DataWorks:Data classification and grading

Introduction

Data classification and grading is the foundation for all data protection capabilities in DataWorks Security Center. It helps you automatically discover and tag sensitive data across various data sources and answers the key questions: "What sensitive data do I have?" and "Where is it?"

1. Step 1: Configure data classification and grading rules

   First, define standards for identifying sensitive data. This includes:

   • Data classification: Assign sensitivity labels to your data, such as S1 (Public) and S2 (Internal).

   • Data classification: Group data into business categories, such as Personal Information and Financial Data.

   • Data Type: Define specific kinds of sensitive data, such as Phone Number or ID Card Number. When you create a data type, you must assign it to a Data classification and specify a data grading.

   • Identification rules: This is the core of automated discovery. You can set powerful identification rules for each data type. The following methods are supported:

     • Identification by content: Match data content by using a regular expression or a built-in algorithm, such as ID card validation.

     • Identification by field name/comment: Match a field's name or comment by using a regular expression.

2. Step 2: Create an identification task

   Create an identification task to apply your defined rules and scan specified data sources like MaxCompute and Hologres. Tasks can be run immediately as a one-time scan or scheduled as a periodic (daily, weekly, or monthly) scan for continuous monitoring.

3. Step 3: Generate identification results

   After a task is complete, the system generates a detailed list of identification results, which serves as your sensitive data asset catalog. For a periodic task, the results are available on the next day (T+1). This catalog lists which field in each table is identified as a specific type of sensitive data. If you find discrepancies, you can revise the results to ensure the catalog's accuracy.

The confirmed catalog of sensitive data assets serves as input for downstream security policies such as data masking, risk monitoring, and access auditing.

Limitations

• Applicable users: This feature is available in DataWorks Standard, Professional, and Enterprise editions for users with the new data security features enabled in Security Center.

• Supported regions: China (Hangzhou), China (Shanghai), China (Beijing), China (Zhangjiakou), China (Ulanqab), China (Shenzhen), China (Chengdu), China (Hong Kong), Japan (Tokyo), Singapore, and Indonesia (Jakarta).

• Supported compute engines: MaxCompute and Hologres.

Prerequisites

• The account used to log on to DataWorks must have one of the following permissions or roles:

  • An account granted the AliyunDataWorksFullAccess policy.

  • An account assigned the DataWorks tenant security administrator role.

  • An account assigned the DataWorks tenant administrator role.

• You have completed the New user guide. If you have not completed the initial setup, accessing the Data Classification and Grading page automatically redirects you to the New user guide page. Complete the initialization first, and then return to this page.

Feature page

1. Log on to the DataWorks console. In the target region, click Data Governance > Security Center in the left-side navigation pane. On the page that appears, click Go to Security Center.

2. In the left-side navigation pane, choose Sensitive Data Protection > Data classification grading.

Configuration Data classification

1. Go to the Data Classification page.

   1. On the Data Classification and Grading page, click the Data classification tab.

   2. The Data classification tree is displayed on the left, and the Data Type that belong to the selected Data classification are on the right. Click a branch in the classification tree to view its associated Data Type. You can then View, Edit, or Delete a data type from the Actions column.

2. Add a data type.

   Important

   The system provides built-in templates for Data classification and Data Type. You can edit them as needed.

   1. On the Data classification tab, click New Data Type in the upper-left corner.

      Configure the following parameters:

      Parameter	Description
      Data Type	Enter a name for the data type. The name must be globally unique. DataWorks tags the data (fields) that meet the identification rule with this data type.
      Data classification	Specify the data classification to which the data type belongs.
      Data Level	Specify the security level for this data type. DataWorks tags the data (fields) that meet the identification rule with this data grading.
      Identification rules	When an identification rule is met, DataWorks marks the data (field) as identified. Three types of identification rules are supported: Data Content Identification, Field Name Identification, and Field Annotation Identification. Each rule type must be configured and validated independently. Satisfy any rule: The condition is met if any of the three rules is matched. Also meet the following rules: The condition is met only if all three rules are matched. After you configure the identification rules, you can click Test Validation below the rule configuration area. In the dialog box that appears, enter Test Data. The system immediately evaluates whether the test data matches the configured identification rules. This helps you confirm that the rules work as expected before you save them.
      Data Type Description	Enter a custom description for the data type based on your business scenario.

   2. After completing the configuration, choose to apply the rule immediately or only save it.

      1. Effective immediately: Saves the configuration and applies the identification rule immediately. When an identification task runs, it tags data (fields) that match the rule with this data type.

      2. Save Only: Saves the configuration, but the identification rule does not take effect. When an identification task runs, it will not tag data with this data type.

3. Delete a data type: You can delete only custom data types, not built-in ones.

   Important

   Deleting a Data Type has the following effects:

   • Historical Identification results are deleted, and new Identify Tasks will no longer identify this data type.

   • Masking rules for this Data Type are removed from Desensitization strategy policies.

   • Access records for sensitive data of this Data Type are deleted.

   • Related rules for this type are deleted from Security risk identification rules.

   The confirmation dialog box that appears when you delete a data type provides a Reset MaxCompute field Label option. You can choose whether to also reset the Label of the corresponding fields in MaxCompute to a specific level. The default value is 0, which clears the Label from the field. For batch deletion, the default value is the highest security level number among the selected items. This capability is independent of the Write to MaxCompute Label switch. Even when the switch is off, you can still choose whether to reset the MaxCompute Label during deletion.

