data-classification

数据分类

概述

数据分类对于安全、合规和治理至关重要。本技能涵盖：

• 发现并识别 ServiceNow 中的敏感数据字段
• 实施 PII/PHI 数据屏蔽策略
• 使用模式和启发式方法自动发现 PII/PHI
• 为表和字段应用分类标签
• 遵守 GDPR、HIPAA、PCI-DSS 等法规

适用场景：

• 对 ServiceNow 实例进行初始安全评估
• 准备合规审计（GDPR、HIPAA、SOX、PCI-DSS）
• 实施数据隐私控制
• 为非生产环境设置数据屏蔽
• 制定数据治理策略

前提条件

• 角色： admin、security_admin、data_privacy_admin
• 访问权限： sys_dictionary、sys_db_object、字段级元数据
• 插件： Data Classification（可选）、Encryption（用于静态加密）
• 知识： 监管要求（GDPR、HIPAA、PCI-DSS）

数据分类框架

分类级别

级别	标签	说明	示例
1	公开	无限制	知识库文章、公司信息
2	内部	仅限员工访问	政策、组织架构图
3	机密	按需知悉	财务数据、人力资源信息
4	受限	严格控制	PII、PHI、凭据
5	秘密	最高级别保护	加密密钥、SSN

敏感数据类别

类别	说明	法规
PII	个人身份信息	GDPR、CCPA
PHI	受保护的健康信息	HIPAA
PCI	支付卡行业数据	PCI-DSS
财务	银行/财务记录	SOX、GLBA
凭据	密码、令牌、密钥	全部

操作流程

阶段 1：发现敏感字段

1.1 自动检测 PII 字段

扫描常见 PII 字段模式：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    var piiPatterns = [
      // Name patterns
      { pattern: /^(first|last|middle|full)_?name$/i, category: 'PII', type: 'Name' },
      { pattern: /^name$/i, category: 'PII', type: 'Name' },

      // Contact patterns
      { pattern: /email/i, category: 'PII', type: 'Email' },
      { pattern: /phone|mobile|fax|tel/i, category: 'PII', type: 'Phone' },
      { pattern: /address|street|city|state|zip|postal|country/i, category: 'PII', type: 'Address' },

      // Identity patterns
      { pattern: /ssn|social.*security|sin|national.*id/i, category: 'PII', type: 'National ID' },
      { pattern: /passport/i, category: 'PII', type: 'Passport' },
      { pattern: /driver.*license|licence/i, category: 'PII', type: 'License' },
      { pattern: /dob|birth.*date|date.*birth/i, category: 'PII', type: 'DOB' },

      // Financial patterns
      { pattern: /credit.*card|card.*number|pan|cc_/i, category: 'PCI', type: 'Credit Card' },
      { pattern: /cvv|cvc|security.*code/i, category: 'PCI', type: 'Card Security' },
      { pattern: /bank.*account|account.*number|routing/i, category: 'Financial', type: 'Bank Account' },
      { pattern: /salary|wage|compensation|income/i, category: 'Financial', type: 'Compensation' },

      // Health patterns
      { pattern: /medical|health|diagnosis|treatment|condition/i, category: 'PHI', type: 'Medical' },
      { pattern: /insurance.*id|policy.*number|member.*id/i, category: 'PHI', type: 'Insurance' },
      { pattern: /prescription|medication|drug/i, category: 'PHI', type: 'Medication' },

      // Authentication patterns
      { pattern: /password|passwd|pwd/i, category: 'Credentials', type: 'Password' },
      { pattern: /secret|token|api.*key/i, category: 'Credentials', type: 'Secret' },
      { pattern: /private.*key|cert|certificate/i, category: 'Credentials', type: 'Certificate' }
    ];

    var findings = [];
    var dict = new GlideRecord('sys_dictionary');
    dict.addQuery('internal_type', '!=', 'collection');
    dict.addNullQuery('element').addOrCondition('element', '!=', '');
    dict.query();

    while (dict.next()) {
      var fieldName = dict.element.toString();
      var tableName = dict.name.toString();

      if (!fieldName || fieldName.startsWith('sys_')) continue;

      for (var i = 0; i < piiPatterns.length; i++) {
        if (piiPatterns[i].pattern.test(fieldName)) {
          findings.push({
            table: tableName,
            field: fieldName,
            category: piiPatterns[i].category,
            type: piiPatterns[i].type,
            label: dict.column_label.toString()
          });
          break;
        }
      }
    }

    gs.info('PII FIELD DISCOVERY RESULTS: ' + findings.length + ' potential PII fields found');
    gs.info(JSON.stringify(findings, null, 2));
  description: "Scan instance for potential PII fields"

