Enable sensitive data discovery in the Enterprise tier

This page describes how to enable sensitive data discovery using default settings if you're subscribed to the Enterprise tier and enable Sensitive Data Protection, a separately priced product. You can customize the settings at any time after you enable discovery.

When you enable discovery, Sensitive Data Protection generates Security Command Center findings that show the sensitivity and data risk levels of data across your organization.

For information about how to enable sensitive data discovery regardless of your Security Command Center service tier, see the following pages in the Sensitive Data Protection documentation:

• Publish data profiles to Security Command Center
• Report secrets in environment variables to Security Command Center

How it works

The Sensitive Data Protection discovery service helps you protect data across your organization by identifying where sensitive and high-risk data reside. In Sensitive Data Protection, the service generates data profiles, which provide metrics and insights about your data at various levels of detail. In Security Command Center, the service does the following:

• Generate observation findings in Security Command Center that show the calculated sensitivity and data risk levels of your data. You can use these findings to inform your response when you encounter threats and vulnerabilities related to your data assets. For a list of finding types generated, see Observation findings from the discovery service.

  These findings can inform the automatic designation of high-value resources based on data sensitivity. For more information, see Use discovery insights to identify high-value resources on this page.

• Generate vulnerability findings in Security Command Center when Sensitive Data Protection detects the presence of highly sensitive data that is not protected. For a list of finding types generated, see Vulnerability findings from the Sensitive Data Protection discovery service.

To enable sensitive data discovery for your organization, you create one discovery scan configuration for each supported resource that you want to scan.

Pricing

Sensitive data discovery is charged separately from Security Command Center regardless of your service tier. If you don't purchase a subscription for discovery, you are charged based on your consumption (bytes scanned). For more information, see Discovery pricing in the Sensitive Data Protection documentation.

Before you begin

Complete these tasks before you complete the remaining tasks on this page.

Activate the Security Command Center Enterprise tier

Complete step 1 and step 2 of the setup guide to activate the Security Command Center Enterprise tier. For more information, see Activate the Security Command Center Enterprise tier.

Note: If Security Command Center is activated at the project level only, findings from Sensitive Data Protection won't appear in Security Command Center. To determine the activation level of your Security Command Center instance, see Check the activation level of Security Command Center.

Enable Sensitive Data Protection as an integrated service

If Sensitive Data Protection isn't already enabled as an integrated service, enable it. For more information, see Add a Google Cloud integrated service.

Set up permissions

To get the permissions that you need to configure sensitive data discovery, ask your administrator to grant you the following IAM roles on the organization:

Purpose	Predefined role	Relevant permissions
Create a discovery scan configuration and view data profiles	DLP Administrator (roles/dlp.admin)	dlp.columnDataProfiles.list dlp.fileStoreProfiles.list dlp.inspectTemplates.create dlp.jobs.create dlp.jobs.list dlp.jobTriggers.create dlp.jobTriggers.list dlp.projectDataProfiles.list dlp.tableDataProfiles.list
Create a project to be used as the service agent container^1	Project Creator (roles/resourcemanager.projectCreator)	resourcemanager.organizations.get resourcemanager.projects.create
Grant discovery access^2	One of the following: Organization Administrator (roles/resourcemanager.organizationAdmin) Security Admin (roles/iam.securityAdmin)	resourcemanager.organizations.getIamPolicy resourcemanager.organizations.setIamPolicy

¹ If you don't have the Project Creator (roles/resourcemanager.projectCreator) role, you can still create a scan configuration, but the service agent container that you use must be an existing project.

² If you don't have the Organization Administrator (roles/resourcemanager.organizationAdmin) or Security Admin (roles/iam.securityAdmin) role, you can still create a scan configuration. After you create the scan configuration, someone in your organization who has one of these roles must grant discovery access to the service agent.

For more information about granting roles, see Manage access.

You might also be able to get the required permissions through custom roles or other predefined roles.

Enable discovery with default settings

To enable discovery, you create a discovery configuration for each data source that you want to scan. This procedure lets you create those discovery configurations automatically using default settings. You can customize the settings at any time after you perform this procedure.

