Automate Entity and Sensitivity Discovery

Within the Immuta product ecosystem, Immuta Detect is responsible for surfacing and indexing a wide range of security-related events, making it a rich source of data security posture insights.

In a typical deployment, Immuta Detect efficiently surfaces and processes a vast number of data security events. While these events all have security relevance, it may be challenging to understand their potential impacts without manual investigation. At the same time, the sheer volume of events typically greatly exceeds what a team can manually explore.

Enter Immuta Discover: Immuta’s data discovery and security analysis engine can identify, categorize, and classify data. Immuta Discover analyzes data available within the operational context of an event in conjunction with applicable legal, regulatory, compliance, and security frameworks to make deep inferences about the status of the data. For example, in a medical context, Immuta Discover can understand the difference between anonymized and identified medical data.

With additional classification metadata powered by Immuta Discover, Immuta Detect analyzes data security events for sensitivity, ensuring that highly significant events remain highly visible. In the context of the previous example, Immuta Detect can detect and flag the accidental identification of anonymized medical data.

With Discover, Immuta Detect can provide insightful oversight of who accesses sensitive data, where it is stored, and how it is used, enabling

• Rapid and exact compliance monitoring and assessment

• Insights into data usage patterns for setting data access policy

• Simplified and expedient audit responses

• Context-aware analysis of data flows as seen through the lens of security or regulatory compliance frameworks

The discovery process

Immuta Discover works in three phases: identification, categorization, and classification.

Phase 1: identification

In the first phase, data is identified by its kind – for example, a name or an age. This identification can be manually performed, externally provided, or automatically determined by Immuta Discover through column-level analysis. This is commonly termed entity identification.

Phase 2: categorization

In the second phase, data is categorized in the context where it appears, subject to any active data compliance or security frameworks. For example, a record occurring in a clinical context containing both a name and individual health entities is Protected Health Information under HIPAA.

Use frameworks to implement organization-specific compliance categories or other relevant high-level regulatory and compliance frameworks, such as those for categorizing data into categories defined under CCPA, GDPR, GLBA, HIPAA, etc. Think of categorization as a way to apply higher level categories to the fine-grained entities discovered in phase 1 through rules you can customize. These categories are presented as tags in Immuta, just like the entities in phase 1 and, thus, can be used for Immuta policies.

Phase 3: classification

In the third and final phase, data is classified according to its sensitivity level (e.g., Customer Financial Data is Highly Sensitive). Just like how categories are built from phase 1 entities, classification builds on the phase 2 categories. Customize this classification under your respective views and organizational needs. These classifications are key to surfacing sensitive queries in Detect based on your definition of sensitive.

Why automate?

There are good reasons to automate data discovery and analysis with Immuta Discover:

1. It formalizes the entire process, producing a coherent set of classification rules.

2. It makes it possible to automatically and uniformly scale compliance to new data sources.

3. It enables Immuta Detect to automatically detect additional threats, such as unauthorized or attempted access to sensitive data, and for soft enforcement of organizational data access policies. (For example, that access to personal information, direct identifiers, or login credentials be masked.)

4. Speed. Automating data discovery and analysis with Immuta Discover enables faster access to data by removing the manual effort of tagging and classifying new tables and columns.

Considerations for automated discovery

Be aware that

• Some customization may be necessary. Although Immuta's sensitive data discovery discovers over 60 types of sensitive data, only some data elements may be relevant. Further, unique sensitive data elements may not be covered out of the box. In these cases, it is possible to create new sensitive data discovery identifiers to ensure data is properly discovered and tagged.

• New global identification frameworks should be created to find only entities that are relevant to the organization. This will ensure extraneous tags are not added to data elements.

• Some customers may already have an existing data catalog tagging data; Immuta’s sensitive data discovery can work in combination with the data catalog.

• Because data environments are not static, it is imperative that data tagging is automatically performed with new or changed data so that policies can be enabled in real-time, lowering the risk of data leaks.

Existing enterprise data catalog

Many organizations have invested in an enterprise data catalog as part of their data governance programs. Entity tags from the data catalogs will be pulled into Immuta in a one-way sync because the catalog is the system of record for entity tags. The tags pulled in from the data catalog can later be mapped to categories in the same way that entities automatically discovered in phase 1 are mapped to categories. This in turn will associate the appropriate sensitivity via classification to the external tags.

For a concrete example, consider a scenario where the Collibra catalog has tags for Longitude and Latitude. The following example framework rule assigns Immuta Framework.Longitude to any column tagged Collibra.Location.Longitude.

{
  "classificationTag": {
    "name": "Immuta Framework.Longitude",
    "source": "curated",
    "description": "Represents a longitude."
  },
  "columnTags": [
    {
      "name": "Collibra.Location.Longitude",
      "source": "collibra"
    }
  ],
  "neighborColumnTags": [],
  "tableTags": []
}

Incorporating tags from external catalog rules is fairly straightforward. External tags are referenced in rules, except the source field identifies the external catalog. The source field generally varies depending on the external catalog system. The correct value for the field may be identified by examining tag objects listed with the tags API, which includes the source field.

To do this, see the How to use a classification framework with your own tags guide.