1.2 发现包含敏感数据的表架构

深入检查特定表：

Tool: SN-Discover-Table-Schema
Parameters:
  table_name: sys_user
  include_inherited: true

查询字段详情：

Tool: SN-Query-Table
Parameters:
  table_name: sys_dictionary
  query: name=sys_user^elementISNOTEMPTY
  fields: element,column_label,internal_type,max_length,read_only
  limit: 100

1.3 查找包含实际数据的字段

采样敏感字段值（已屏蔽）：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    var sensitiveFields = [
      { table: 'sys_user', field: 'email', mask: true },
      { table: 'sys_user', field: 'phone', mask: true },
      { table: 'sys_user', field: 'mobile_phone', mask: true },
      { table: 'customer_contact', field: 'email', mask: true }
    ];

    var results = [];

    for (var i = 0; i < sensitiveFields.length; i++) {
      var config = sensitiveFields[i];

      var gr = new GlideRecord(config.table);
      gr.addNotNullQuery(config.field);
      gr.setLimit(5);
      gr.query();

      var samples = [];
      while (gr.next()) {
        var value = gr[config.field].toString();
        if (config.mask && value) {
          // Mask all but first/last 2 characters
          if (value.length > 4) {
            value = value.substring(0, 2) + '***' + value.substring(value.length - 2);
          } else {
            value = '***';
          }
        }
        samples.push(value);
      }

      if (samples.length > 0) {
        results.push({
          table: config.table,
          field: config.field,
          populated: true,
          sample_count: samples.length,
          samples: samples
        });
      }
    }

    gs.info('SENSITIVE FIELD SAMPLE (MASKED):');
    gs.info(JSON.stringify(results, null, 2));
  description: "Sample sensitive field data (masked)"

阶段 2：数据屏蔽策略

2.1 动态数据屏蔽

创建屏蔽显示业务规则：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    // Example: Create a script include for data masking
    var scriptContent =
      "var DataMasker = Class.create();\n" +
      "DataMasker.prototype = {\n" +
      "  initialize: function() {},\n" +
      "  \n" +
      "  maskEmail: function(email) {\n" +
      "    if (!email) return '';\n" +
      "    var parts = email.split('@');\n" +
      "    if (parts.length != 2) return '***@***';\n" +
      "    var user = parts[0];\n" +
      "    var domain = parts[1];\n" +
      "    if (user.length > 2) {\n" +
      "      user = user.charAt(0) + '***' + user.charAt(user.length-1);\n" +
      "    }\n" +
      "    return user + '@' + domain;\n" +
      "  },\n" +
      "  \n" +
      "  maskPhone: function(phone) {\n" +
      "    if (!phone) return '';\n" +
      "    var digits = phone.replace(/\\D/g, '');\n" +
      "    if (digits.length >= 10) {\n" +
      "      return '***-***-' + digits.slice(-4);\n" +
      "    }\n" +
      "    return '***';\n" +
      "  },\n" +
      "  \n" +
      "  maskSSN: function(ssn) {\n" +
      "    if (!ssn) return '';\n" +
      "    var digits = ssn.replace(/\\D/g, '');\n" +
      "    if (digits.length >= 4) {\n" +
      "      return '***-**-' + digits.slice(-4);\n" +
      "    }\n" +
      "    return '***-**-****';\n" +
      "  },\n" +
      "  \n" +
      "  maskCreditCard: function(cc) {\n" +
      "    if (!cc) return '';\n" +
      "    var digits = cc.replace(/\\D/g, '');\n" +
      "    if (digits.length >= 4) {\n" +
      "      return '****-****-****-' + digits.slice(-4);\n" +
      "    }\n" +
      "    return '****-****-****-****';\n" +
      "  },\n" +
      "  \n" +
      "  type: 'DataMasker'\n" +
      "};";

    gs.info('Data Masker Script Include:\n' + scriptContent);
  description: "Generate data masking script include"

