01Introduction
Data spreads. A production table gets copied to analytics, then exported to a bucket for a one-off job, then forgotten. DSPM exists to answer where your sensitive data is and who can reach it.
02What is DSPM?
Data security posture management (DSPM) is a category of tools that discover data stores across cloud and SaaS environments, classify the sensitive data in them (personal data, payment data, health records, secrets), and assess the access paths and controls around it.
03How DSPM works
DSPM follows the data, not the resource.
- 1.
Discover stores
Find databases, buckets, warehouses and file shares, including shadow copies.
- 2.
Classify
Sample content to identify sensitive data types and volumes.
- 3.
Map access
Link identities, roles and services to the stores they can read or write.
- 4.
Flag risk
Highlight sensitive data that is over-exposed, unencrypted or in the wrong region.
04Threats and risks
Data risk is usually about access.
Shadow data
Untracked copies of production data in dev and analytics environments.
Over-broad access
Roles and services that can read far more data than they need.
Residency violations
Regulated data stored or replicated in regions it shouldn't be.
Application-layer leaks
An API that returns another user's records bypasses every storage control. See application security.
05How Parameter helps
Parameter covers the two ways attackers actually reach data: cloud paths and application flaws.
Paths to data
Cloud Security traces how identity and network settings lead to sensitive stores.
Access control testing
The pentesting agents test whether one user can read another's records through your API.
Secrets that unlock data
Secrets detection shows which data store a leaked credential opens.
