Sensitive Data Protection through SCC (Virtual Red Teaming)

[ShashankSec]

Now customers that use Sensitive Data Protection discovery and publish the data profiles to Security Command Center, can configure Security Command Center to automatically set the priority value of certain high-value resources by the sensitivity of the data that the resources contain.

To enable data-sensitivity prioritization, customers will need to specify the resources in a resource value configuration. Once enabled, if Sensitive Data Protection discovery classifies the data within a resource as either MEDIUM or HIGH sensitivity, the attack path simulations will, by default, assign a corresponding priority value (MEDIUM or HIGH) to that resource.

What that means for our customer is that SCC’s Virtual Red Teaming will now take the type of data stored by the resource into consideration while running simulations for external attack possibilities resulting in higher Attack Exposure Scores for resources containing high sensitivity data . This saves customers the toil involved in classifying resource priorities according to the sensitivity of the data stored by them.

Understanding Data Sensitivity Levels

The data sensitivity levels are defined by Sensitive Data Protection and can be interpreted as follows:

• High sensitivity data: Sensitive Data Protection discovery has found at least one instance of high-sensitivity data within the resource.
• Medium sensitivity data: Sensitive Data Protection discovery has found at least one instance of medium-sensitivity data, but no high-sensitivity data, within the resource.
• Low sensitivity data: Sensitive Data Protection discovery has not detected any sensitive data, freeform text, or unstructured data within the resource.

Important Considerations

• Resources containing only low-sensitivity data will not be automatically designated as high-value resources. If you require such resources to be included, you can create a duplicate resource value configuration and assign a LOW priority value.
• You have the flexibility to modify the default priority values that SCC assigns when sensitive data is detected..

The following resource types are currently supported for automated data-sensitivity priority value assignment based on Sensitive Data Protection classifications:

Google Cloud:

• bigquery.googleapis.com/Dataset
• sqladmin.googleapis.com/Instance
• storage.googleapis.com/Bucket

AWS:

• Amazon S3 bucket