DBSEC-Provides professional data security products and data security governance services.

Background

With the development of digital economy, cross-border data flow has become the core and hot topic of politics, economy and society. The European Union and APEC have published GDPR and CBPRs, respectively, to standarize the cross-border data transmission. In China, data are transmitted frequently across transnational enterprises and local enterprises who operating internationally. Therefore, government attaches great importance to the security of cross-border data transfer. In this context, the Cyber Security Law requires data exit security assessment as a must for enterprises. And on this basis, made Personal information and important data exit security assessment measures and Information security technology data exit security assessment guidelines as administrative regulations and national standards, respectively, together with the Cyber Security Law, constitute China's current data exit security assessment system.

Security Challenges

Compliance Challenge

With the frequent occurrence of network and data security events, such as Snowden Event, PRISM Event, Google Ireland Event, countries attach great importance to data exit security and continuously strengthen data exit management system, posing new challenges to enterprise data exit security compliance.

Article 37 of the Cyber Security Law says, “the operators of key information infrastructure”and “the general network operators”, contains the network owner, manager and service provider, which means the vast majority of enterprises who engaged in network operations need to apply for security assessment when individual information and important data are involved.

Personal information and important data exit security assessment measures defines the data exist as, provides personal information and important data that collected and generated in the process of network operating in China to overseas institutions, organizations and individuals. According to the definition, some special scenarios are classified into data exist, such as whose data center is in China and can be access to from overseas, or the data are transmitted inside a transnational group across many international branches. In the meantime, Information security technology data exit security assessment guidelines says the data exist assessment mode is “self assessment in general case + assessment oraganized by industry competent department in special case + CAC is responsible for overall assessment”. The following three conditions are described as data exist:

◆Provides personal information and important data to domestic main body who are not subject to national jurisdiction or have not registered in China.

◆Data that not being transferred and stored outside China, but is accessed and viewed by institutions, organizations and individuals outside the country.

◆Transfer the internal data of network operating group to overseas, involves personnal information and important data that collected and generated in domestic operating process.

Security Challenges of Cross-border Data

As the accelerating economic globalization, cross-border data increased significantly, which may bring problems like data breaches, abuse, etc., and bring more challenges to the enterprises’ data exit security construction. Most large multinational companies conduct global management, and the daily business data and management data within the group flow across borders frequently, espacially the internet business and internal IT business, who generally will not set up data centers in every countries. Branch companies are used to processing customer information and daily business data centrally. The frequent cross-border flow of many sensitive data brings huge risks to sensitive data security.

Behaviors Control Challenge of Legal Personnel

Multinational companies usually have large operation teams, contains legal personal such as DBA, who give rise to core data related security risks because of illegal operations, such as unauthorized access to sensitive data, access to core business table during non-business hours, non-workplace access to the database, misoperation, high risk command, etc. The behavior management of different regions, departments and permissions becomes a data security management challenge to the multinational companies.

Challege of Security Auditing and Accountability

When database system is intruded and unauthorized operated, it is hard to accurately locate and trace the disruptive behavior and data breaches of hacker and illegal personnel, and seriously hinder the investigation and evidence collection by the auditing department in the future.

Security Solution

Before-event Inspection Warning

Inspect database vulnerabilities in lock-up period, to monitor the database security status, including assess the security status of related security configuration, connection, user change, permission change, code change, etc. Provide advides for security baseline establishment and security patches reinforcement, to form the report and analysis of security change status.

Monitor the security status of database, prevent database security from deteriorating: establish security baseline for database, and scan database regularly, report and analyze the change of database security status.

In-event Operating Controlling

Perform login control by limiting the IP address, client tool, account and date of database operating personnel; perform database table control by configuring the affected number of data rows(threshold value), including the query, update and delete behavior. Block and intercept the illegal behavior, to prevent high risk operation and mass data breaches.

Provide the “apply and approva in advance” mechanism for regular database operations. Only the approved database operation can be executed normally during the specified operation period, otherwise it will be intercepted.

Sensitive Data Masking

Identify the sensitive data from data centers in China, configure flexible policies and masking solutions, achieve a rapidly sensitive data masking, and ensure the effectiveness and availability of data at the same time. The masked data can be used safely in test, development, analysis and third-party environment.

Effectively Behavior Auditing

The database operation of business personnel is basically legal, but they still could be maliciously utilized or attacked. DAS helps to accurately record the key business operation and key business operator, to provides precise evidence for the tracing of after-event, and sends warning when illegal database operation or batch export occurs. After the security event happens, it provides a complete audit record and trace path to restore the historical process of databse security violations.

Advantages

Automatic Identification and Masking of Sensitive Data

The flexible policies and masking solutions helps to achieve a rapidly sensitive data masking, and ensure the effectiveness and availability of data at the same time. The masked data can be used safely in test, development, analysis and third-party environment.

Controllable Cross-border Access of Sensitive and Privacy Data

Take the “apply and approva in advance” mechanism when overseas entity accesses to the business sensitive data in China’s data centers. Only the approved database operation can be executed normally during the specified operation period, otherwise it will be intercepted.

Tracable Sensitive Data Access Behavior

Audit and record the database access process, and make the historical access behavior traceable and definable.