Functions

Asset Map

You can view multiple aspects of your asset security, such as asset overview, categories and levels, permission configuration, data storage, and sensitive data. This helps you quickly detect risky assets and handle them. For details, see Asset Map.

• Asset visualization
  • Data service assets: All data assets on the cloud, including OBS, RDS, CSS, Hive, and HBase.
  • Data risks: The categorization and leveling results display the risk levels of data.
  • Region display: The region where each asset is located is displayed based on the cloud resource VPC and associated with the service region.
• Egress visualization
  • Data egresses: All data egresses on the cloud are identified, including EIP, NAT, API Gateway, and ROMA.
  • Asset and egress association: Cloud egresses are associated with data assets and data asset categorization and leveling results.
  • Cascading association: Egresses and the cascading egresses are displayed.
• Policy visualization
  • Data security policies: All security policies of data assets are detected based on cloud native capabilities and policy risks are displayed.
  • Policy recommendation: Different security policy configurations are recommended based on the data asset level.

Asset Management

• Asset center: You can manage data assets from OBS, databases, big data, Log Tank Service (LTS), and MRS. For details, see Asset Center.
• Asset catalog: You can view statistics about different service domains or data types. For details, see Asset Catalog.
• Data exploration: You can view details about all the added data assets and add descriptions, tags, sensitivity levels, and classifications to databases, tables, and data views to manage data assets by level and classification. For details, see Data Exploration.
• Metadata tasks: You can create metadata tasks to collect data assets as metadata. In this way, you can manage data assets by level and classification. For details, see Data Exploration.
• Asset group management: Data can be managed by group. For details, see Managing Asset by Group.

Sensitive Data Identification

• File types: Nearly 200 types of unstructured files are supported.
• Data types: Dozens of personal privacy data types are supported, including Chinese and English.
• Image types: DSC is able to identify sensitive words (Chinese and English) in eight types of images, including PNG, JPEG, x-portable-pixmap, TIFF, BMP, GIF, JPX, and JP2.
• Automatic identification of sensitive data
  • Automatic identification of sensitive data and personal privacy data
  • Visualized identification results are provided and can be downloaded to your local PC. For details, see Creating an Identification Task.

The identification duration depends on the data volume, number of identification rules, and scan mode. For details, see How Long Does It Take for DSC to Identify and Mask Sensitive Data?

Data Masking

DSC data masking supports static masking and API-based masking. For details, see Creating a Database Data Masking Task.

Data masking has the following features:

• Zero impact: DSC reads data from original databases, statically masks sensitive data using precise masking engines, and saves the masked data separately without affecting your data assets.
• Various data sources: Data of various sources on the cloud, such as RDS, user-built databases on ECSs, or big data, can be masked to meet security requirements.
• Custom data masking policies: DSC provides you with over 20 preset data masking rules. You can use the default masking rules or customize the masking rules to mask sensitive data in the specified database table. For details about the data masking algorithms supported by DSC, see Configuring a Data Masking Rule.
• Easy configuration of masking rules: Data masking rules can be easily configured based on the scan results.

In addition, DSC provides APIs for data masking. For details, see Dynamic Data Masking.

DSC uses preset and customized masking algorithms to mask sensitive data stored in RDS, Elasticsearch, MRS, Hive, HBase, DLI, and OBS. For details about the masking duration, see How Long Does It Take for DSC to Identify and Mask Sensitive Data?

Data Watermarking

Watermarks can be injected and extracted for databases, documents, and images. For details, see Data Watermarking.

• Copyright proof: The owner information is added to the assets to specify the ownership, achieving copyright protection.
• Automated monitoring: The user information is added to the assets for tracing data leak.

DSC provides APIs for dynamically adding data watermarks and extracting watermarks from data. For details, see DSC API Reference.

Security Awareness Dashboard

By default, DSC provides an integrated security awareness dashboard that presents a thorough analysis of risky assets, identification, masking, and watermarking tasks, as well as events and alarms in the cloud. This dashboard facilitates swift recognition and response to the overall status of assets, including addressing risky assets and urgent alarms. For details, see Situational Awareness Dashboard.

Alarm Management

When a system or service risk alarm is generated for DBSS, the alarm event is sent to DSC. You can view the alarm event on the DSC console. For details, see Alarm Management.

Event Management

DSC integrates with key security components such as database audit and CBH, enabling centralized event management and real-time event delivery to DSC. This allows you to promptly verify and handle events. You can also convert alarms on the Alarm Management page to events. For details, see Event Management.

OBS Usage Audit

DSC detects OBS buckets based on sensitive data identification rules and monitors identified sensitive data. After abnormal operations of the sensitive data are detected, DSC allows you to view the monitoring result and handle the abnormal events as required. For details, see OBS Usage Audit.

Alert Notifications

DSC sends notifications through the notification method configured by users when sensitive data identification is completed or abnormal events are detected. For details, see Alarm Notifications.