Data Classification and Sensitivity Handling Questions

Clarify goals & constraints

• Classify sensitive data (PII, PHI, IP) across on‑prem RDBMS, file shares, and multi‑cloud object stores with automated labeling, integration into DLP/IAM/KMS, low performance impact, and auditable provenance.

High‑level architecture / components

• Scanner fleet: lightweight agents for on‑prem, serverless scanners for cloud, central orchestration service.
• Classification engine: rules + ML models (NER, regex, entropy) hosted centrally.
• Metadata catalog: centralized metadata store (object tags, DB columns, CMDB entries).
• Integration layers: connectors to IAM, DLP, KMS, SIEM, ticketing.
• Policy manager & UI for exceptions/feedback.

Scanning & labeling techniques

• Use hybrid approach: deterministic (regex, dictionary, checksum) + probabilistic ML (NER, contextual embeddings) per data type.
• DBs: column profiling using JDBC with sampling, schema inference.
• File servers: content and filename scanning, hash-based de‑duplication.
• Object stores: event-driven scans on PUT + periodic full scans.

IAM / DLP / KMS integrations

• IAM: map sensitivity to roles/attributes for fine‑grained access controls (ABAC). Push tags into IAM policies.
• DLP: feed labels and confidence scores to enforce blocking/alerting workflows.
• KMS: auto‑apply encryption scopes (envelope encryption) based on classifications; rotate/bring‑your‑own keys for high sensitivity.

Metadata propagation & provenance

• Write labels as immutable metadata: object tags, DB extended properties, file system ACL attributes, and catalog entries.
• Store provenance (scanner id, rule/model, confidence, timestamp) in catalog for audit.

False positives & feedback loop

• Provide analyst UI for review and correction; store labeled ground truth to retrain models.
• Confidence thresholds with quarantine workflows; human review for high‑impact actions.
• Rate limit enforcement to avoid operational disruption.

Operational rollout

1. Pilot on low‑risk dataset; validate detection & FP rates.
2. Tune rules/models; integrate with DLP and KMS in monitor mode.
3. Phased expansion by business unit; add automation for enforcement gradually.
4. Full production: enforce policies, continuous monitoring, periodic retraining, compliance reporting.

Trade‑offs

• Sampling vs full scan (cost/perf), deterministic vs ML (explainability), on‑agent vs network scanning (coverage vs latency).

Definition
Data classification is the process of categorizing data by sensitivity and business value (e.g., Public, Internal, Confidential, Restricted) to drive protection, handling, and lifecycle decisions.

Ownership & Governance

• Data owners: business unit leads (accountable for classification decisions).
• Data stewards: implementers (cataloguing, tagging).
• Central Data Governance Board: policy, taxonomy, exceptions approval, periodic reviews.

Mapping classifications → controls

• Public: no encryption required, standard retention.
• Internal: at-rest encryption, role-based access.
• Confidential: strong encryption (TLS + AES-256 at rest), MFA, DLP, stricter retention and audit.
• Restricted: HSM-managed keys, strict separation of duties, limited retention, privileged access logging.

Enforcement points

• API gateway: validate classification headers, inject policy decisions, deny/transform requests.
• Storage: metadata tags, encryption policies enforced by CSP IAM, automated quarantine.
• Messaging/Queue: end-to-end encryption, tag-based routing, redaction for lower tiers.
• Endpoint & DLP: prevent exfiltration, enforce watermarking.

Reclassification & Exceptions

• Reclassification flow: request → impact assessment by owner/steward → update metadata, propagate to controls, re-encrypt/retag if needed → audit log.
• Exceptions: time-boxed approvals by Governance Board with compensating controls (additional monitoring, segmentation), logged and reviewed.

Operational practices

• Automate tagging, scanning, and policy enforcement; integrate classification into CI/CD, data discovery, and IAM. Measure via coverage, incidents, and audit findings.