Skip to main content

📝 Google BigQuery Sensitive Data Protection is not in use 🟢

  • Contextual name: 📝 Sensitive Data Protection is not in use 🟢
  • ID: /ce/ca/google/big-query/sensitive-data-protection
  • Located in: 📁 Google BigQuery

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Description​

Open File

Description​

BigQuery tables can contain sensitive data that for security purposes should be discovered, monitored, classified, and protected. Google Cloud's Sensitive Data Protection tools can automatically provide data classification of all BigQuery data across an organization.

Rationale​

Using a cloud service or 3rd party software to continuously monitor and automate the process of data discovery and classification for BigQuery tables is an important part of protecting the data.

Sensitive Data Protection is a fully managed data protection and data privacy platform that uses machine learning and pattern matching to discover and classify sensitive data in Google Cloud.

Impact​

There is a cost associated with using Sensitive Data Protection. There is also typically a cost associated with 3rd party tools that perform similar processes and protection.

Audit​

  1. Go to Cloud DLP by visiting https://console.cloud.google.com/dlp/landing/dataProfiles/configurations.
  2. Verify there is a discovery scan configuration either for the organization or project.

... see more

Remediation​

Open File

Remediation​

Enable profiling​

  1. Go to Cloud DLP by visiting https://console.cloud.google.com/dlp/landing/dataProfiles/configurations
  2. Click Create Configuration
  3. For projects follow https://cloud.google.com/dlp/docs/profile-project. For organizations or folders follow https://cloud.google.com/dlp/docs/profile-org-folder

Review findings​

Columns or tables with high data risk have evidence of sensitive information without additional protections. To lower the data risk score, consider doing the following:

• For columns containing sensitive data, apply a BigQuery policy tag to restrict access to accounts with specific access rights.

• De-identify the raw sensitive data using de-identification techniques like masking and tokenization.

Incorporate findings into your security and governance operations​

• Enable sending findings into your security and posture services. You can publish data profiles to Security Command Center and Chronicle.

• Automate remediation or enable alerting of new or changed data risk with Pub/Sub.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS GCP v3.0.0 → 💼 7.4 Ensure all data in BigQuery has been classified - Level 2 (Manual)1
💼 Cloudaware Framework → 💼 Data Protection and Recovery10