DSPM Classification Management Overview

Introduction

Classification management is the systematic process of organizing data into specific categories based on predefined criteria such as sensitivity, type, regulatory compliance, usage, and/or other categories useful to the business. Strong classification management practices within your organization are essential for several reasons:

• Data security: Implement security measures to protect against unauthorized access and potential by classifying data by its severity and importance.
• Regulatory compliance: Comply with key regulations by ensuring sensitive data is handled according to legal and industry standards, such as HIPAA.
• Risk management: Identify critical data types and apply stringent protections to reduce the risk of data loss or exposure.
• Efficiency and cost savings: Reduce storage and backup costs by eliminating redundant data and streamlining the search and retrieval process for more efficient data management.
• Data lifecycle management: Ensure data at each stage is managed (eg. stored, accessed, shared, archived, and deleted) according to its classification level.
• Data accessibility and retrieval: Make finding and retrieving essential data easier, particularly important for legal discovery and responding to information requests.
• Data protection policies: Provide a clear understanding of data sensitivity and necessary controls to drive effective data protection policies and data loss prevention strategies.

Read on to learn how Netskope DSPM handles data sampling and classification, including built-in and custom Entity Data Type (EDT) classifiers, confidence scoring, built-in and custom data tags, and possible use cases.

How Netskope DSPM Classifies Data

Netskope DSPM samples data from scanned data stores to identify and classify sensitive data. Across data types, classification is based on a combination of heuristic signals, including but not limited to:

• Keywords
• Field or file names
• Field or file content
• Dictionaries
• Proximity
• Query logs
• Regex
• Checksums

Sampling for Structured Data

Netskope DSPM’s default sampling and classification process for structured data involves obtaining 50 non-null samples from each data store field and matching them against the heuristic signals described above. Thus, the process determines whether the field contains sensitive data, its type and sensitivity level, and the resulting confidence score. This approach is fully configurable, as you can determine the scan frequency and schedule when connecting the data store. Sampling does not impact data store performance. 

Sampling for Unstructured Data

In addition to scan frequency, sampling rate, defined as the percentage of files in a bucket Netskope DSPM receives per scan, can be specified for unstructured data when connecting the data store. Sampling then works at the file level, matching your scanned files against relevant heuristic signals and determining if the file contains sensitive data, its type and sensitivity level, and resulting confidence score. This approach is fully configurable, as you can determine scan frequency, schedule, and sampling rate when connecting the data store. Sampling does not impact data store performance. 

Read more about customizing the sampling rate when connecting AWS S3 and Google Cloud Storage unstructured data stores.

Supported File Types for Unstructured Data Store Scanning

DSPM now supports all file types supported by the DLP appliance:

Entity Data Types

Netskope DSPM uses the built-in Entity Data Type classifiers and categories from DLP to classify sensitive data. DSPM supports all DLP entities (approximately 3,000 to 4,000), removing the previous limitation of 50 data types. Click each of the category tabs below for the full list, description, and default sensitivity level of classifiers.

Leverage direct and indirect identifier Entity Data Types to drive GDPR and CCPA compliance.

Customization

Netskope DSPM’s classification process described above can be fully adapted to meet your organization’s needs with customizable tags, sensitivity levels, scan frequency, scheduling, and sampling rates, including custom regex and context words to improve classification accuracy. 

Read more about using the DLP Profiles and Rules to create and manage custom classification definitions specific to your organization.

Confidence Scoring

Each identified Entity Data Type has an associated confidence score on the Classification Management page.

Confidence scoring represents the likelihood that the field or file contains the Entity Data Type predicted by Netskope DSPM. Specifically, it measures how strongly the field or file matches the assigned Entity Data Type. This is calculated based on several signals, including data patterns, domain-specific validation, metadata, and more. The confidence score increases as these features produce more matches against our trained classifier model. We recommend utilizing the confidence score while evaluating your classification results to determine false positives and negatives.

If you manually-mark a field as reviewed, the confidence score will be set to 100%, as the application will assume your review take precedence over any scoring the system may perform.

Additional Documentation

To learn more about how to fully utilize our Classification capabilities, please read the articles below:

Using the Classification Management Page

Data Tags

Object-Level Tagging