Data Discovery

📖 What is Data Discovery?

Data Discovery is the process of locating, identifying, and cataloging sensitive or regulated data across an organization’s digital environment. It answers the critical question:

“Where is our sensitive data stored, and who has access to it?”

Before enforcing Data Loss Prevention (DLP) policies, you must first discover where the data resides — whether it's on endpoints, file servers, databases, or in the cloud.

🎯 Why is Data Discovery Important?

• 🔎 Visibility: You can't protect what you don't know exists.
• 🧠 Risk Assessment: Understand where your data is most exposed.
• ⚖️ Compliance: Regulations like GDPR, HIPAA, and PCI-DSS require data inventory and traceability.
• 🛡️ DLP Enablement: Ensures that policies target real data, not assumptions.

🗂️ Types of Data Discovery

🔹 1. Endpoint Discovery

• Scans laptops, desktops, and mobile devices
• Detects files stored locally or in unauthorized folders
• Identifies USB-stored or unsynced files

🔹 2. Network Discovery

• Analyzes data in transit across the network
• Identifies sensitive files moving over email, FTP, SMB, HTTP
• Useful for detecting shadow IT and unauthorized data flows

🔹 3. File Server & NAS Discovery

• Crawls file shares, network drives, and shared folders
• Maps sensitive data locations across departments
• Checks for permissions and access control risks

🔹 4. Database Discovery

• Scans structured data in SQL, NoSQL, and cloud databases
• Searches for PII, financial records, passwords, etc.
• Classifies fields, tables, and entire schemas

🔹 5. Cloud Storage Discovery

• Integrates with services like:
  • Google Drive, OneDrive, Dropbox, Box
  • AWS S3, Azure Blob, Google Cloud Storage
• Finds publicly shared files, sensitive documents, or tokens

⚙️ How Does Data Discovery Work?

✅ Techniques Used:

🔐 Agent vs Agentless Discovery

📊 Output of Data Discovery

• Indexed data inventory
• Classification labels
• Risk heatmaps
• Access control audit logs
• Visual dashboards (who, what, where, when)

🧠 Best Practices for Data Discovery

1. Start with known high-risk areas (HR, Finance, Legal)
2. Use classification rules during discovery for automatic labeling
3. Schedule recurring scans to ensure up-to-date awareness
4. Integrate with IAM (Identity and Access Management) to track user data access
5. Alert on anomalies like sensitive data in unauthorized locations

🧪 Example Scenario

An organization's DLP system discovers a spreadsheet named Employee_Salaries.xlsx on a public folder in OneDrive. It flags the file as containing PII (emails, salaries), auto-labels it as "Confidential", and sends an alert to the security admin.

🧾 Summary

In summary, Data Discovery is the first step of any strong DLP strategy. Once data is discovered and classified, you can confidently apply DLP policies, track access, and prevent leakage.