[MUSIC PLAYING]
A.T. MCWILLIAMS: AT here.
I'm a program manager on the Google for Education Team.
You may have seen me on the EDU in 90 series.
HEATHER CROSS: So glad you could join us, AT.
So in today's episode, we're going
to talk about a critical part of any business, protection
and management of data.
And mismanagement of sensitive information
can come at all costs.
A.T. MCWILLIAMS: The challenge is
how to protect sensitive data while still being
able to use it for important business functions,
like running analytics or customer support operations.
HEATHER CROSS: Well, we've got an answer for this, Cloud Data
Loss Prevention API.
We'll also run through a quick demo of the self-paced lab
where we'll set up a DLP API and use
it to inspect a string of data for sensitive information.
A.T. MCWILLIAMS: So when it comes to properly handling
sensitive data, the first step is knowing where it exists.
Well, the DLP API uses a variety of techniques
to identify sensitive data like credit card
numbers, social security numbers, names,
and other forms of personally identifiable information.
In addition to identifying sensitive data within text
content, the API can detect and classify sensitive data
within standard bitmap images too.
HEATHER CROSS: Applying the API to tech streams
allows you to automatically redact
or censor any sensitive data before it writes to disk,
generates logs, or is used to perform analysis tasks.
Identifying sensitive data upfront
also allows you to choose the most suitable storage system
and appropriate access controls for that data.
The DLP API classifies raw data by using
a set of predefined detectors to identify patterns, formats,
and checksums.
The API can even understand contextual clues.
A.T. MCWILLIAMS: Once you know where your sensitive data
lives, the API gives you the option to deidentify that data.
So what does that mean?
Deidentifying data removes identifying information
from a dataset, making it more difficult to associate
the remaining data with an individual
and reducing the risk of exposure.
The resulting data is then suitable for apps, storage,
or analysis.
HEATHER CROSS: Redaction removes entire values or entire records
from a dataset.
Partial masking hides parts of the data,
leaving some data visible--
for example, the last seven digits
of a US telephone number.
A.T. MCWILLIAMS: Tokenization, or secure hashing,
replaces sensitive data with a key.
This is often used in credit card processing.
Dynamic data masking applies deidentification and masking
techniques in real time.
This can be useful if you don't want to alter your underlying
data but want to mask it when viewed by certain users.
Special access privileges could be
applied for those who need to view it,
say HR or a finance team.
HEATHER CROSS: The DLP API integrates with many
of our other GCP services too.
Cloud Functions can help you automate
the classification of data that's
uploaded to Cloud Storage.
Also, there's a built-in support for scanning and classifying
sensitive data and Cloud Storage, Cloud Datastore,
and BigQuery.
Cloud Pub/Sub notifications can be generated in response
to a completed inspection jobs.
We then created a service account
to access the Google Cloud APIs when testing locally
and gave the service account the required permissions.
We then generated a service account key.
So first, we create a JSON file with sensitive information.
In this case, it's a phone number.
We authenticate to our service account,
passing the location of the service account key file,
and obtain an authorization token
using the service account.
We can then use the curl command to inspect the JSON
file for sensitive information.
And the response shows that the phone number was found
with a likelihood of likely.
We can also redact sensitive information.
We create a second JSON file, this time
with a sensitive email address.
We can then use the curl command to deidentify the JSON
file for sensitive information.
We can see the response that the email
address has been replaced.
A.T. MCWILLIAMS: Well, that's the end of another episode.
We hope you enjoyed it.
If you've got some great examples
of how you've been able to apply this API,
please share it with us.
HEATHER CROSS: And make sure to check out
the link where you can apply what you've learned today
and use a $300 free trial credit at Google Cloud platform here.
A.T. MCWILLIAMS: All of our additional training resources
are linked below.
Thanks for watching.
See you soon.
[MUSIC PLAYING]