Manage Data Metadata

Learn about how to manage tags, external catalogs, data identification tags, or data classification tags

This section includes guidance for connecting and managing data metadata, which is used by Immuta to identify data targeted by policies.

Entity and classification tags

Tagging your data sources and columns allows you to decouple policy logic from referencing physical tables or columns when authoring a policy. Immuta divides tags into two broad categories: Entity tags, which describe facts about the contents of individual columns in isolation, and classification tags, which describe the sensitive contents of a table with the context of all its columns. In Immuta, entity tags and classification tags are applied automatically to your data by data identification and data classification, respectively.

Identification: entity tags

• Describe content.
• Do not require subjective decisions.
• Don't indicate how sensitive the data is.
• Examples

  • Column ssn has column tag social security number
  • Column l_name has column tag name
  • Column dob has column tags date and date of birth

Classification: classification tags

• Describe sensitivity of content.
• Require subjective decisions about context.
• Indicate the sensitivity level of the data.
• Examples

  • Column ssn has column tag PII
  • Column l_name has column tag sensitive
  • Column dob has column tag indirect identifier

Data identification and classification work together to describe the content of your data and the sensitivity of that data in context. For example, under the HIPAA framework a list of procedures a doctor performed is only considered protected health information (PHI) if it can be associated with the identity of patients. That means that

1. If procedure codes appear in a table that contains patient identity information, those codes are PHI.
2. If procedure codes appear in a table that does not contain any patient identity information, those codes are not PHI.

Since identification (entity tagging) operates on a column-by-column basis, it can’t reason whether or not a column containing procedure codes merits classification as PHI and will not tag procedure codes as PHI. However, classification (classification tags) will tag the column PHI if it detects patient identity information in the other columns of the table.

Classification tags also carry a sensitivity level. For example, identification may tag a column that contains telephone numbers, but that entity tag alone cannot say that the column is sensitive. Instead, classification must determine the sensitivity level using the context of other columns: A phone number associated with a person may be tagged as sensitive, for example, while the publicly-listed phone number of a company would not be tagged sensitive.

Using tags in policies to enforce access controls

Because identification does not contextualize column contents with neighboring columns' contents, using entity tags applied by identification alone prevents you from being able to author scalable policies using higher level classifications like "Tag all PII" or "Mask all columns tagged classified." Pairing identification with classification helps solve this issue. The implement entity and classification section below provides specific guidance for managing and using data metadata in policies, but in general you should

• Use identification to automatically apply entity tags to your data.
• Use classification frameworks to automatically apply classification tags to your data to provide higher-level context.
• Target classification tags in policies to create more scalable and generic policies. For example, instead of building a policy like “Allow access to tables with columns tagged person name and phone number,” build a policy that says “Allow access to tables with columns tagged PII.”

See the Policies page for details about how tags are used to enforce policies.

Implement entity and classification tagging

1

Apply entity tags

There are several options for applying entity tags to data:

1. Identification (recommended): Immuta automatically discovers and tags your sensitive data with entity tags, and you can extend what types of entities are discovered to those specific to your business. This saves the time of identifying your data manually and provides the benefit of a standard taxonomy across all your data sources in Immuta.
2. Tags from an external source: You may have already done all the work tagging your data in some external catalog or your own homegrown tool. If so, you can connect your existing data catalog to Immuta to pull your tags into Immuta. Once the catalog has been connected, Immuta ingests tags from the catalog and applies data source and column tags directly to the registered data source. See the Support matrix for a list of the supported external catalogs.
3. Manually tag: You can manually tag tables and columns in Immuta from within the UI, using the Immuta API, or when registering the data.

2

Use classification frameworks to automatically apply classification tags

Create and activate a classification framework so that Immuta can automatically apply classification tags to your data. To classify your data, Immuta evaluates your data in two phases:

1. Identification runs to identify your data by content type. The data is discovered and evaluated by the identifier it matches and is tagged.
2. After identification applies entity tags, any activated classification frameworks run to apply classification tags. The data is classified by the rules within a framework and the tags currently applied to the column and table. Once the data is classified, it's tagged with special classification tags with additional metadata to denote its sensitivity.

Both phases of classification in Immuta can be customized to find and tag the data your organization cares about. After data is classified, classification tags can be used to build policies or visualize sensitive data access in the audit dashboards.

3

Author policies

Author policies that target classification tags to enforce access controls on your sensitive data.