[Music]
welcome to the google cloud security
showcase a special web series where
we'll focus on security use cases that
customers can solve with google cloud
my name is scott ellis and i'm a product
manager at google cloud
today we'll be walking through one of
the top questions we get from customers
how can i discover if i have sensitive
data in my bigquery data warehouse
first why does it matter where sensitive
data exists
well sensitive data such as pii or
personally identifiable information
is the kind of information you really
want to make sure is well protected and
well understood
you want to make sure that this data
exists only where you intend it to exist
maybe in certain geographic regions
and doesn't exist in areas where you do
not want it
and also that you're not collecting or
storing sensitive information that you
don't intend to collect
so again knowing where it exists can
help you address and answer these kind
of questions
and help you increase and improve your
security privacy and compliance posture
automatic dlp for bigquery is a service
that can help you discover classify and
protect your most sensitive data
and this really is about understanding
your data risk
where do you have
examples of maybe low data risk where
there's no evidence of sensitive
information or you have added
protections in place
or where you have moderate or high data
risk where there's highly sensitive data
or
it's highly exposed and automatic dlp
does this by generating rich insights
for each table and column across your
organization
and this includes detailed metrics
about your data including dlp's
predicted info type which is an
indication of the type of data in a
given column or table now when you're
trying to answer the question where do i
have sensitive data
it's really important that you look
across your entire organization
you don't want to just look at the areas
you're aware of but you also want to
make sure you have coverage in the areas
that you may not be aware of an
automatic dlp enables you to profile
data across your entire organization
specific organization folders
or individual projects
and this means that you can cover
every table and column within that scope
so you can get a wide view and
understand where sensitive data exists
across your organization now let's look
at the results
here i have a test organization where we
have turned on automatic dlp
to help us answer the question where do
we have sensitive data and what we see
here on this dashboard is that we
scanned
a lot of data in this case around 205
terabytes of data we have seen a
breakdown in summary of this information
organized by risk as well as type of
data and we can also see the activity in
our organization over the last few
months
here we see
every day new tables being created
picked up and profiled automatically to
make sure that we have coverage and
understand
what kind of data and what kind of risk
we have across our entire organization
the summary view is great but maybe we
want to jump in and look at it from a
different angle
for example maybe we're concerned about
having certain types of sensitive data
in particular geographic regions so here
we're looking at a regional summary
where we have narrowed down to look at
our data workloads that are in our
australia region
and here we can see across
these regions the workloads and the
number of tables that have sensitive
data such as email
name credit card number and other types
of data
and now let's look at another type of
sensitive data
unstructured data now unstructured data
can contain sensitive information
but because it's unstructured it could
even be a higher risk because this is
something again that may not have been
intended to be collected
or it's not consistently collected and
so it's important that we look at this
and investigate it so in this particular
view
we're narrowing down to columns that
have a high free text score which is an
indication that this is an unstructured
column
and contains evidence of sensitive
information
pii such as email address and here we're
seeing the project data set table and
column again in this australia region
where we have this type of sensitive
information
and it's found in a high free text or
unstructured column
enabling automatic dlp
can be done completely in the cloud
console
here i've selected my organization
and by filling out these simple steps we
can turn on
discovery and classification across our
entire organization
here we can configure the conditions on
when to pick up new tables
configure what to look for to make sure
that it meets exactly what
our business needs are
and we can decide what to do with the
output
in this case i can turn on publish to
chronicle in order to automatically send
all of our details and profiles and
metrics
into chronicle to help with our threat
investigations and threat intelligence
additionally we can export a copy of all
of our profile metrics directly into
bigquery for
advanced analytics or if i want to
export this or move it into another
system
and we can turn on alerting with pub sub
for example
maybe i want to alert anytime a new
table is detected that contains either
high data risk or high sensitivity
once i fill out these steps and click
continue
automatic dlp will be configured for my
org
and will help me answer the question
where do i have sensitive data
in my bigquery data warehouse
thank you for tuning in
please visit cloud.google.com
security for more content from google
cloud experts
[Music]
you