If you want to customize the settings from the start, see the following pages instead:

• Profile BigQuery data in an organization or folder
• Profile Cloud SQL data in an organization or folder
• Profile Cloud Storage data in an organization or folder
• Sensitive data discovery for Amazon S3
• Report secrets in environment variables to Security Command Center

To enable discovery with default settings, follow these steps:

1. In the Google Cloud console, go to the Sensitive Data Protection Enable discovery page.

   Go to Enable discovery

2. Verify that you are viewing the organization that you activated Security Command Center on.

3. In the Service agent container field, set the project to be used as a service agent container. Within this project, the system creates a service agent and automatically grants the required discovery permissions to it.

   If you previously used the discovery service for your organization, you might already have a service agent container project that you can reuse.

   • To automatically create a project to use as your service agent container, review the suggested project ID and edit it as needed. Then, click Create. It can take a few minutes for the permissions to be granted to the new project's service agent.
   • To select an existing project, click the Service agent container field and select the project.

4. To review the default settings, click the expand icon.

5. In the Enable discovery section, for each discovery type that you want to enable, click Enable. Enabling a discovery type does the following:

   • BigQuery: Creates a discovery configuration for profiling BigQuery tables across the organization. Sensitive Data Protection starts profiling your BigQuery data and sends the profiles to Security Command Center.
   • Cloud SQL: Creates a discovery configuration for profiling Cloud SQL tables across the organization. Sensitive Data Protection starts creating default connections for each of your Cloud SQL instances. This process can take a few hours. When the default connections are ready, you must give Sensitive Data Protection access to your Cloud SQL instances by updating each connection with the proper database user credentials.
   • Secrets/credentials vulnerabilities: Creates a discovery configuration for detecting and reporting unencrypted secrets in Cloud Run environment variables. Sensitive Data Protection starts scanning your environment variables.
   • Cloud Storage: Creates a discovery configuration for profiling Cloud Storage buckets across the organization. Sensitive Data Protection starts profiling your Cloud Storage data and sends the profiles to Security Command Center.

   • Amazon S3: Creates a discovery configuration for profiling Amazon S3 data across the organization, a single S3 account, or a single bucket.

     Note: This feature requires you to first create an AWS connector that has Sensitive Data Protection permissions.

6. To view the newly created discovery configurations, click Go to discovery configuration.

   If you enabled Cloud SQL discovery, the discovery configuration is created in paused mode with errors indicating the absence of credentials. See Manage connections for use with discovery to grant the required IAM roles to your service agent and to provide database user credentials for each Cloud SQL instance.

7. Close the pane.

From the time Sensitive Data Protection generates the data profiles, it can take up to six hours for the associated findings to appear in Security Command Center.

From the time you turn on secrets discovery in Sensitive Data Protection, it can take up to 12 hours for the initial scan of environment variables to complete and for any Secrets in environment variables findings to appear in Security Command Center. Subsequently, Sensitive Data Protection scans environment variables every 24 hours. In practice, scans can run more frequently than that.

To view the findings generated by Sensitive Data Protection, see Review Sensitive Data Protection findings in the Google Cloud console.

Use discovery insights to identify high-value resources

You can have Security Command Center automatically designate a resource that contains high-sensitivity or medium-sensitivity data as a high-value resource by enabling the Sensitive Data Protection discovery insights option when you create a resource value configuration for the attack path simulation feature.

For high-value resources, Security Command Center provides attack exposure scores and attack path visualizations, which you can use to prioritize the security of your resources that contain sensitive data.

Attack path simulations can automatically set priority values based on data-sensitivity classifications from Sensitive Data Protection discovery for only the following data resource types:

• bigquery.googleapis.com/Dataset
• sqladmin.googleapis.com/Instance
• storage.googleapis.com/Bucket

Customize the scan configurations

After you create the scan configurations, you can customize them. For example, you can do the following:

• Adjust the scan frequencies.
• Specify filters for data assets that you don't want to reprofile.
• Change the inspection template, which defines the information types that Sensitive Data Protection scans for.
• Publish the generated data profiles to other Google Cloud services.
• Change the service agent container.

To customize a scan configuration, follow these steps:

1. Open the scan configuration for editing.

2. Update the settings as needed. For more information about the options on the Edit scan configuration page, see the following pages:

   • Profile BigQuery data in an organization or folder
   • Profile Cloud SQL data in an organization or folder
   • Profile Cloud Storage data in an organization or folder
   • Profile Amazon S3 data
   • Report secrets in environment variables to Security Command Center

What's next

• View Sensitive Data Protection findings