Data Security Posture Management (DSPM)

Data Security Posture Management, or DSPM, is a tool that helps you quickly detect sensitive information stored in Yandex Object Storage buckets and Yandex 360 disks for timely action to protect it through access policies, anonymization, etc.

DSPM has two operating modes: continuous update scanning based on data analysis and regular scanning. The management console provides a separate interface to manage each mode.

Data analysisData analysis

The first stage of DSPM is data analysis. This step automatically detects, identifies, and catalogs resources that may contain sensitive data within a selected environment.

The analysis starts automatically once you enable DSPM when creating or modifying an environment.

The analysis results provide a complete view of data locations across your cloud. Using this information, you can accurately define and add key scan scopes for continuous monitoring.

You can save the data analysis results to a local file or to a Yandex Object Storage bucket.

Continuous scanning of changesContinuous scanning of changes

To start scanning, you need to create a scan scope. A scan scope may include multiple resource groups. For each group, you can choose to scan either all environment resources or select specific targets:

• Clouds in Yandex Cloud.
• Yandex Cloud folders.
• Object Storage buckets.

Optionally, you can configure filters for files within each group:

• Select formats.
• Set minimum and maximum size limits.
• Define a regular expression to target a specific path.

Additionally, you can select data categories for separate searches in text and images.

Once a scan scope is created, DSPM continuously monitors it for new or modified sensitive data, providing ongoing protection.

When you run DSPM for the first time, it performs a full scan of all data stored inside the environment buckets. This may take a while since the scan targets all your data.

Following this initial scan, the module scans only modified or new files. This reduces scanning times and resource usage.

Regular scanningRegular scanning

DSPM detects sensitive information in buckets and disks by scanning data sources. You can run a scan once or on a schedule.

To run scans for sensitive information, use a service account.

To create a scan, the user must have the dspm.editor role for the folder specified in the Security Deck settings as the default storage as well as the iam.serviceAccounts.user role for the service account that will run the scan.

Before you start scanning, select a data source and specify the data categories to search for.

Data sourceData source

A data source contains settings and information about the resources to scan:

• Object Storage buckets
• Yandex Cloud folders
• Yandex Cloud clouds
• Shared Yandex 360 disks
• Shared Yandex 360 folders

When you add folders and clouds to a data source, all buckets of the selected types in your selected clouds and/or folders will be scanned. This includes both the existing buckets and any other buckets added to these clouds and folders by the time of the scan.

You can set the following scan scopes for a data source:

• All files: To scan all files saved in the buckets.

• DOC / TXT: To scan .doc, .docx, and .txt text files.

• XLS / CSV: To scan .xls, .xlsx, and .csv spreadsheet files.

• PPT: To scan .ppt and .pptx presentation files.

• PDF: To scan .pdf document files.

• HTML / XML: To scan .html and .xml files.

• Images: To scan .jpg, .jpeg, .png, .gif, .webp, and .svg image files.

• Custom filter: To scan all files whose names do or do not match the specified patterns:

  • The file name contains: To scan files whose names match the specified pattern.
  • The file name does not contain: To ignore files whose names match the specified pattern.

  Specify the patterns using the RE2 regular expression syntax. You can specify patterns in both fields, in which case the scan will use the AND logic to select files.

You can select multiple filters at the same time; the system will use the OR logic to apply them.

You can add multiple buckets, folders, and/or clouds as well as create multiple resource groups with different scan scope settings in a single data source at once. You can also add a bucket to multiple data sources with different scan scope settings at the same time.

Data categoriesData categories

When creating a new scan, you can select data categories separately for text and images.

You can select all the available categories at once or any combination of them.

Data categories available for scanning:

• In text:
  • Personal data: Full names, email addresses, phone numbers, and social security numbers (SNILS).
  • Financial data: Bank card details.
  • Secrets: Cloud access keys, passwords, tokens, SSH keys, etc.
• On images:
  • Personal data: Full names, email addresses, phone numbers, and social security numbers (SNILS).
  • Financial data: Bank card details.
  • Medical data: Data from medical documents and images.
  • Other: Data from personal documents, including military IDs, pensioner IDs, academic certificates, etc.

To create data sources, set up and run scans, and view scan results, the user must have the appropriate roles.

Useful linksUseful links

• Preparing data for scanning in DSPM
• Creating a DSPM scan