2.2 字段级加密

检查加密功能：

Tool: SN-Query-Table
Parameters:
  table_name: sys_properties
  query: nameLIKEencrypt
  fields: name,value,description
  limit: 20

启用字段加密：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    // Check if encryption is configured
    var encryptProp = gs.getProperty('glide.security.encryption.module');
    gs.info('Encryption Module: ' + encryptProp);

    // To encrypt a field, update sys_dictionary
    // Set 'encrypt_on_write' = true for the field
    var dict = new GlideRecord('sys_dictionary');
    dict.addQuery('name', 'u_custom_table');
    dict.addQuery('element', 'ssn_field');
    dict.query();

    if (dict.next()) {
      gs.info('Current encryption setting: ' + dict.encrypt_context);
      // dict.encrypt_context = 'system';
      // dict.update();
    }
  description: "Check and configure field encryption"

2.3 基于角色的数据屏蔽

创建用于屏蔽的显示业务规则：

Tool: SN-Create-Record
Parameters:
  table_name: sys_script
  data:
    name: "Mask Sensitive Data Display"
    table: sys_user
    when: display
    order: 100
    active: true
    script: |
      (function executeRule(current, previous /*null when async*/) {

        // Only mask for non-privileged users
        if (gs.hasRole('security_admin') || gs.hasRole('hr_admin')) {
          return; // Full access
        }

        // Mask email for general users
        if (current.email && !gs.hasRole('itil')) {
          var email = current.email.toString();
          var parts = email.split('@');
          if (parts.length == 2) {
            current.email.setDisplayValue(parts[0].charAt(0) + '***@' + parts[1]);
          }
        }

        // Mask phone for general users
        if (current.phone && !gs.hasRole('hr_user')) {
          var phone = current.phone.toString().replace(/\D/g, '');
          if (phone.length >= 4) {
            current.phone.setDisplayValue('***-***-' + phone.slice(-4));
          }
        }

      })(current, previous);
    description: "Masks sensitive user data based on viewer's roles"

阶段 3：PII/PHI 发现

3.1 全面 PII 扫描

运行整个实例的 PII 扫描：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    var piiReport = {
      scan_date: new GlideDateTime().toString(),
      tables_scanned: 0,
      fields_checked: 0,
      pii_fields_found: [],
      phi_fields_found: [],
      pci_fields_found: [],
      recommendations: []
    };

    // PII field name patterns
    var piiPatterns = [
      /email/i, /phone/i, /mobile/i, /address/i, /zip/i, /postal/i,
      /first.*name/i, /last.*name/i, /birth/i, /dob/i, /ssn/i,
      /social.*security/i, /passport/i, /driver/i, /license/i
    ];

    var phiPatterns = [
      /medical/i, /health/i, /diagnos/i, /treatment/i, /condition/i,
      /prescription/i, /medication/i, /insurance/i, /patient/i
    ];

    var pciPatterns = [
      /credit.*card/i, /card.*number/i, /cvv/i, /cvc/i, /pan/i,
      /expir/i, /bank.*account/i, /routing/i
    ];

    // Get all custom tables
    var tables = new GlideRecord('sys_db_object');
    tables.addQuery('name', 'STARTSWITH', 'u_');
    tables.addOrCondition('name', 'IN', 'sys_user,customer_contact,customer_account,hr_core_profile');
    tables.query();

    while (tables.next()) {
      piiReport.tables_scanned++;
      var tableName = tables.name.toString();

      var dict = new GlideRecord('sys_dictionary');
      dict.addQuery('name', tableName);
      dict.addNotNullQuery('element');
      dict.query();

      while (dict.next()) {
        piiReport.fields_checked++;
        var fieldName = dict.element.toString();
        var fieldLabel = dict.column_label.toString();

        // Check against patterns
        for (var i = 0; i < piiPatterns.length; i++) {
          if (piiPatterns[i].test(fieldName) || piiPatterns[i].test(fieldLabel)) {
            piiReport.pii_fields_found.push({
              table: tableName,
              field: fieldName,
              label: fieldLabel
            });
            break;
          }
        }

        for (var j = 0; j < phiPatterns.length; j++) {
          if (phiPatterns[j].test(fieldName) || phiPatterns[j].test(fieldLabel)) {
            piiReport.phi_fields_found.push({
              table: tableName,
              field: fieldName,
              label: fieldLabel
            });
            break;
          }
        }

        for (var k = 0; k < pciPatterns.length; k++) {
          if (pciPatterns[k].test(fieldName) || pciPatterns[k].test(fieldLabel)) {
            piiReport.pci_fields_found.push({
              table: tableName,
              field: fieldName,
              label: fieldLabel
            });
            break;
          }
        }
      }
    }

