one or more regular expressions.
6. The method of claim 1 , wherein performing the at least one operation comprises: performing at least one of: applying a data masking script to at least the particular data object to mask the sensitive data, applying a data redaction policy on a document that includes the sensitive data if the confidence score satisfies a threshold, deleting the particular data object, triggering a compliance check on the particular data object, or encrypting the sensitive data within the data object based on the confidence score.
7. The method of claim 1 , further comprising: receiving a set of discovery configurations that identify regular expressions and corresponding confidence scores; wherein the confidence score is generated by aggregating the corresponding confidence scores for regular expressions matched to data and/or metadata associated with the particular data object.
8. The method of claim 1 , further comprising: storing a plurality of sensitive data type definitions; wherein each respective sensitive data type definition defines a respective set of regular expressions for identifying data objects that satisfy the respective sensitive data type definition within a prescribed level of confidence, wherein the first set of one or more regular expressions is part of a sensitive data type definition applied to the set of data objects.
9. The method of claim 1 , further comprising: generating respective confidence scores for each data object in the set of data objects; and performing the at least one operation on a subset of data objects in the set of data objects that have confidence scores that satisfy a threshold.
10. One or more non-transitory computer-readable media storing instructions which, when executed by one or more hardware processors, cause:
searching a set of data objects for data matching a first set of one or more regular expressions;
wherein the first set of one or more regular expressions include a generic regular expression and a set of one or more specific regular expressions that are associated with the generic regular expression;
generating a confidence score for a particular data object in the set of data objects as a function of regular expressions in the first set of one or more regular expressions that match data stored by the data object;
wherein generating the confidence score comprises:
matching the generic regular expression to data in the particular data object;
responsive to matching the generic regular expression, adjusting the confidence score to reflect a higher level of confidence that the particular data object includes sensitive data;
determining whether the set of one or more specific regular expressions match data from the particular data object, and
for each specific regular expression that matches data from the particular data object, adjusting the confidence score to reflect a higher level of confidence that the particular data object includes sensitive data; and
performing at least one operation to protect sensitive data stored in the particular data object based, at least in part, on the confidence score.
11. The media of claim 10 , wherein the confidence score is further generated as a function of contextual information associated with the data object, wherein the contextual information identifies a group category for the data object.
12. The media of claim 10 , wherein the confidence score is further generated as a function of security controls applied to the data object.
13. The media of claim 10 , wherein at least one regular expression in the first set of one or more regular expressions is associated with a first weight, wherein at least one regular expression in the first set of one or more regular expressions is associated with a second weight, and wherein the confidence score is further generated as a function of the first weight and the second weight.
14. The media of claim 10 , wherein the instructions further cause: identifying a sensitive data object that includes sensitive data; responsive to identifying the sensitive data object, generating at least one data regular expression and at least one metadata regular expression; wherein the at least one data regular expression is included in the first set of one or more regular expressions and the at least one metadata regular expression is included in a second set of one or more regular expressions.
15. The media of claim 10 , wherein performing the at least one operation comprises: performing at least one of: applying a data masking script to at least the particular data object to mask the sensitive data, applying a data redaction policy on a document that includes the sensitive data if the confidence score satisfies a threshold, deleting the particular data object, triggering a compliance check on the particular data object, or encrypting the sensitive data within the data object based on the confidence score.
16. The media of claim 10 , wherein the instructions further cause: receiving a set of discovery configurations that identify regular expressions and corresponding confidence scores; wherein the confidence score is generated by aggregating the corresponding confidence scores for regular expressions matched to data and/or metadata associated with the particular data object.
17. The media of claim 10 , wherein the instructions further cause: storing a plurality of sensitive data type definitions; wherein each respective sensitive data type definition defines a respective set of regular expressions for identifying data objects that satisfy the respective sensitive data type definition within a prescribed level of confidence, wherein the first set of one or more regular expressions is part of a sensitive data type definition applied to the set of data objects.
18. The media of claim 10 , wherein the instructions further cause: generating respective confidence scores for each data object in the set of data objects; and performing the at least one operation on a subset of data objects in the set of data objects that have confidence scores that satisfy a threshold.
19. The media of claim 10 , further comprising: searching metadata associated with the set of data objects for metadata matching a second set of one or more regular expressions, wherein the confidence score is further generated as a function of regular expressions in the second set of one or more regular expressions that match metadata associated with the particular data object.
20. A system comprising:
one or more hardware processors;
one or more non-transitory computer-readable media storing instructions that, when executed by the one or more hardware processors, cause:
searching a set of data objects for data matching a first set of one or more regular expressions;
wherein the first set of one or more regular expressions include a generic regular expression and a set of one or more specific regular expressions that are associated with the generic regular expression;
generating a confidence score for a particular data object in the set of data objects as a function of regular expressions in the first set of one or more regular expressions that match data stored by the data object;
wherein generating the confidence score comprises:
matching the generic regular expression to data in the particular data object;
responsive to matching the generic regular expression, adjusting the confidence score to reflect a higher level of confidence that the particular data object includes sensitive data;
determining whether the set of one or more specific regular expressions match data from the particular data object, and
for each specific regular expression that matches data from the particular data object, adjusting the confidence score to reflect a higher level of confidence that the particular data object includes sensitive data; and
performing at least one operation to protect sensitive data stored in the particular data object based, at least in part, on the confidence score.