Best Practices of OBS Data Security Protection

Overview

Sensitive data includes personal privacy information, passwords, keys, sensitive images, and other high-value data. Such data is usually stored in your OBS bucket in different formats. Once the data is leaked, enterprises will suffer significant economic and reputation losses.

After you authorize DSC to perform identification on the data source, DSC quickly identifies sensitive data from your massive data stored in OBS, classify the sensitive data and display it. DSC also traces the usage of sensitive data, and protects and audits data based on predefined security policies. In this way, DSC allows you to learn about the security status of your OBS data assets at any time.

Application Scenario

• Sensitive data identification

  OBS stores a large amount of data and files. However, it is difficult to determine whether the OBS data contains sensitive information and where the sensitive information is stored.

  You can use the built-in algorithm rules of DSC or customize industry rules to scan, classify, and grade data stored in OBS, and take further security protection measures based on the scanning results. For example, you can use the access control and encryption functions of OBS.

• Anomaly detection and audit
  The DSC can detect access, operation, and management anomalies related to sensitive data and send alarms to you for you to confirm and handle the anomalies. The following behaviors are regarded as anomalies:

  • Unauthorized users access and download sensitive data.
  • Authorized users access, download, and modify sensitive data, as well as change and delete permissions.
  • Authorized users change or delete permissions granted for buckets that contain sensitive data.
  • Users who accessed sensitive files fail to log in to the device.

Procedure

1. Buy DSC.
2. In the navigation pane on the left, choose Asset Center > Asset Management.
3. Click Modify next to Cloud Asset Authorization. The Authorize Access to Cloud Assets page is displayed.
4. Locate the row that contains the OBS asset, click in the Operation column to enable authorization.
5. For details about how to add OBS assets, see Adding OBS Assets.
6. In the navigation pane on the left, choose Classification and Grading > Tasks. On the displayed page, click Create Task and configure a sensitive data scanning task.

   Set Data Type to OBS and select the OBS asset added in 5. For details about other configurations, see Creating a Task.

   Table 1 Parameters for creating a sensitive data identification task

   Parameter	Description	Example Value
   Task Name	You can customize the task name. The task name must: Contain 4 to 255 characters. Consist of letters, digits, underscores (_), and hyphens (-). Start with a letter. Be unique.	Test_OBS
   Data Source	Type of data source. You can select multiple types. OBS: After DSC is authorized to access your Huawei Cloud OBS asset, DSC will identify the sensitive data in it. For details about how to add OBS assets, see Adding an OBS Asset. Database: DSC will identify the sensitive data in the authorized databases. For details about how to authorize a database, see Adding and Authorizing Database Assets. Big Data: DSC will identify the sensitive data in the authorized big data assets. For details about how to authorize big data assets, see Adding and Authorizing Big Data Assets. LTS: DSC will identify the sensitive data in the authorized LTS assets. For details about how to add a log stream, see Adding a Log Stream.	OBS
   Identification Template	You can select a built-in or custom template. DSC displays data by level and category based on the template you select. For details about how to create a template, see Configuring Sensitive Data Identification Policies.	General Cloud Data Security Classification Template
   Identification Period	Set the execution policy of the data identification task. Once: The task will be executed once at a specified time. Daily: The task is executed at a fixed time every day. Weekly: The task is executed at a specified time every week. Monthly: The task is executed at a specified time every month.	Once
   When to Execute	This parameter is displayed when Identification Period is set to Once. Now: Select the option and click OK, the system executes the data identification task immediately. As scheduled: The task will be executed at a specified time.	Now

7. Click Identification Result in the Operation column to view the Identification result.

   In the upper left corner of the page, set Task Name to dsc-test, Data Type to Test_OBS, and Asset types to All Assets to filter the OBS sensitive data identification result.

8. In the row containing the desired scan object, click View Categorizing and Leveling Result Details in the Operation column. The Categorizing and Leveling Result Details dialog box is displayed, as shown in Figure 1.
   Figure 1 Categorizing and leveling results

   

   1. In the alarm list, view anomalies based on the risk level and check whether there are high-risk events. For operation details, see OBS Usage Auditing .
   2. On OBS Console, modify the read and write permissions of the risky buckets or files. For details, see Bucket Policy.