Introduction

Classification management is the systematic process of organizing data into specific categories based on predefined criteria such as sensitivity, type, regulatory compliance, usage, and/or other categories useful to the business. Strong classification management practices within your organization are essential for several reasons:

• Data security: Implement security measures to protect against unauthorized access and potential by classifying data by its severity and importance.
• Regulatory compliance: Comply with key regulations by ensuring sensitive data is handled according to legal and industry standards, such as HIPAA.
• Risk management: Identify critical data types and apply stringent protections to reduce the risk of data loss or exposure.
• Efficiency and cost savings: Reduce storage and backup costs by eliminating redundant data and streamlining the search and retrieval process for more efficient data management.
• Data lifecycle management: Ensure data at each stage is managed (eg. stored, accessed, shared, archived, and deleted) according to its classification level.
• Data accessibility and retrieval: Make finding and retrieving essential data easier, particularly important for legal discovery and responding to information requests.
• Data protection policies: Provide a clear understanding of data sensitivity and necessary controls to drive effective data protection policies and data loss prevention strategies.

Read on to learn how Netskope One DSPM handles data sampling and classification, including built-in and custom sensitive data type (SDT) classifiers, confidence scoring, built-in and custom data tags, and possible use cases.

How Netskope One DSPM Classifies Data

Netskope One DSPM samples data from scanned data stores to identify and classify sensitive data. Across data types, classification is based on a combination of heuristic signals, including but not limited to:

• Keywords
• Field or file names
• Field or file content
• Dictionaries
• Proximity
• Query logs
• Regex
• Checksums

Sampling for Structured Data

Netskope One DSPM's default sampling and classification process for structured data involves obtaining 50 non-null samples from each data store field and matching them against the heuristic signals described above. Thus, the process determines whether the field contains sensitive data, its type and sensitivity level, and the resulting confidence score. This approach is fully configurable, as you can determine the scan frequency and schedule when connecting the data store. Sampling does not impact data store performance. 

Sampling for Unstructured Data

In addition to scan frequency, sampling rate, defined as the percentage of files in a bucket Netskope One DSPM receives per scan, can be specified for unstructured data when connecting the data store. Sampling then works at the file level, matching your scanned files against relevant heuristic signals and determining if the file contains sensitive data, its type and sensitivity level, and resulting confidence score. This approach is fully configurable, as you can determine scan frequency, schedule, and sampling rate when connecting the data store. Sampling does not impact data store performance. 

Read more about customizing the sampling rate when connecting AWS S3 and Google Cloud Storage unstructured data stores.

Supported File Types for Unstructured Data Store Scanning

Sensitive Data Types

Netskope One DSPM uses the following built-in Sensitive Data Type classifiers and categories to classify sensitive data. Click each of the category tabs below for the full list, description, and default sensitivity level of classifiers.

Leverage direct and indirect identifier Sensitive Data Types to drive GDPR and CCPA compliance. 

Leverage financial information Sensitive Data Types to drive PCI DSS and SOX compliance.

Leverage health information Sensitive Data Types to drive HIPAA and FERPA compliance.

Leverage credentials Sensitive Data Types to mitigate risk for data breaches.

Customization

Netskope One DSPM's classification process described above can be fully adapted to meet your organization's needs with customizable tags, sensitivity levels, scan frequency, scheduling, and sampling rates, including custom regex and context words to improve classification accuracy. 

Read more about using Custom Sensitive Data Types to classify and protect sensitive data types specific to your organization.

Confidence Scoring

Each identified Sensitive Data Type has an associated confidence score on the Classification Management page.

Confidence scoring represents the likelihood that the field or file contains the Sensitive Data Type predicted by Netskope One DSPM. Specifically, it measures how strongly the field or file matches the assigned Sensitive Data Type. This is calculated based on several signals, including data patterns, domain-specific validation, metadata, and more. The confidence score increases as these features produce more matches against our trained classifier model. We recommend utilizing the confidence score while evaluating your classification results to determine false positives and negatives.

If you manually-mark a field as reviewed, the confidence score will be set to 100%, as the application will assume your review take precedence over any scoring the system may perform.

Additional Documentation

To learn more about how to fully utilize our Classification capabilities, please read the articles below:

Using the Classification Management Page

Data Tags

Object-Level Tagging

Creating a Custom Sensitive Data Type

Managing Custom Sensitive Data Types

Using Regular Expressions in Custom Sensitive Data Types

Using Data Dictionaries in Custom Sensitive Data Types