# Data Classification With Satori [By Ben Herzberg](https://blog.satoricyber.com/author/ben/) | Chief Scientist July 22, 2021 In this article, I will discuss how people perform data classification using Satori and explain why Satori is a great choice for you to manage all of your stored data types. Before we dive in, here is a quick summary video: [Continuous data classification](https://www.youtube.com/watch?v=0fh-U6Gx5xA) One of the core principles of [DataSecOps](https://blog.satoricyber.com/what-is-datasecops) is prioritizing knowledge about the location of your sensitive data and then prioritizing resources for security and governance of that data. Another guiding principle is that continuous processes are always preferable over ad-hoc projects because data changes very often. ## Continuous Sensitive Data Discovery in Satori This is where Satori comes in. At Satori, it was extremely important for us to design our product so that it continuously scans data as it is being accessed in real time. Let’s start by reviewing the flow of what is happening (with regards to data classification) when you use Satori: As you can see in the chart above, when your users are going through Satori, it continuously analyzes the data that is sent by the users (i.e. queries or commands) as well as the data that is returned from the data stores (e.g. Snowflake, Redshift, or others) back to the user. If needed, Satori also applies other capabilities such as [self-service access control](https://blog.satoricyber.com/satori-is-launching-self-service-data-access). In addition to these extra capabilities, Satori scans the data which passes through to classify specific data types. The main categories of data which Satori scans for are: - PII (personally identifiable information), such as person names, addresses, phone numbers, etc. - PCI (payment card industry), such as credit card numbers. - Operational sensitive data, such as passwords or financial information. - PHI (protected health information), such as patient identifiers and healthcare data. You can find our complete list of classification tags [here](/content/docs/acl/c12n-tags/index.html). ### Data Inventory Satori automatically updates the data types found in its inventory which provides you with up-to-date information about the locations and types of sensitive data in your organization. In the screenshot below, you can see the Data Inventory that is generated automatically by Satori as data is being accessed: ### Data Access Audit Satori displays the types of data that are being accessed in its data access audit, allowing you to view what types of data were being accessed in each log entry. You can then create reports based on this information and investigate users’ access to sensitive data. In the screenshot below, you can see an audit entry which contains the data classified: ### Access Control & Security Policies Satori allows you to use the classified data types in security policies and access control configuration. For example, in addition to being able to set security policies for known locations, you can set them directly based on data types. In the screenshot below, you can see a Satori dynamic masking definition, based on data types classified: ## Semi-Structured Data Classification Semi-structured data is often either overlooked or classified uniformly as one chunk in many data classifications. This problem is further intensified, as semi-structured data is used quite often due to its flexibility and the fact that it requires less overhead when loading it into your favorite data store. A data classification tool that does not fully support the classification of semi-structured data can have negative effects both on audits and on reducing sensitive data leakage. In Satori, we regularly handle data in warehouses and lakes which utilize semi-structured data, so it was important for us to ensure that we also correctly classify data within semi-structured data. ## Overriding Satori’s Classifications At Satori, we have designed our data classification system to be the most suitable for your data. This means that with Satori, you can also easily override any classifications. You can add specific classifications to locations, or you can remove classifications for irrelevant locations. ## How Sensitive Data Is Discovered by Satori Satori is a data access controller that does not change anything about the way your data users utilize the data and does not change anything in the data stores themselves. Rather, Satori acts as a proxy between the data users and the data stores. Because Satori is positioned at the point of data access, Satori is able to scan both the queries and the data returned to the users and learn the different data types customers hold. Most of the classification is done by analyzing the data returned from the data store. Classification is done using the following methods, depending on the data type: ### Dictionary Matches For some data types, we use dictionaries or lists of values, most often by incorporating additional logic to the classification. ### Pattern Matching Some data types are identified by pattern matching. For example, email addresses, which all follow a somewhat complex pattern. ### Algorithm Matching Some data types are discovered by applying certain algorithms, such as the Luhn algorithm for credit card numbers. ### Machine Learning Some data types are best discovered by extracting certain features and then applying a trained machine learning algorithm. ## What About Data That Is Not Accessed? In some cases, our customers want to run a “full scan” on their repositories. In those cases, it is easy to run these full scans by retrieving a sample of data from your data stores. ## Conclusion An important part of what Satori does is continuously classifying data as it is being accessed in real-time. We believe that this is the best way to discover sensitive data for data that may change.