Configuration data grading

DataWorks supports up to 10 grading levels. You can modify the description for each level based on your business needs. A higher number indicates a higher security level.

1. Go to the Data Grading page: On the Data Classification and Grading page, click the Data classification tab.

2. Edit data grading: Click Edit in the upper-left corner to modify the Detailed description for different data grading levels.

3. Save data grading: After modifying the detailed descriptions, click Save in the upper-left corner.

Manage data Identify Tasks

1. Go to the Identification Tasks page: On the Data Classification and Grading page, click the Identify Tasks tab.

2. Create an identification task.

   1. On the Identify Tasks tab, click New Task in the upper-left corner.

      Configure the following parameters:

      Parameter	Description
      Task Name	A custom name for the data classification and grading identification task.
      Data Source Type	Select a data source type. MaxCompute and Hologres are supported.
      Task Type	Single Task: Runs only once and is not repeated. Periodic Tasks: Runs repeatedly at a scheduled time. Important Periodic Tasks scans only new data (fields). You can use a one-time task to re-evaluate historical identification results. DataWorks supports only one Periodic Tasks.
      Identification range	Specify the data scope for the identification task. The minimum scope is a data table. If you set Data Source Type to MaxCompute, you can select a project or a data table. If you set Data Source Type to Hologres, you can select a database or a data table. You must select an instance that has been bound as a Data source within a specific Workspace, and then select a Resource Group to verify network connectivity.
      Sampling quantity	The amount of data to sample from each field when the identification task runs. A larger sample size improves identification accuracy but increases task duration. The maximum value is 200.
      Data sampling using	During an identification task, DataWorks uses the specified account to access data. If the specified account lacks the required permissions, sampling and identification fail. Important Ensure that the account you specify has permission to access table names, field names, field comments, and field data within the specified identification scope.

   2. After configuring the parameters, click Confirm to save the task.

3. Edit an identification task.

   To reconfigure a periodic identification task, on the Identify Tasks tab, click Edit in the Operation column for the target task.

   Important

   One-time tasks cannot be edited. You must delete the task and create a new one.

4. View an identification task.

   1. On the Identify Tasks tab, find the task that you want to view and click View in the Operation column to open the task details page.

   2. On the task details page, click the number next to Running records to view the Start execution time and End execution time for each run.

5. Delete identification tasks.

   On the Identify Tasks tab, you can delete tasks individually or in batches.

   • Delete a single task:

     Find the task you want to delete and click Delete in the Operation column.

   • Delete tasks in batches:

     Select the checkboxes of the tasks you want to delete and click Batch Delete in the lower-left corner.

   Important

   • Deleting an identification task does not stop a running task.

   • After a periodic task is deleted, it will no longer run.

   • The identification results from previous runs of a deleted task are retained.

Classification and grading results

1. On the Data Classification and Grading page, click the Identification results tab. On this tab, you can view the identification results for table fields after a task has run.

2. View data classification and grading results.

   The Identification Results page displays the classification and grading information for your data assets. The following table describes the columns.

   Parameter	Description
   Data Source Type	The data engine to which the data asset belongs.
   Instance/Project/Database	The name of the instance, project, or database to which the data asset belongs.
   Table	The name of the data table to which the data asset belongs.
   Field	The name of the field in the data asset.
   Data classification	The data classification directory corresponding to the data type, or the directory revised by a user. The path is displayed in the Level-1 directory/Level-2 directory/... format.
   Data Type	The data type determined by the identification task, or the data type revised by a user.
   Data classification	The security level corresponding to the data type, or the level revised by a user.
   Judgment mode	System identification: An identification task determined the result. Revision: A user revised the result.
   Update time	The last time the system determined or a user revised the result.

3. Revise data classification and grading results.

   You can delete or revise results from the Actions column. Two revision methods are available:

   • Rescan to overwrite: Create a new one-time task to re-evaluate the identification results for assets within a specific scope.

   • Revise manually: Manually revise the identification result for a data asset. Perform the following steps:

     1. On the Identification Results tab, use the search bar to filter for the data asset that you want to modify, and then click Revision in the Actions column.

     2. In the dialog box that appears, select a new data type to apply your changes.

   The identification results list also supports the following batch and manual operations:

   • Batch Revise: Select multiple identification results and click the Revise button at the bottom of the list to update the data classification, data grading, or data type of the selected records in one operation.

     Procedure:

     1. In the identification results list, use the checkboxes in the first column to select the records that you want to revise. You can select one or more records, or click the select-all checkbox to select all records on the current page.

     2. After selecting records, the number of selected records is displayed at the bottom-left of the list. Click Revise.

     3. In the Revise dialog box, confirm the revision information (which displays "x records selected for batch revision" along with details of the selected records), and then use the multi-level drop-down list to select the target data classification.

     4. Click Confirm. The system displays "Successfully revised X records." After the revision, the determination method of these records is automatically changed to Revision.

   • Batch Delete: Select multiple identification results and click the Delete button at the bottom of the list to delete the selected records in batch. The Reset MaxCompute field Label option also appears during deletion. The default value is the highest security level number among the selected items.

   • Manually Add Identification Result: On the toolbar of the Identification results tab, click Add. In the dialog box, select the engine type, catalog (project/instance/cluster/Catalog), database/Schema, data table, field, and data type to create an identification result with the determination method set to Revision. Use this for fields that automatic identification did not match but whose sensitivity you have confirmed.