When engineering teams move their workloads to the cloud, it’s often possible that sensitive data—such as credit card numbers, login credentials, and personally identifiable information (PII)—unintentionally moves to the cloud with them. To secure this data, avoid costly breaches, and meet GRC requirements, these teams often catalog where this data is stored and establish the right controls to limit access. However, as organizations scale up in the cloud, the increasing size and complexity of their environments sometimes results in data being replicated or stored incorrectly, leaving sensitive information vulnerable.
Once you enable Datadog Data Security, now available in private beta, Datadog will automatically pinpoint many types of sensitive data in your Amazon S3 buckets and RDS instances and help you fix security issues affecting these cloud resources. Data Security will also automatically detect new resources as they are spun up, accelerating discovery of unauthorized or non-secure data storage. In this post, we’ll show you how you can use Datadog Data Security to:
Find and review sensitive data quickly
Data Security scans for sensitive data by deploying Agentless scanners in your environment. These scanners use Remote Configuration to retrieve a list of S3 buckets and RDS instances across your infrastructure, as well as their dependencies.
Agentless scanners also continually scan many types of text files—such as CSVs and JSONs—in your S3 buckets and tables in your RDS instances. With Data Security, Datadog will automatically flag when an Agentless scanner discovers a match with any of the rules determined by Sensitive Data Scanner. When a match is found, the location of the match is sent to Datadog by the scanning instance. Data stores and their files are only read in your environment—Data Security does not send sensitive data match content back to Datadog.
In Data Security, you can see what data stores have been scanned, as well as any matches with Sensitive Data Scanner rules that have been found. Data Security first displays the number of matches, along with the types of sensitive data found. For example, the first S3 bucket below has over 25,000 credit card matches.
These insights can help you prioritize what matches to review first. For example, if you are looking to attain or maintain PCI compliance, you may want to first review data stores containing credit card information, like the iac-remediation-bucket resource in the screenshot above.
Clicking on a data store opens up a side panel that lists all files in that data store that contain matches with Sensitive Data Scanner rules. In addition to displaying the number and types of matches found for each file, the side panel shows the location of the first match to help you kickstart your investigation.
This information helps you quickly determine the urgency of investigating a file and what actions you may want to take next. For example, if you notice that a file has multiple credit card matches, this heightens the urgency to investigate. From here, you can click “Inspect in AWS” to pivot to your AWS console, where you can take actions such as viewing matches (starting from the location of the first match), redacting matches, or deleting the file entirely.
Prioritize and fix security issues
Because of the scale and complexity of cloud environments, there might be hundreds of security issues present at any given time—but only a small portion of these may be high priority or urgent. Datadog Data Security surfaces security issues from Cloud Security Management to help you prioritize fixes related to cloud data stores hosting sensitive data. Fixing vulnerabilities in these resources is typically high-priority, as any resulting incidents could put high-value information at risk.
In the screenshot below, for example, the second data store in this list has five security issues, including “S3 buckets should have the ‘Block Public Access’ feature enabled.” Turning on this feature is important to prevent anyone who comes across this S3 bucket from being able to access it and modify its data. If the bucket contains customer credit card information and public access is permitted, any actor could gain access to customer financial data from this bucket—resulting in a costly breach.
To fix this issue, you can click “Investigate” to open this issue in Cloud Security Management, which offers triage, remediation, and incident response capabilities. Fixed issues are easily viewable, allowing you to confirm that the CSM security posture evaluation was successful and the issue is fully resolved.
Sign up for private beta access
Data Security is now available in private beta for AWS cloud environments—you can click here to sign up. To join the beta, you must have:
- Sensitive Data Scanner enabled
- Cloud Security Management enabled
- Amazon S3 buckets and/or RDS instances in your cloud environment
If you don’t already have a Datadog account, you can sign up for a 14-day free trial today.
