Cloud Data Security · Topic 4 of 7
Data Discovery and Classification
CCSP data discovery of structured, unstructured and semi-structured data and its location, plus classification policies, data mapping, labeling and tags.
- 5 min
- Structured has a schema, unstructured has none, semi-structured is self-describing with tags or keys.
- Discovery uses metadata, labels and content analysis; content analysis is most accurate.
- Location of data, replicas and backups drives jurisdiction and contracts.
What it is
Data discovery finds out what data the organization holds in the cloud, what kind it is and where it is. Data classification assigns each data set a sensitivity level and handling rules, then makes that level visible through labels and tags so tools can enforce it.
Discovery comes first. In the cloud, self-service provisioning means data appears in new storage, SaaS tools and regions without anyone telling security.
How it works
Data by structure
| Type | Description | Examples | Discovery approach |
|---|---|---|---|
| Structured | Fixed schema in rows and columns | Relational databases, spreadsheets with fixed columns | Query schemas and column names, sample values |
| Unstructured | No predefined model | Documents, emails, images, video, chat messages | Content inspection, pattern matching, OCR, ML classifiers |
| Semi-structured | Self-describing tags or keys, flexible schema | JSON, XML, logs, NoSQL documents | Parse keys and tags, then inspect values |
Unstructured data is the hardest and usually the largest share. Semi-structured data is common in cloud services: API payloads, event logs and document databases.
Discovery techniques
- Metadata based: column names, file names, tags, owners and creation dates.
- Label based: reading classification labels already applied.
- Content based: inspecting the content itself with regular expressions, checksums such as the Luhn check for card numbers, keyword lists, fingerprints of known documents and ML models.
Content analysis is the most accurate but costs the most to run across large stores.
Data location
Location matters for jurisdiction, contracts and incident response. Discovery should record the region, the provider, the service and any replicas or backups. Cloud asset inventories, provider configuration APIs and CASB tools help find SaaS and storage that IT did not provision.
Data classification policies
A classification policy defines:
- The levels, for example Public, Internal, Confidential and Restricted.
- Criteria for each level, based on value, sensitivity, legal requirements and impact of disclosure.
- Handling rules per level: encryption, permitted locations, sharing, retention and destruction.
- Roles: the data owner classifies; custodians apply controls.
- Review: reclassification when data changes, ages or is combined.
Aggregated data can be more sensitive than its parts. A combined data set should be classified at least at the highest level of its components, and sometimes higher.
Data mapping
Data mapping links each data set to its owner, systems, locations, flows and the regulations that apply. It translates between schemes, for example when two companies merge or when an organization's levels must be mapped to a provider's or a regulator's categories.
| Data set | Owner | Location | Regulation | Class |
|---|---|---|---|---|
| Patient records | Clinical director | EU region, SaaS EHR | GDPR, health law | Restricted |
| Marketing images | Marketing lead | Object storage, global CDN | None | Public |
| Payroll | HR director | SaaS HR, EU region | GDPR, tax law | Confidential |
Labeling and tagging
| Mechanism | Example | Used by |
|---|---|---|
| Label | Visible header "Confidential" plus embedded document metadata | Users, DLP, IRM |
| Resource tag | Key value pair on a cloud resource, such as data-class: restricted | Policies, cost reports, automation |
| Database column tag | Column marked as holding personal data | Dynamic masking, access policies |
Tags let policy follow the data. A rule can deny creation of storage tagged restricted outside approved regions, or require encryption for anything tagged confidential. Tags must be protected from change by unauthorized users, or attackers can downgrade them.
A worked example
After a year of cloud adoption, an engineering firm does not know where its client design files are. A discovery scan of all accounts and the main SaaS file service finds design files in three unapproved storage buckets and in personal SaaS folders, including copies in a region outside the client contract.
The data owner classifies client designs as Restricted. The mapping records the client contract's location clause. Resource tags are applied, a policy blocks Restricted data outside approved regions, and DLP watches the SaaS service for new copies.
How the exam asks about this
- "Which data type is JSON log output an example of?" Semi-structured data.
- "Who is responsible for assigning a classification to a data set?" The data owner.
- "What should be done FIRST before applying DLP controls across cloud storage?" Data discovery and classification.
What to remember for the exam
- Structured has a schema, unstructured has none, semi-structured is self-describing with tags or keys.
- Discovery uses metadata, labels and content analysis; content analysis is most accurate.
- Location of data, replicas and backups drives jurisdiction and contracts.
- The data owner classifies; aggregated data may need a higher level.
- Labels and tags let tools enforce handling rules automatically.
Classification that lives only in a policy document protects nothing. Unless labels or tags are applied and read by enforcement tools, the levels have no effect.
Common mistakes
Classifying before discovering. You cannot classify data you do not know exists, and cloud sprawl hides a lot of it.
Letting IT decide classification. IT custodians apply controls; the business owner knows the value and decides the level.
Ignoring aggregation. Individually harmless data sets can become sensitive when combined.
Check yourself
What is the difference between structured and semi-structured data?
Structured data follows a fixed schema such as database tables, while semi-structured data carries its own tags or keys, as in JSON or XML, with a flexible schema.
What does data mapping produce?
A record linking each data set to its owner, systems, locations, flows, applicable regulations and classification.
Why should resource tags be protected from change?
Because policies use them to enforce controls, so an attacker who can change a tag could downgrade protection.
Topic 4 of 7 in Cloud Data Security
Test yourself on Cloud Data Security
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.