Data security
Data Security (DDS) covers classification, sensitivity levels, recognition algorithms/tasks, review/publication, access policies, authorization, and masking. Classification, reviewer confirmation, and data access controls are related but separate tasks.
Understand the objects
| Object | Purpose | Follow-up |
|---|---|---|
| Security classification | Organize by business meaning | Design hierarchy, create nodes, assign objects |
| Classification information item | Reusable recognition concept | Not a specific database column |
| Security level and rationale | Requirements and evidence | Same-class objects can have different levels |
| Algorithms, rules, tasks | Bulk candidate recognition | Review results before publication |
| Access policy | Identities, scope, controls | Direct access, rows, table/column masking |
| Masking rule | Presentation of sensitive values | Reference in policies and verify actual access |
Before you begin
Harvest metadata, confirm meanings, and agree classifications, levels, and evidence. Prepare real test identities and approved samples for gateway verification.
Recommended responsibilities: business owners explain meaning, security stewards maintain controls, reviewers confirm classification, and administrators configure enforcement. Actual roles/permissions are organization-defined. Start with a few manually classified objects using Quick start, then expand recognition.
Understand the gateway boundary
This module governs rules and results. Security Gateway is the separate DDS dynamic masking component, including server, JDBC clients, and audit.
Find a task
| Goal | Guide |
|---|---|
| First governance cycle | Quick start |
| Framework, concepts, levels | Classification design |
| Legal evidence | Legal basis |
| Manual classification/review | Collaboration, Workbench |
| Bulk recognition | Recognition |
| Algorithm library | Algorithms |
| Access, rows, masking | Policies |
| Folders and evidence | Policy folders/logs |
| Masking and operation | Rules/configuration |
Read the security overview
Published here means reviewed associations between assets, classes, and levels, not catalog publication or verified access policies.
| Chart | Meaning |
|---|---|
| Asset levels | Proportions of published assets; exclude unconfirmed candidates |
| Classification and levels | Level counts within top-level classes |
| Levels by system | Published assets by their business system |
| Levels by department | Business department of the table/column's system, not the operator |
Align objects, hierarchy, review states, and department properties before reconciling counts. Coverage does not replace access/masking tests.