    // Generate recommendations
    if (piiReport.pii_fields_found.length > 0) {
      piiReport.recommendations.push('Review PII fields for GDPR/CCPA compliance');
      piiReport.recommendations.push('Implement data masking for non-production environments');
      piiReport.recommendations.push('Create ACLs to restrict PII field access');
    }

    if (piiReport.phi_fields_found.length > 0) {
      piiReport.recommendations.push('Ensure HIPAA BAA is in place with ServiceNow');
      piiReport.recommendations.push('Enable audit logging on all PHI tables');
      piiReport.recommendations.push('Implement PHI encryption at rest');
    }

    if (piiReport.pci_fields_found.length > 0) {
      piiReport.recommendations.push('PCI data should NOT be stored in ServiceNow');
      piiReport.recommendations.push('Consider tokenization for payment data');
      piiReport.recommendations.push('Review PCI-DSS compliance requirements');
    }

    gs.info('PII/PHI/PCI DISCOVERY REPORT:\n' + JSON.stringify(piiReport, null, 2));
  description: "Comprehensive PII/PHI/PCI discovery scan"

3.2 数据内容扫描

扫描实际数据中的敏感模式：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    // Regex patterns for detecting sensitive data in content
    var patterns = {
      email: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
      phone: /(\+1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}/g,
      ssn: /\d{3}[-\s]?\d{2}[-\s]?\d{4}/g,
      creditCard: /\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}/g,
      ipv4: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g
    };

    // Tables and fields to scan for embedded PII
    var scanTargets = [
      { table: 'incident', field: 'description' },
      { table: 'incident', field: 'comments' },
      { table: 'sc_req_item', field: 'special_instructions' },
      { table: 'kb_knowledge', field: 'text' }
    ];

    var findings = [];

    for (var i = 0; i < scanTargets.length; i++) {
      var target = scanTargets[i];

      var gr = new GlideRecord(target.table);
      gr.setLimit(100); // Limit for performance
      gr.query();

      while (gr.next()) {
        var content = gr[target.field].toString();

        for (var patternName in patterns) {
          var matches = content.match(patterns[patternName]);
          if (matches && matches.length > 0) {
            findings.push({
              table: target.table,
              field: target.field,
              record: gr.getDisplayValue(),
              sys_id: gr.sys_id.toString(),
              pattern: patternName,
              count: matches.length
            });
          }
        }
      }
    }

    if (findings.length > 0) {
      gs.warn('EMBEDDED PII DETECTED: ' + findings.length + ' records contain potential PII');
      gs.info(JSON.stringify(findings.slice(0, 20), null, 2)); // First 20
    } else {
      gs.info('No embedded PII detected in scanned content');
    }
  description: "Scan record content for embedded PII patterns"

阶段 4：分类标签

4.1 创建分类标签

定义分类标签：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    // Check if data classification table exists
    if (GlideTableDescriptor.isValid('sys_data_classification')) {
      var labels = [
        { name: 'Public', level: 1, description: 'Information that can be freely shared' },
        { name: 'Internal', level: 2, description: 'For internal use only' },
        { name: 'Confidential', level: 3, description: 'Sensitive business information' },
        { name: 'Restricted', level: 4, description: 'PII, PHI, or regulated data' },
        { name: 'Secret', level: 5, description: 'Maximum protection required' }
      ];

      for (var i = 0; i < labels.length; i++) {
        var gr = new GlideRecord('sys_data_classification');
        gr.addQuery('name', labels[i].name);
        gr.query();

        if (!gr.hasNext()) {
          gr.initialize();
          gr.name = labels[i].name;
          gr.level = labels[i].level;
          gr.description = labels[i].description;
          gr.insert();
          gs.info('Created classification: ' + labels[i].name);
        } else {
          gs.info('Classification exists: ' + labels[i].name);
        }
      }
    } else {
      // Use custom table or properties
      gs.info('Data Classification plugin not installed');
      gs.info('Consider using sys_properties or custom table for labels');
    }
  description: "Create data classification labels"

