SPEAKER 1: Credit card numbers, birth dates,
phone numbers, names, addresses, passport numbers--
what do they all have in common?
Cloud DLP can protect them all.
How does it do it?
Stay tuned to find out.
So by now, you know that de-identification
can be accomplished with a few different techniques,
each with their own benefits and features.
But you might wonder, how does DLP know what's what?
How does it know when it's spotted a phone
number, for instance, in the data processes,
and how sure is it?
When DLP inspects data, the results for any matches
include a certainty score that we call the likelihood.
The likelihood can be one of five scores that
range from very unlikely to very likely.
Likelihood is important, because it
lets you fine tune the scope of your de-identification,
and weed out potential false positives
by setting a confidence threshold based on likelihood.
How is likelihood determined?
Well, for each of the 120 built-in infotypes,
this score is determined differently,
depending on the corresponding infotype detector.
That's the detection mechanism that matches
on a certain set of criteria.
This criteria could include pattern matching or checksum.
It can even consider the surrounding context
that can be identified in the data
around the potential match.
Time for an example.
Take a look at this string.
What do you think we're looking at here?
Well, it could be a job title, followed by an arbitrary
identification number.
On the other hand, it could also be a person's name and a phone
number.
When we run this through a DLP inspection job, as expected,
we can get two infotype matches.
Kitty Walker is identified as the infotype person name,
with a Likelihood score of likely.
And the 10 digit number got matched to phone number
with a Likelihood score of possible.
Now, let's take a look at the same data
with some positive context mixed in.
For us, it's a lot more obvious what we're looking at.
And similarly, Cloud DLP considers the context
surrounding the data, and the Likelihood score
jumped to very likely for both person name and phone number.
DLP's use of context makes it especially
effective for conversational text and transcripts.
Once data is inspected and classified
by infotype and likelihood, DLP can then
apply de-identification.
So let's talk about one of the most basic forms
of de-identification--
redaction.
What's redaction?
When working with text, redaction completely
removes the sensitive values from your data without a trace.
Poof.
It leaves no clue as to what was removed.
Let's see how the DLP API handles redaction
by looking at a request from a Node.js app.
When we use a DLP API to inspect content,
we construct a request object that looks like this.
In the request, we of course specify the item
that we want to scan.
We also provide an inspection configuration
that configures the scanning process.
Here, we can limit the scope by providing a likelihood
threshold or any particular infotypes
that we might want to limit our scan to.
Next, there's a de-identification
configuration.
This is where we specify that, with each match,
we want to de-identify it with redaction.
The response we get for this request will
have the transform data in an overview that includes
a summary of the inspection and transformation
for each infotype found.
For text, redaction is one of the most simplest forms
of de-identification, because it leaves
no trace of what was removed.
The same concept can be applied to images
using image redaction.
In this case, DLP uses optical character recognition
to find potential text in an image
and overlays an opaque bar over any suspected sensitive values.
Let's take a look at another Node.js request,
this time for this image.
The request object is a bit different this time.
We, once again, provide an inspection configuration
where we can indicate likelihood and infotypes.
We have the option of passing redaction configuration options
here.
But by default, it'll just place a black bar only on the text
that it matches.
And finally, we provide the image converted to a string,
along with the file type.
The response here will be a new image, this time with bars
covering the redacted data.
Boom.
Our image has successfully been de-identified,
thanks to image redaction.
So whether you're working with text or images,
redaction is the way to go when you
want to totally and completely remove those sensitive values
from your data.
Although data identification redaction is powerful,
I did mention that it's one of the most simplest forms
of de-identification.
Next time, we'll take a look at a more complex technique
and talk about de-identification using
crypto-based tokenization.
See you then.
[MUSIC PLAYING]