Case Study
At a glance
The data landscape
Profile
Global sports data and technology provider
Many separate business units
Security and privacy teams that both need answers
Environment
About 280 AWS accounts
Amazon S3, RDS and Aurora
DynamoDB and DocumentDB
Self-managed Oracle on EC2
The challenge
The only map of the data lived with engineering
Answers came one team at a time. To learn what data sat in an account, security had to ask the engineering team that owned it.
Too many accounts to check by hand. With hundreds of accounts, a manual review was never going to finish, so nobody started one.
An Oracle estate snapshots could not read. One business unit's Oracle databases replicate in a way that standard snapshot scanning cannot handle.
“Unless someone will start digging manually and checking, right? But nobody will start doing this.”
The provider's data security program lead
“I have a strong feeling that for your solution it's not going to work.”
A database administrator at the provider, before deployment
Why Bedrock Data
Classification across every account, Oracle included
Coverage across about 280 accounts
S3, RDS and Aurora, DynamoDB, DocumentDB and self-managed Oracle, classified account by account.
Read-replica scanning for Oracle
Where snapshots could not work, Bedrock Data scans a read replica instead.
Sensitivity-first findings
Findings are sorted by sensitivity, so highly confidential data surfaces first.
One view for security and privacy
Both teams work from the same picture of what data sits where.
Rolling coverage
Each account is rescanned on a rolling 30-day cycle.
Production and non-production
Non-production data stores are classified with the same rules as production.
Results
What the scans turned up
Personal data nobody had mapped. 25,000 invoices holding scouts' personal data turned up. The privacy team had not known they existed.
Passwords in plain text. Clear-text passwords sat in nine datasets, four of them in a single freshly onboarded database.
Sensitive data outside production. 656 non-production data stores held sensitive data.
Highly confidential data, counted. 274 data stores hold highly confidential data, and the team can see them from one screen.
Security and privacy now answer where data sits from one view, without asking each engineering team in turn.
The vision
Visibility without asking engineering
“We were relying on engineering for understanding where we have data in the past. And now a tool will provide us visibility. So it's faster and cleaner.”
The provider's infrastructure lead
What's next
Where this is heading
The team expects audits to get easier now that it can show where data sits, and wants scans to run more often than every 30 days.