4.2 为表应用分类

存储表分类：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    // Use sys_properties to store table classifications
    var tableClassifications = {
      'sys_user': 'Restricted',
      'customer_contact': 'Restricted',
      'incident': 'Internal',
      'kb_knowledge': 'Public',
      'hr_core_profile': 'Secret',
      'ast_contract': 'Confidential'
    };

    for (var table in tableClassifications) {
      var propName = 'data.classification.' + table;
      var propValue = tableClassifications[table];

      var prop = new GlideRecord('sys_properties');
      prop.addQuery('name', propName);
      prop.query();

      if (prop.next()) {
        prop.value = propValue;
        prop.update();
        gs.info('Updated: ' + propName + ' = ' + propValue);
      } else {
        prop.initialize();
        prop.name = propName;
        prop.value = propValue;
        prop.description = 'Data classification for ' + table + ' table';
        prop.type = 'string';
        prop.insert();
        gs.info('Created: ' + propName + ' = ' + propValue);
      }
    }
  description: "Apply data classifications to tables"

4.3 字段级分类

为敏感字段应用分类：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    var fieldClassifications = [
      { table: 'sys_user', field: 'email', classification: 'Restricted', reason: 'PII - Contact' },
      { table: 'sys_user', field: 'phone', classification: 'Restricted', reason: 'PII - Contact' },
      { table: 'sys_user', field: 'home_phone', classification: 'Restricted', reason: 'PII - Contact' },
      { table: 'sys_user', field: 'mobile_phone', classification: 'Restricted', reason: 'PII - Contact' },
      { table: 'hr_core_profile', field: 'ssn', classification: 'Secret', reason: 'PII - National ID' },
      { table: 'hr_core_profile', field: 'date_of_birth', classification: 'Restricted', reason: 'PII - DOB' },
      { table: 'customer_contact', field: 'email', classification: 'Restricted', reason: 'PII - Contact' }
    ];

    for (var i = 0; i < fieldClassifications.length; i++) {
      var fc = fieldClassifications[i];
      var propName = 'data.classification.' + fc.table + '.' + fc.field;

      var prop = new GlideRecord('sys_properties');
      prop.addQuery('name', propName);
      prop.query();

      if (prop.next()) {
        prop.value = fc.classification;
        prop.update();
      } else {
        prop.initialize();
        prop.name = propName;
        prop.value = fc.classification;
        prop.description = fc.reason;
        prop.type = 'string';
        prop.insert();
      }

      gs.info('Classified: ' + fc.table + '.' + fc.field + ' as ' + fc.classification);
    }
  description: "Apply field-level data classifications"

阶段 5：合规报告

5.1 生成分类报告

创建数据分类清单：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    var report = {
      generated: new GlideDateTime().toString(),
      summary: {
        total_tables: 0,
        classified_tables: 0,
        total_fields: 0,
        classified_fields: 0
      },
      by_level: {
        'Public': { tables: [], fields: [] },
        'Internal': { tables: [], fields: [] },
        'Confidential': { tables: [], fields: [] },
        'Restricted': { tables: [], fields: [] },
        'Secret': { tables: [], fields: [] }
      },
      unclassified: {
        sensitive_tables: [],
        sensitive_fields: []
      }
    };

    // Get table classifications
    var props = new GlideRecord('sys_properties');
    props.addQuery('name', 'STARTSWITH', 'data.classification.');
    props.query();

    while (props.next()) {
      var propName = props.name.toString();
      var classification = props.value.toString();
      var parts = propName.replace('data.classification.', '').split('.');

      if (parts.length === 1) {
        // Table classification
        report.summary.classified_tables++;
        if (report.by_level[classification]) {
          report.by_level[classification].tables.push(parts[0]);
        }
      } else if (parts.length === 2) {
        // Field classification
        report.summary.classified_fields++;
        if (report.by_level[classification]) {
          report.by_level[classification].fields.push(parts[0] + '.' + parts[1]);
        }
      }
    }

    // Count total tables
    var tables = new GlideAggregate('sys_db_object');
    tables.addAggregate('COUNT');
    tables.query();
    if (tables.next()) {
      report.summary.total_tables = parseInt(tables.getAggregate('COUNT'));
    }

