Managing Sensitive Data Discovery Tasks

Adding a Sensitive Data Discovery Task

1. Logging in to the Database Operations and Maintenance Management System using the sysadmin system administrator account.
2. Select Ops Asset Management > Ops Asset Control from the left navigation pane to load the asset control list page.
3. Select an existing Ops asset control entry and click the Config button, which opens a new browser tab.
4. Select Sensitive Data Discovery to display the list of sensitive data discovery tasks.
   Figure 1 ensitive data discovery
   

5. Click the Add Discover Task button to redirect to the New Task page.
6. Enter the discovery task name and remarks. (Task names under the same asset control cannot be duplicated.)
7. Click Next to navigate to the Select Data Source page.
8. Select one or more schemas, tick the target tables within the selected schemas for discovery, and click Next to proceed to the Configure Rules page.
9. Select the sampling mode as sequential sampling and set the maximum sampling count (default: 1,000 records, adjustable manually; actual data volume applies if fewer than 1,000 entries exist). Configure the matching threshold: this threshold serves as a judging criterion. When the ratio of records matching any discovery rule of a specific data domain to valid sampled records exceeds the configured threshold (system default: 50%, configurable), the corresponding field will be tagged under that data domain.
10. Add sensitive types: Click the Add Sensitive Types button to display all data domains bound to the current Ops asset control along with their default discovery rules, which can be modified manually. Check required data domains.
11. Click the OK button to save the discovery task.

    Table 1 Table1 Adding sensitive data discovery task input parameter description

    Parameter	Description
    Discovery Task Name	Name of the discovery task specified during creation and saving. (Required)
    Notes	Supplementary comments and additional information for the task.
    Schema	Schema(s) from the data source; multiple schemas can be configured.
    Table	Target tables to run discovery in the task; multiple-table selection is supported.
    Sampling Method	Sequential sampling is adopted for data discovery.
    Maximum Sampling Number	Total volume of sampled data for discovery. If the configured value exceeds the total table data volume, the actual table record count shall prevail.
    Matching Rate	Judgment threshold. A field will be labeled with the corresponding data domain when the proportion of records matching any discovery rule of the data domain against valid sampled data exceeds this ratio.
    Sensitive Type	Namely data domain type. After selection, data will be checked against the default discovery rules of the corresponding data domain.

Related Operations

You can perform the following operations on the Sensitive Data Discovery page as required:

• Edit: Select a Sensitive Data Discovery task and click Edit to modify and save task information as needed.
• Discover: Select a Sensitive Data Discovery task and click Discover to start sensitive data scanning. The page automatically redirects to the monitoring page for checking real-time task progress.
• Monitor: Select a Sensitive Data Discovery task and click Monitor to switch to the monitoring page, where you can view the execution status of running or finished tasks.
• Stop: Select an in-progress sensitive data discovery task and click Stop. The system forcibly terminates the task, and no execution result will be generated for stopped tasks.
• Intelligent Discovery: Select a Sensitive Data Discovery task, click More > Intelligent Discovery, pick a discovery version and click Intelligent Discovery to launch incremental sensitive data scanning. The page automatically jumps to the monitoring page to view task status. Intelligent discovery performs incremental scanning based on results of the selected historical discovery version.
• View History: Select a Sensitive Data Discovery task, click More > View History to check discrepancies of collation results across different discovery versions. Refer to Viewing History for detailed operations.
• View Result: Select a Sensitive Data Discovery task, click More > View Result to open the page displaying task execution outcomes. Refer to Viewing Results for operation details.
• Delete: Select a Sensitive Data Discovery task, click More > Delete to remove the target task.

• Intelligent Discovery mainly avoids repeated discovery and collation of sensitive data during scanning, so as to reduce relevant redundant workload to the greatest extent.
• As mentioned earlier in the function of sorting discovery results and saving discovery versions, some fields have been identified and tagged as sensitive fields and stored in specific versions. Intelligent Discovery delivers the following effect: fields already confirmed as sensitive data will not be repeatedly scanned again. An application example is provided to further elaborate on this feature: during phone number identification, certain system code fields may be incorrectly labeled as phone numbers. Intelligent Discovery can fix such exceptions. First, reset the matching rules for mislabeled fields in batches and save the modified configuration as a new version. Afterwards, subsequent tasks launched via Intelligent Discovery will no longer mark these fields as phone numbers.
• Incremental Discovery is a best practice summarized from practical project implementation to address two common real-world issues:
  • Sensitive data changes dynamically. Specifically, the scope of sensitive data defined by laws and regulations may be adjusted, and enterprises may add or delete sensitive data definitions due to business development requirements.
  • Certain types of data share similar features, making it difficult to set identification priorities during sensitive data discovery. For example, system codes may conform to the same matching rules as mobile phone numbers, an issue that can be efficiently resolved by incremental discovery.
  • Take the first scenario as an example: phone numbers were not previously categorized as sensitive data by applicable laws and regulations, whereas contact information has recently been added to the sensitive data catalogue. A full-scale rediscovery would require complete repeated collation of all data; incremental discovery is therefore required to streamline this process.
  • Combined with the intelligent discovery function, the operating procedures for incremental discovery are as follows: first edit the discovery task to add newly-included data domains (sensitive types) and tables to the task scope, then click Intelligent Discovery and select a previously finalized version. The system directly inherits verified data domain configurations of already-collated fields into new discovery results, while performing incremental scanning only on newly appended data domains and tables.