Best Practices of OBS Data Security Protection

Overview

Sensitive data includes personal privacy information, passwords, keys, sensitive images, and other high-value data. Such data is usually stored in your OBS bucket in different formats. Once the data is leaked, enterprises will suffer significant economic and reputation losses.

After you authorize DSC to identify data sources, DSC can quickly detect and locate sensitive data in OBS. It then performs classification and grading on the data, displays the result, traces its usage, and protects and audits the data based on the predefined security policies. In this way, you can learn about OBS data asset security status anytime.

Application Scenarios

• Sensitive data identification

  OBS stores a large amount of data and files. However, it is difficult to determine whether the OBS data contains sensitive information and where the sensitive information is stored.

  You can use the built-in algorithm rules of DSC or customize industry rules to scan, classify, and grade data stored in OBS, and take further security protection measures based on the scanning results. For example, you can use the access control and encryption functions of OBS.

• Anomaly detection and audit
  DSC can detect abnormal events related to the access, operation, and management of sensitive data and report alarms to you to confirm and handle these abnormal events. The following behaviors are regarded as anomalies:

  • Unauthorized users access and download sensitive data.
  • Authorized users access, download, and modify sensitive data, as well as change and delete permissions.
  • Authorized users change or delete permissions granted for buckets that contain sensitive data.
  • The login terminal of the user who accesses sensitive data is abnormal.

Procedure

1. Buy DSC.
2. In the navigation pane on the left, choose Asset Center > Asset Management.
3. Click Modify next to Cloud Asset Authorization. The Authorize Access to Cloud Assets page is displayed.
4. Locate the row that contains the OBS asset, click in the Operation column to enable authorization.
5. For details about how to add OBS assets, see Adding OBS Assets.
6. In the navigation pane on the left, choose Classification and Grading > Tasks. On the displayed page, click Create Task and configure a sensitive data scanning task.

   Set Data Type to OBS and select the OBS asset added in 5. For details about other configurations, see Creating a Task.

   Table 1 Parameters for creating a sensitive data identification task

   Parameter	Description	Example Value
   Task Name	You can customize the task name. The task name must: Contain 4 to 255 characters. Contain only letters, digits, underscores (_), and hyphens (-). Start with a letter. Be unique.	Test_OBS
   Data Source	Select OBS. DSC identifies sensitive data in the added Huawei Cloud OBS assets.	OBS
   Identification Template	You can select a built-in or custom template. DSC displays data by level and category based on the template you select. For details about how to create a template, see Configuring Sensitive Data Identification Policies.	General Cloud Data Security Classification Template
   Identification Period	Set the execution policy of the data identification task. Once: The task will be executed once at a specified time. Daily: The task is executed at a fixed time every day. Weekly: The task is executed at a specified time every week. Monthly: The task is executed at a specified time every month.	Once
   When to Execute	This parameter is displayed when Identification Period is set to Once. Now: Select the option and click OK. The system executes the data identification task immediately. As scheduled: The task will be executed at a specified time.	Now

7. Click Identification Result in the Operation column to view the Identification result.

   In the upper left corner of the page, set Task Name to dsc-test, Data Type to Test_OBS, and Asset types to All Assets to filter the OBS sensitive data identification result.

8. In the row containing the desired scan object, click View Categorizing and Leveling Result Details in the Operation column. The Categorizing and Leveling Result Details dialog box is displayed, as shown in Figure 1.
   Figure 1 Categorizing and leveling results

   

   1. In the alarm list, view anomalies based on the risk level and check whether there are high-risk events. For operation details, see OBS Usage Auditing .
   2. On OBS Console, modify the read and write permissions of the risky buckets or files. For details, see Bucket Policy.