    // Count total fields
    var fields = new GlideAggregate('sys_dictionary');
    fields.addNotNullQuery('element');
    fields.addAggregate('COUNT');
    fields.query();
    if (fields.next()) {
      report.summary.total_fields = parseInt(fields.getAggregate('COUNT'));
    }

    gs.info('DATA CLASSIFICATION REPORT:\n' + JSON.stringify(report, null, 2));
  description: "Generate data classification report"

5.2 GDPR 数据映射

生成符合 GDPR 要求的数据映射：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    var gdprMap = {
      generated: new GlideDateTime().toString(),
      data_controller: 'Your Organization Name',
      personal_data_inventory: [],
      lawful_basis: {},
      retention_periods: {},
      third_party_sharing: []
    };

    // Find all PII fields
    var piiFields = [
      { table: 'sys_user', fields: ['first_name', 'last_name', 'email', 'phone', 'mobile_phone', 'home_phone', 'location'] },
      { table: 'customer_contact', fields: ['first_name', 'last_name', 'email', 'phone', 'mobile_phone'] },
      { table: 'hr_core_profile', fields: ['first_name', 'last_name', 'date_of_birth', 'ssn', 'address', 'city', 'state', 'zip'] }
    ];

    for (var i = 0; i < piiFields.length; i++) {
      var tableInfo = piiFields[i];

      // Count records
      var gr = new GlideAggregate(tableInfo.table);
      gr.addAggregate('COUNT');
      gr.query();
      var recordCount = 0;
      if (gr.next()) {
        recordCount = parseInt(gr.getAggregate('COUNT'));
      }

      gdprMap.personal_data_inventory.push({
        table: tableInfo.table,
        fields: tableInfo.fields,
        record_count: recordCount,
        data_subjects: 'Employees/Customers',
        purpose: 'Business operations',
        lawful_basis: 'Legitimate interest / Contract performance'
      });
    }

    // Define retention periods
    gdprMap.retention_periods = {
      'sys_user': 'Duration of employment + 7 years',
      'customer_contact': 'Duration of relationship + 5 years',
      'incident': '3 years after closure',
      'hr_core_profile': 'Duration of employment + 7 years'
    };

    gs.info('GDPR DATA MAP:\n' + JSON.stringify(gdprMap, null, 2));
  description: "Generate GDPR data map"

工具用法摘要

操作	MCP 工具	REST 端点
发现架构	SN-Discover-Table-Schema	GET /sys_dictionary
查询字段	SN-Query-Table	GET /sys_dictionary
运行扫描	SN-Execute-Background-Script	通过 sys_trigger
创建分类	SN-Create-Record	POST /sys_properties
更新分类	SN-Update-Record	PATCH /sys_properties
获取表信息	SN-Get-Table-Schema	GET /sys_dictionary

最佳实践

• 先盘点： 在实施控制措施前，先完成数据发现
• 基于风险的方法： 优先处理风险最高的数据（PII、PHI、PCI）
• 纵深防御： 结合使用 ACL、加密、脱敏和审计
• 定期扫描： 安排定期 PII 发现扫描
• 记录一切： 保留数据分类记录以备审计
• 非生产环境脱敏： 始终对非生产环境中的生产数据进行脱敏
• 最小权限： 仅在必要时授予对已分类数据的访问权限

故障排查

未应用数据脱敏

症状： 用户看到未脱敏的数据
原因： 显示业务规则未执行
解决方案： 检查业务规则的顺序和条件；验证角色检查

PII 扫描遗漏字段

症状： 未检测到已知的 PII 字段
原因： 字段名称与模式不匹配
解决方案： 为组织特有的命名规则添加自定义模式

分类未持久保存

症状： 分类被重置或缺失
原因： 属性未在正确的范围内创建
解决方案： 验证 sys_properties 的范围以及更新集捕获情况

加密性能

症状： 加密字段上的查询速度缓慢
原因： 加密会阻止使用索引
解决方案： 仅加密真正敏感的字段；使用引用字段进行查找

相关技能

• security/acl-management - 限制对已分类数据的访问
• security/audit-compliance - 审计对敏感数据的访问
• security/incident-response - 响应数据泄露事件
• grc/risk-identification - 识别与敏感数据处理相关的风险

参考资料

• GDPR 官方文本
• HIPAA 安全规则
• PCI-DSS 标准
• NIST 隐私框架
• ServiceNow 数据分类
• CCPA 要求