Data Security Posture Management (DSPM) For Dummies

• what DSPM is
• why you need DSPM
• what you can do with DSPM
• ten must-have capabilities to look for in a DSPM solution
• how to get started with DSPM

©Deagreez / Adobe Stock

What is DSPM?

A data-centric security strategy emphasizes the importance of protecting your valuable data rather than focusing on systems and infrastructure.

• Global data visibility provides organizations with a comprehensive view of their sensitive data. This involves identifying the location and type of sensitive data to ensure proper protection measures are in place. All clouds — including infrastructure-as-a-service (IaaS), platform-as-service (PaaS), and software-as-a-service (SaaS) resources — need to be covered. The appropriate data owners must also be identified, to facilitate efficient communication of any data-related security or privacy issues.
• Data hygiene is about keeping your data clean and healthy. It encompasses various actions that help organizations maintain clean and organized data in accordance with their data governance framework. This includes addressing and remediating misplaced, redundant, and obsolete data to streamline maintenance, optimize storage resources, and reduce potential security risks. Purging outdated or irrelevant data is another essential part of good data hygiene, resulting in the retention of only accurate and useful data.
• Data security risk control involves immediately detecting and proactively remediating data risk factors to prevent data breaches. This capability detects and addresses three key data postures:
  • Overexposed data, such as public read access, or permissive access rights, which should be identified and mitigated to reduce the likelihood of unauthorized access or data breaches
  • Underprotected data, where there are missing controls like encryption, masking, or proper retention policies
  • Misplaced data, such as cardholder data subject to the Payment Card Industry Data Security Standards (PCI DSS) in an unauthorized environment or PII data in a development environment
• Data access governance manages and controls access to sensitive data. This involves:
  • Identifying all internal and external users, roles, and resources with access to sensitive data
  • Monitoring and controlling access patterns based on their roles and responsibilities
  • Ensuring that only authorized users have access to sensitive assets
  • Regularly reviewing and updating access permissions based on actual usage
• Privacy and compliance ensure that organizations adhere to data privacy regulations and industry standards, and make audits more manageable (and perhaps a little less painful and costly). Providing objective evidence for audits can be challenging, but having reporting from DSPM that shows you know where your data is and understand that its security posture can significantly ease compliance.

Why do you need DSPM?

• Cloud transformation and data democratization: The cloud has enabled widespread data democratization, enabling easy access to data for developers, data scientists, and business users to support their innovation efforts. However, this freedom to access and use data without oversight creates unknown, unmanaged, and unprotected cloud data sources.
• Technology sprawl and complexity: In the public cloud, each cloud service is configured and used differently, and each introduces new and unique risks. The ever-changing architectures are confusing and complex, and if you’re not careful, this can lead to some costly and even devastating mistakes with sensitive data stored in the cloud.
• Cloud data proliferation: Nearly half of all data (48 percent) is stored in the public cloud today, and it’s only increasing, according to the Flexera 2022 State of the Cloud Report. Unfortunately, traditional data security controls are unable to keep up with the dynamic movement of data, so they must be configured from scratch every time data is created, copied, shared, or moved.
• Death of the traditional perimeter: One of the many benefits of the cloud is that it is accessible from anywhere. Thus, the notion of a network perimeter — an on-premises data center protected by a firewall — has all but disappeared. The lack of a single choke point (a firewall) means sensitive data is exposed by design because anyone can access it from anywhere with the proper credentials (whether authorized or stolen).
• Faster rate of change: Release cycles now happen in weeks, days, and hours rather than months and years. Unfortunately, security teams are usually not on that same quick schedule and still rely on slower manual approaches.
• The changing role of security: In cloud computing, data security teams must evolve to securely enable the business rather than just slowing everyone down or letting risk grow exponentially. Data security in cloud computing must focus on protecting data from breaches and compromises while also empowering users to be productive.

What can you do with DSPM?

• Automating data discovery and classification: DSPM helps organizations automatically and continuously discover, classify, and categorize all of their known and unknown data — including sensitive, proprietary, regulated, abandoned, and shadow data — across multicloud environments, such as Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Snowflake, Microsoft 365, and more.
• Enforcing data security policies automatically: DPSM automatically enforces data security policies at scale for all of your data as it travels through the cloud. DSPM converts data policies into specific technical configurations and shows where data security policies are violated. It also prioritizes issues for resolution and helps you fix those issues with clear, specific technical remediation instructions.
• Controlling data exposure: As data rapidly proliferates in the cloud, security does not follow that data, often leading to crucial business data being exposed. DSPM pinpoints all of your exposed sensitive data that can lead to data breaches, ransomware attacks, and noncompliance penalties — whether it’s misplaced data (for example, sensitive data mistakenly stored in public buckets), misconfigured controls (for example, third-party access granted to sensitive data), or overly permissive access.
• Controlling datacentric environment segmentation: DSPM helps you segment your cloud environments and apply location controls to comply with security and regulatory requirements. You can detect and receive alerts when sensitive or regulated data is placed in untrusted and/or unauthorized environments, review violations, and take action to remove the data or authorize the new environment.
• Complying with data privacy and compliance frameworks: DSPM streamlines evidence collection for internal and external privacy and governance stakeholders through autonomous data discovery and classification of your sensitive and regulated data. A DSPM data policy engine continuously enforces regulatory compliance and standards requirements for data, regardless of the underlying technology or location.

Ten must-have capabilities to look for in a DSPM solution

• Autonomous: Automatically discover unknown, new, and modified data stores across all of your clouds — without needing credentials or manual configuration.
• Continuous: Change is constant — especially in the public cloud — so your DSPM solution must be able to continuously monitor your environment for changes and automatically scan new cloud accounts, new data stores, and new data added to existing data stores.
• Secure by design: Look for a solution that doesn’t extract data from your environment. Your DSPM should use the cloud service provider’s (CSP) application programming interface (API) and ephemeral serverless functions in your cloud account to scan your data.
• Breadth and depth of coverage: Whether you’re using Amazon Web Services (AWS), Azure, Google Cloud Platform (GCP), Snowflake, Microsoft 365, or practically any combination of various cloud database, storage services, or software as a service (SaaS) apps, you need a single and consistent view of your data across clouds, geographies, and organizational boundaries to evaluate the risk to your data across all clouds.
• Intelligent classification: Look for a solution that utilizes multistep contextual analysis to automatically identify sensitive data with low false positive (FP) and false negative (FN) rates. The solution should also include hundreds of predefined classification rules, data validators, and classification algorithms that extract the data insights you need without having to locate the data owner.
• Extensive set of built-in datacentric policies: Look for a solution that provides out-of-the-box datacentric policies for common use cases like data security, proper governance, and privacy.
• Customization features: You need a solution with robust customization features that are flexible and powerful enough to match your data taxonomy and address any unique requirements your organization may have such as sensitivity levels/definitions, data types, and custom industry policies.
• Guided remediation: Look for a solution that provides a full analysis of why a security or compliance violation exists, evidence of its existence, and technical recommendations on how to fix it based on policy and environment.
• Simple and quick deployment process: Your DSPM solution should be agentless and connectorless to simplify and accelerate the deployment process. Look for a solution that can be deployed in minutes and delivers time-to-value in a few days.
• Easy integration with your ecosystem: Look for a DSPM solution with extensive integrations that include third-party systems such as IT service management (ITSM), security information and event management (SIEM), cloud security posture management (CSPM), extended detection and response (XDR), and data catalogs.

Getting started