Techniques for agentless detection of sensitive data on managed databases

1 . A method for agentless detection of sensitive data in a cloud computing environment and rendering the same for display, comprising:

generating a snapshot from a managed database service of a cloud computing environment, the snapshot including a plurality of data files;

deploying a virtual instance based on the snapshot to generate a database, the database including a database management system (DBMS);

querying the DBMS to fetch data from the database;

classifying the fetched data, wherein the fetched data is classified as sensitive data or non-sensitive data; and

generating a node on a security graph stored in a graph database to represent the fetched data and the classification thereof, wherein the security graph includes a representation of the cloud computing environment.

2 . The method of claim 1 , further comprising:

detecting that a workload deployed in the cloud computing environment stores data in the managed database service.

3 . The method of claim 1 , further comprising:

receiving access credentials for the managed database service, the access credentials providing access to the plurality of data files.

4 . The method of claim 3 , further comprising:

receiving any one of: an identifier of data stored on the managed database service, an identifier of a data schema stored on the managed database service, an identifier of a data file stored on the managed database service, and any combination thereof.

5 . The method of claim 1 , further comprising:

storing the plurality of data files in a bucket which is accessible by an inspection environment.

6 . The method of claim 1 , wherein the virtual instance is any one of: a virtual machine, and a software container.

7 . The method of claim 1 , further comprising:

fetching from the DBMS any one of: a data schema, and a metadata; and

classifying the fetched data further based on any one of: the data schema, the fetched data, the metadata, and any combination thereof.

8 . The method of claim 1 , further comprising classifying sensitive data further as any one of: personal identifiable information (PII), personal health information (PHI), payment card industry (PCI), and any combination thereof.

9 . The method of claim 1 , wherein of the plurality of data files includes a header and a content and the header includes a data schema.

10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

generating a snapshot from a managed database service of a cloud computing environment, the snapshot including a plurality of data files;

deploying a virtual instance based on the snapshot to generate a database, the database including a database management system (DBMS);

querying the DBMS to fetch data from the database;

classifying the fetched data, wherein the fetched data is classified as sensitive data or non-sensitive data; and

generating a node on a security graph stored in a graph database to represent the fetched data and the classification thereof, wherein the security graph includes a representation of the cloud computing environment.

11 . The non-transitory computer readable medium of claim 10 , wherein of the plurality of data files includes a header and a content and the header includes a data schema.

12 . A system for agentless detection of sensitive data in a cloud computing environment and rendering the same for display, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

generate a snapshot from a managed database service of a cloud computing environment, the snapshot including a plurality of data files;

deploy a virtual instance based on the snapshot to generate a database, the database including a database management system (DBMS);

query the DBMS to fetch data from the database;

classify the fetched data, wherein the fetched data is classified as sensitive data or non-sensitive data; and

generate a node on a security graph stored in a graph database to represent the fetched data and the classification thereof, wherein the security graph includes a representation of the cloud computing environment.

13 . The system of claim 12 , wherein the system is further configured to:

detect that a workload deployed in the cloud computing environment stores data in the managed database service.

14 . The system of claim 12 , wherein the system is further configured to:

receive access credentials for the managed database service, the access credentials providing access to the plurality of data files.

15 . The system of claim 14 , wherein the system is further configured to:

receive any one of: an identifier of data stored on the managed database service, an identifier of a data schema stored on the managed database service, an identifier of a data file stored on the managed database service, and any combination thereof.

16 . The system of claim 12 , wherein the system is further configured to:

store the plurality of data files in a bucket which is accessible by an inspection environment.

17 . The system of claim 12 , wherein the virtual instance is any one of: a virtual machine, and a software container.

18 . The system of claim 12 , wherein the system is further configured to:

fetch from the DBMS any one of: a data schema, and a metadata; and

classifying the fetched data further based on any one of: the data schema, the fetched data, the metadata, and any combination thereof.

19 . The system of claim 12 , wherein the system is further configured to:

classify sensitive data further as any one of: personal identifiable information (PII), personal health information (PHI), payment card industry (PCI), and any combination thereof.

20 . The system of claim 12 , wherein of the plurality of data files includes a header and a content and the header includes a data schema.