Data Asset Protection Overview

DSC can help mask a large amount of data at one time based on the configured data masking rules. Static data masking is used when sensitive data in the production environment is delivered to the development, testing, or external environment for development and testing and data sharing and research. You can create a data masking task on the DSC console to quickly mask sensitive data in databases, OBS, and big data.

Figure 1 Static data masking flowchart

Data watermarking supports databases, documents, and images. If watermarks are added to distributed data, you can extract watermarks from leaked data to trace data flows and accurately locate the organization and person who leaked the data. In this case, the organization or person that is accountable for the leakage problem can be easily found. Adding watermarks does not affect use of the distributed data.

Figure 2 Data watermarking process

Leveraging advanced big data analytics, database audit offers a suite of features including database auditing, SQL injection attack detection, and identification of hazardous activities, all designed to fortify database security in the cloud environment. Table 5 describes its functions and features.

For details, see Database Audit Functions and Using Database Audit.

CBH is a unified security management and control platform. It provides account, authorization, authentication, and audit management services that enable you to centrally manage cloud computing resources.

CBH provides various functional modules, such as department, user, resource, policy, operation, and audit modules. It integrates functions such as single sign-on (SSO), unified asset management, multi-terminal access protocols, file transfer, and session collaboration. With the unified O&M login portal, protocol-based forward proxy, and remote access isolation technologies, CBH enables centralized, simplified, secure management and maintenance auditing for cloud resources such as servers, cloud hosts, databases, and application systems.

For details, see CBH Features and CBH User Guide.

• Identity Authentication

  CBH uses multi-factor authentication and remote authentication technologies to enhance O&M security.

  • Multi-factor authentication: CBH authenticates users with SMS messages, mobile tokens, USB keys, and one-time-password (OTP) tokens, reducing account leakage risks.
  • Remote authentication: CBH interconnects with third-party authentication services or platforms to perform remote account authentication, prevent credential leakage, and ensure secure O&M. Currently, Active Directory (AD), Remote Authentication Dial-In User Service (RADIUS), Lightweight Directory Access Protocol (LDAP), and Azure AD remote authentication are available. CBH allows you to synchronize users from the AD domain server without modifying the original user directory structure.

• Account Management

  With a CBH system, you can centrally manage system user accounts and managed resource accounts, and establish a visible, controllable, and manageable O&M system that covers the entire account lifecycle.

  • User account management: Manages the entire life cycle of system user accounts. Users can use a unique account to log in to the system to solve problems such as shared accounts, temporary accounts, and permission abuse.
  • Resource account management: Centralized resource account management, full lifecycle management of resource accounts, single sign-on (SSO) to resources, and seamless switchover between management and O&M.

• Permissions Management

  CBH supports fine-grained permission management so that you have complete control over which user can access the CBH system and which managed resources can be accessed by a specific system user, enabling you to safeguard both the CBH system and managed resources.

  • System access permission: controls user login and system access permissions based on the attributes of a single user account.
  • Resource access control: You can assign permissions for resources by user, user group, account, and account group.

• Operation Audit

  In a CBH system, each system user has a unique identifier. After a system user logs in to the CBH system, the CBH system logs their operations and monitors and audits their operations on managed resources based on the unique identifier so that any security events can be discovered and reported in real time.

  • System behavior audit: All system operations are recorded, and alarms are generated for misoperations, malicious operations, and unauthorized operations.
  • Resource O&M audit: Records users' O&M operations throughout the entire process and supports multiple O&M audit technologies and forms. User operations can be audited at any time to identify O&M risks and provide basis for security event tracing and analysis.

• O&M Functions

  CBH supports multiple architectures, tools, and methods to manage a wide range of resources.

  • O&M from your web browser: By leveraging HTML5 for remote logins, O&M engineers can perform O&M, such as real-time operation monitoring and file uploading and downloading, without installing a special client.
  • O&M using a third-party client: CBH enables one-click interconnection with multiple O&M tools, enabling you to perform O&M without changing client usage habits.
  • Automatic O&M: Complex online operations are automatically performed, eliminating repeated work and improving work efficiency.

• O&M Ticket Application

  During the O&M, if a system user does not have the required permissions for a certain resource, they can submit a ticket to apply for the permissions.

  • O&M engineers can:
    • Manually or automatically trigger the ticket system and submit access approval tickets, command approval tickets, and database approval tickets.
    • Submit, query, cancel, and delete tickets.
  • System administrators can:
    • Customize approval processes, including multi-level approval processes.
    • Approve one or more tickets at a time, as well as reject, cancel, query, and delete tickets.