When engineering teams move their workloads to the cloud, it’s often possible that sensitive data—such as credit card numbers, login credentials, and personally identifiable information (PII)—unintentionally moves to the cloud with them. To secure this data, avoid costly breaches, and meet GRC requirements, these teams often catalog where this data is stored and establish the right controls to limit access. However, as organizations scale up in the cloud, the increasing size and complexity of their environments sometimes results in data being replicated or stored incorrectly, leaving sensitive information vulnerable.
Once you enable Datadog Sensitive Data Scanner (SDS), now in limited availability, Datadog will automatically pinpoint many types of sensitive data in your Amazon S3 buckets and RDS instances and help you fix security issues affecting these cloud resources. SDS will also automatically detect new resources as they are spun up, accelerating discovery of unauthorized or non-secure data storage. In this post, we’ll show you how you can use SDS to:
Find and review sensitive data quickly
SDS scans for sensitive data by deploying Agentless scanners in your environment. These scanners use Remote Configuration to retrieve a list of S3 buckets and RDS instances across your infrastructure, as well as their dependencies.
Agentless scanners also continually scan many types of text files—such as CSVs and JSONs—in your S3 buckets and tables in your RDS instances. Sensitive Data Scanner will automatically flag when an Agentless scanner discovers a match with any of the the SDS library rules. When a match is found, the location of the match is sent to Datadog by the scanning instance. Data stores and their files are only read in your environment—Sensitive Data Scanner does not send sensitive data match content back to Datadog.
In SDS, you can see what data stores have been scanned, as well as any matches with its included rules that have been found. SDS first displays the number of matches, along with the types of sensitive data found.
These insights can help you prioritize what matches to review first. For example, if you are looking to attain or maintain HIPAA compliance, you may want to first review data stores containing personally identifiable information (PII).
Clicking on a data store opens up a side panel that lists all files in that data store that contain matches with Sensitive Data Scanner rules. In addition to displaying the number and types of matches found for each file, the side panel shows the location of the first match to help you kickstart your investigation.
This information helps you quickly determine the urgency of investigating a file and what actions you may want to take next. For example, if you notice that a file has multiple credit card matches, this heightens the urgency to investigate. From here, you can click “Inspect in AWS” to pivot to your AWS console, where you can take actions such as viewing matches (starting from the location of the first match), redacting matches, or deleting the file entirely.
Prioritize and fix security issues
Because of the scale and complexity of cloud environments, there might be hundreds of security issues present at any given time—but only a small portion of these may be high priority or urgent. Sensitive Data Scanner surfaces security issues from Cloud Security Management to help you prioritize fixes related to cloud data stores hosting sensitive data. Fixing vulnerabilities in these resources is typically high-priority, as any resulting incidents could put high-value information at risk.
In the screenshot below, for example, one of the data stores in this list has several security issues, including “S3 buckets should have the ‘Block Public Access’ feature enabled.” Turning on this feature is important to prevent anyone who comes across this S3 bucket from being able to access it and modify its data. If the bucket contains customer credit card information and public access is permitted, any actor could gain access to customer financial data from this bucket—resulting in a costly breach.
To fix this issue, you can click “Investigate” to open this issue in Cloud Security Management, which offers triage, remediation, and incident response capabilities. Fixed issues are easily viewable, allowing you to confirm that the CSM security posture evaluation was successful and the issue is fully resolved.
Sign up for limited availability access
Cloud storage scanning in SDS is now available in limited availability for AWS cloud environments—you can click here to sign up. To join, you must have:
- Sensitive Data Scanner enabled
- Amazon S3 buckets and/or RDS instances in your cloud environment
If you don’t already have a Datadog account, you can sign up for a 14-day free trial today.
