DataWorks:Data Security Guard

Workflow

Data Security Guard follows a three-phase workflow: preparation, active protection, and post-event audit.

1. Step 1: Preparation

   Classify and grade data assets and configure detection rules before sensitive data is generated.

   Operation	Description	References
   Configure data classification and grading	Classify data into sensitivity levels based on value, content sensitivity, and impact scope. Management principles and development requirements vary by level. DataWorks provides built-in templates. You can also create custom classification and grading names.	Configure sensitive data classification and categorization
   Configure sensitive data detection rules	Define sensitive column types and configure rules based on data source and purpose. Content matching a rule is flagged as sensitive. Supported detection methods: Data content detection: Uses built-in rules, custom models, sample libraries, or regular expressions. Metadata detection: Matches column names and comments using wildcards, prefixes, suffixes, or containment patterns. Combined detection: Combines multiple conditions with AND/OR operators.	Configure data detection rules and run detection tasks Detection with a custom model Identify data with a sample library
   Other configurations	System settings: Configure watermark tracing periods, tag classification results to MaxCompute column labels, specify email addresses and webhook URLs for receiving alert notifications on detection results, and enable real-time detection for unidentified columns. User group settings: Batch-add accounts with identical permissions to a group. You can then allowlist the group to let members access unmasked data.	System configuration Configure user groups

2. Step 2: Active protection

   After rules are enabled, DataWorks automatically detects matching sensitive data. View results in the Data Security Guard modules below.

   Operation	Description	References
   Data masking management	Configure masking rules for detected sensitive data. Masking policies vary by sensitivity level. Masking types: Dynamic masking: Masks data at query time on the results page. Static masking: Masks and stores data in a specified location. Methods include format-preserving encryption, redaction, hashing, character replacement, interval transformation, rounding, and nullification. To grant access to raw data, configure an allowlist. Select the masking type and method that fit your requirements.	Create a data masking rule
   Risk identification management	Built-in risk rules take effect immediately. You can also create custom rules with threshold comparisons such as data volume and frequency. Active rules automatically detect risky operations and send alerts.	Risk identification management
   Risk monitoring and handling	View detected risk details and mark them as risk-free or handled.	View data risks

3. Step 3: Post-event audit and tracing

   Process sensitive data and perform security management based on risk monitoring results.

   Operation	Description	References
   Data operation audit	Data Security Guard logs all sensitive data operations, including IP addresses, database users, timestamps, and lineage information. You can manually correct misidentified sensitive data.	View and correct sensitive data detection results Sensitive data overview Access and export sensitive data
   Data watermark tracing	Extract watermark information from leaked data files to trace the source of a data leak.	Data traceability

Limitations

Access Data Security Guard

1. Log on to the DataWorks console. In the target region, click Data Governance > Security Center in the left-side navigation pane. On the page that appears, click Go to Security Center.

2. In the left-side navigation pane, click Data Security > Sensitive Data Management and then click Try Now to access Data Security Guard.

   Note

   • If your Alibaba Cloud account is already authorized, you are directed to the Data Security Guard homepage.

   • If your Alibaba Cloud account is not authorized, you are redirected to the Data Security Guard authorization page. To use Data Security Guard features for the first time, go to Data Security > Sensitive Data Management, select Data Security Guard in the pop-up dialog, and then complete the authorization.