Manage sensitive data

Prerequisites

You have purchased the sensitive data protection feature. For more information, see Purchase DMS services.

Step 1: Enable sensitive data protection

1. Log on to the Data Management (DMS) 5.0 console as an administrator.

2. In the database instance list on the left, find your target instance and right-click it.

3. Click Edit Instance.

4. In the Basic Information section, select Sensitive Data Protection and choose a data classification and grading template. DMS uses this template to scan and identify sensitive data in the database.

   This example uses the built-in DMS data classification and grading template. For more information about data classification and grading templates, see How data classification and grading scans work in DMS.

5. Click Save.

Step 2: Configure a sensitive data scan task

DMS scans for sensitive data in the specified database based on the associated data classification and grading template. It then automatically applies classification and grading labels to the fields that match the rules.

1. Go to the Sensitive Data Assets page.

   1. Move the pointer over the icon in the upper-left corner and choose All Features > Security and disaster recovery (DBS) > Sensitive Data > Sensitive Data Assets.

      Note

      If you use the DMS console in normal mode, choose Security and disaster recovery (DBS) > Sensitive Data > Sensitive Data Assets in the top navigation bar.

   2. In the Instance List section at the bottom, find the target instance.

2. Click Configure Scan Task in the Actions column. In the Configure Scan Task dialog box, configure the following information.

   Set Scan Mode to Instant Task (runs once immediately), Scheduled Task (runs once at a specified time), or Periodic Task. Set Scan Scope to All Databases or Specified Databases. If you choose Specified Databases, select the specific databases from the drop-down list. Set Apply Scan Results Immediately to Yes or No (go to the identification results page to apply manually).

   Note

   • Regardless of the scan mode you choose, DMS automatically flags sensitive fields in tables during the scan.

   • Applying the results immediately adds classification and grading labels to the identified fields. If you choose not to apply the results immediately, you must go to the recognition results page after the scan to apply them manually.

3. Click Confirm.

Step 3: View scan task details

1. On the Sensitive Data Assets page, in the Instance List section, click Task Details for the target instance.

2. On the Recognition Task Log page, view details such as the recognition results and matched rules.

   The results table includes columns such as Database name, Table name, Field name, Matched rule name, Sensitivity level, Sample data, and Status. In the Actions column, you can click Ignore or Adjust Classification Result. At the top of the page, you can click Batch Apply Recognition Results or Batch Ignore Recognition Results.

Step 4: View data masking results

1. From the database instance list on the left of the DMS console, find the target database and double-click its name to open the SQL Console.

2. In the SQL Console, verify that data masking is applied to sensitive data as expected.

   After you run a SELECT query, the values in sensitive columns such as buyer_name, seller_name, city, and zone appear as **. This indicates that the data masking rules are in effect. Non-sensitive columns, such as item_id, still display their original values.

FAQ

Related documentation

• Overview of sensitive data protection

• Enable sensitive data protection

• Manage sensitive data

• Manage data classification and grading templates

• Manage recognition models

• Disable sensitive data protection