Viewing the Data Security Situation on the Asset Map

The data asset map allows you to view the security status of your assets from multiple dimensions, such as asset overview, categories and risk levels, permissions, storage, sensitivity, and data egress analysis. This helps you quickly detect risky assets and handle them.

Notes and Constraints

A maximum of 1,000 assets can be displayed.
Only the data sources listed in Data Source Types and Versions Supported by DSC are supported.

Prerequisites

There are added OBS assets or authorized big data or database assets. For details, see Adding and Authorizing Data Assets in DSC.

Asset Map Authorization

Log in to the DSC console.
Click in the upper left corner and select a region or project.
In the navigation pane on the left, choose Asset Center > Asset Map.
Click in the upper left corner for authorization.
- After the authorization is approved, DSC displays the authorized OBS buckets, databases, big data instances, and other cloud assets.
  
  After DSC is authorized to access the OBS buckets to obtain the logs, fees are incurred. For details, see Requests.
- Once authorization is canceled, DSC automatically deletes your cloud assets, IAM agencies, and all associated data. Exercise caution when performing this operation.
When the message "Starting security scanning and analysis..." is displayed in the upper right corner, the authorization is successful.
After the security scanning and analysis are complete, click Rating Details to go to the Risks page and view the details. Functions and usage of each module will be described later in this section.

Asset Map Functions

Data assets on the cloud can be displayed by region. DSC automatically scans and sorts out data assets on the cloud and on-premises and displays asset distribution on a map. The asset map displays regions of assets based on VPCs and associates asset regions with service regions.
Figure 1 Asset Map
Sensitive data display: DSC displays sensitive data by categories. It identifies and classifies sensitive data using a three-layer identification engine, including default compliance rules, natural language semantic identification, and advanced file similarity detection.
Data egress analysis: DSC provides a unified data egress view based on the asset map to help you identify all data egresses on the cloud and on-premises and potential security risks of these egresses, so you can take corresponding data security protection measures.
Figure 2 Data egress analysis
Risk monitoring and alarming: DSC monitors data asset risks using the risk identification engine, displays the risk distribution for each asset type, and reports alarms for you to take quick response.
- Security Score: The asset map displays the overall security score of all your assets. You can click next to Scoring Rules to view the asset security score calculation rule, as shown in Figure 3.
  Figure 3 Scoring Rule
- Sensitivity Level: Assets are classified into different sensitivity levels to facilitate viewing and management. You can click an asset with risks to view the risk details.
  Figure 4 Sensitivity levels

Risk Statistics

The Security Score, Last Scored, and Rating Details of the asset are displayed. You can click Analyze to update the score.
Figure 5 Security score
- The security score of the asset is displayed. Click next to the Scoring Rules to view the asset security score calculation rule.
- Click Analyze to perform security analysis and scanning cloud and on-premises assets again.
- Click Rating Details to go to the Risks page and view the risk details of each asset. Based on the policy baseline information, click Modify, Enable Now, or Details to handle the risks. You can click Ignore to ignore the configuration policy recommendation or the asset. Ignored assets are not counted in the asset score. For more information about policy baseline configuration, see Configuring Security Baselines.
  Figure 6 Risk details
Hover your cursor over an item in the Risk Statistics area. The sensitive data grading result will be displayed.
Figure 7 Sensitive data identification and leveling result
- You can hover the cursor over an asset category to display the names and scan times of all its scanned assets in the adjacent dialog box.
- Click an asset to view its details in the right-hand dialog box, including basic asset information, sensitive data identification, bucket protection policy analysis or protection policy analysis, and data egress analysis. For details, see Viewing Database Instance Details.

Viewing Database Instance Details

Basic Info: displays the type, port number, version, private IP address, and engine type of the instance.
Sensitive data identification: displays authorized and unauthorized databases in the instance.
- For an authorized database that has not been scanned, click Create identification task to go to the sensitive data identification page and create an identification task to identify sensitive information in the database. For details, see Creating an Identification Task.
- For an authorized database that has been scanned, click Expand to view database scan details.
- For an unauthorized database, click Go to Authorize to obtain the access permission to the database. For details, see Adding and Authorizing Data Assets in DSC.
Figure 8 Sensitive data identification

For OBS data, click View Details to view the Result Details of the sensitive data identification task. If there is no identification result, create an identification task by referring to section Creating an Identification Task and view the identification result again.
Common Read/Write or Protection Policy Analysis:
- Checks whether high-risk permissions, such as server-side encryption, database encryption, transmission encryption, security group, and public network access, are enabled and displays handling notifications. You can click View or Modify to handle the permissions.
- Allows you to view the current status of security configurations, including encryption, backup, and audit, for all assets, along with the specific requirements of the policy baseline. Additionally, you can switch to the policy/task configuration page to configure policies and tasks.
- You can click Ignore to ignore the Configuration Policy Recommendation or Ignore the asset. Ignored assets are not counted in the asset score.
Data Egress Analysis: identifies all cloud and on-premises data egresses, including EIP, NAT Gateway, API Gateway, and ROMA. You can also move the cursor to the data type icon or VPC icon on the asset map to view the data egress gateway lines. You can click Details to view detailed data.
Figure 9 Data egress analysis

Related Operations

If you want to change authorization status of your assets, click Modify in the upper right corner. If you want to stop authorization of your assets, ensure that the assets have no ongoing tasks. DSC will delete your agencies and assets and all related data. Exercise caution when performing this operation. For details, see Allowing or Disallowing Access to Cloud Assets.
Asset sensitivity level legend: Each color represents an asset sensitivity level from L0 to L10.
You can drag the slider on the progress bar to adjust the scale of the asset map.
Click in the lower right corner.
Click in the lower right corner to display the asset map operation guide.
Click in the lower right corner to display the data exception events, so that you can handle the exceptions in time.
Click in the lower right corner to display the asset legend.