What is the best method to create or group Scans?

It is standard practice and an operational best practice to create scans grouped by Target Type.

For example, separate scans for:

• macOS endpoints
• Windows endpoints
• SQL databases
• Network file shares
• Cloud storage

However, in enterprise environments, these Target-type scans are often further sub-divided based on operational considerations such as:

• Scheduling
• Network topology
• Security rules

NOTE:

For information and recommendations on scan naming conventions, see "What naming convention should I use to organize my scans?"

Why Scans Are Grouped by Target Type

1. Architecture & Protocol Differences

In Spirion Sensitive Data Platform, each target category uses a distinct environmentType and authentication model:

• Endpoints (macOS / Windows): Scanned locally via an Agent installed on the machine. Mac targets rely on Mac-specific configuration files (com.identityfinder.macedition.xml) and Mac file paths (MacPath).
• Databases (SQL / Oracle / PostgreSQL): Require database connection strings, database credentials, and query settings, executed via centralized discovery Agents.
• Cloud & SaaS Repositories (OneDrive, S3, Box): Scanned via API integrations requiring OAuth tokens and API tenant configurations.

2. Differing Performance & Scheduling Requirements

• Endpoints (Workstations/Laptops): Typically scanned continuously in the background or during idle periods, often batched across departments or time zones to prevent network saturation.
• Databases & Production Servers: Scanned strictly during designated off-peak maintenance windows (e.g., overnight or weekends) with controlled CPU/thread limits to avoid impacting database query latency.
• File Shares / SAN Storage: Requires scheduled off-peak window scanning due to high disk I/O and network bandwidth usage.

3. Policy & Detector Customization

• Target-Specific Rules: A database scan may focus on structured PII (Social Security Numbers, Credit Cards, Bank Accounts), whereas endpoint scans might include OCR image processing for scanned documents and driver's licenses.
• Resource Tuning: Resource-intensive features like Optical Character Recognition (OCR) or deep archive extraction are often disabled on database scans but enabled on endpoint file scans.

Enterprise Grouping Patterns

Beyond grouping by Target Type (Endpoints, Databases, Cloud Storage, File Shares), enterprise organizations group and organize scans in Spirion Sensitive Data Platform (SDP) using several strategic frameworks:

1. By Regulatory & Compliance Scope

Scans are frequently aligned with specific legal and compliance frameworks to satisfy regulatory audits:

• PCI-DSS Scans: Targeted strictly at the Cardholder Data Environment (CDE) using specialized credit card and PAN detectors.
• HIPAA / PHI Scans: Focused on healthcare infrastructure, medical records, and insurance claim repositories.
• GDPR / CCPA Privacy Scans: Grouped to search for PII (SSNs, national IDs, passports, addresses) across customer-facing systems and employee records.
• Intellectual Property / Secrets: Targeted at source code repos, engineering shares, and design folders looking for credentials, private keys, and trade secrets.

2. By Business Unit / Department (Data Ownership)

Aligning scans with organizational departments helps assign clear data custodianship for remediation:

• Human Resources (HR): High-frequency scans targeting employee onboarding folders, payroll files, and background checks.
• Finance & Legal: Scans covering contract repositories, tax documents, bank details, and merger/acquisition folders.
• R&D / Product Engineering: Scans checking development shares and build servers for hardcoded credentials and source code leaks.

3. By Data Sensitivity & Risk Tiering

Scans are grouped based on the risk level of the data assets:

• Crown Jewels / Critical Risk: High-priority, frequent scans on repositories known to contain sensitive or confidential data.
• General Corporate Storage: Periodic (monthly/quarterly) baseline scans on standard shared drives and team collaboration spaces.
• Public / Low Risk: Infrequent spot-check scans on public-facing sites or staging environments.

4. By Network Topology & Data Sovereignty

To optimize network bandwidth and comply with data residency laws:

• Geographic / Regional Groups (for example, US-East, EU-West, APAC): Grouping scans by data center location so designated local Agent Pools perform scanning locally, avoiding heavy WAN latency.
• Data Sovereignty Constraints: Ensuring EU-hosted data is processed strictly by Agents within the EU boundary to maintain compliance with cross-border data transfer laws.

5. By Scan Cadence & Trigger Type

• Incremental / Daily Scans: Scans configured to check only newly created or modified files since the last scan run (delta scanning).
• Deep / Maintenance Window Scans: Full disk and deep archive scans executed during off-peak weekend hours.
• Ad-Hoc / Incident Response Scans: On-demand scans created during security investigations, eDiscovery requests, or data breach audits.

6. By Remediation Action / Automated Playbook

Scans are sometimes grouped by the automated response action assigned to findings:

• Quarantine / Auto-Redact Scans: Scans tied to automated playbooks that immediately isolate files containing high-risk data (for example, unencrypted credit card lists).
• Audit & Visibility Only: Discovery-only scans designed purely for risk mapping without altering files or triggering automated actions.

Enterprise Scan Group Examples

Here are concrete examples of how enterprise security and data governance teams configure and organize scans in Spirion Sensitive Data Platform (SDP) across each strategic framework:

1. By Regulatory & Compliance Scope

• Scan Name: COMP-PCI-CDE-Quarterly-Scan
• • Targets: Cardholder Data Environment (CDE) file servers, payment gateway log directories, and billing database tables (transactions, credit_cards).
  • Detectors / Rules: Credit Card Numbers (PAN), CVV/CVC codes, Expiration Dates.
  • Schedule: Quarterly (aligned with PCI-DSS audit cycles).
  • Agent Pool: Dedicated CDE Discovery Agent Pool (isolated PCI network segment).
• Scan Name: COMP-HIPAA-PHI-EHR-Scan
• • Targets: Electronic Health Record (EHR) network exports, medical imaging shares, and clinical department endpoints.
  • Detectors / Rules: Social Security Numbers, Medical Record Numbers (MRN), Health Insurance IDs, ICD Diagnosis Codes.

2. By Business Unit / Department (Data Ownership)

• Scan Name: DEPT-HR-Onboarding-And-Payroll
• • Targets: HR SharePoint site, HR team laptops, payroll export file shares (\\fileserver\hr_share).
  • Detectors / Rules: SSN, Direct Deposit / Bank Account & Routing Numbers, Driver’s Licenses, Passports.
  • Owner / Alerts: Sent directly to the HR Data Custodian & Compliance Officer for triage.
• Scan Name: DEPT-FIN-Contracts-And-Tax
• • Targets: Finance OneDrive repositories, accounting databases, ERP staging folders.
  • Detectors / Rules: Taxpayer ID (EIN/TIN), Bank Account Details, Credit Card Numbers, Wire Transfer Routing.

3. By Data Sensitivity & Risk Tiering

• Scan Name: TIER1-CrownJewels-Daily-Scan
• • Targets: Executive leadership OneDrive folders, M&A project shares, core production databases.
  • Detectors / Rules: Multi-match high-confidence rules (for example, SSN + Full Name + DOB), Private Keys / API Tokens, Confidentiality Agreement keywords.
  • Schedule: Daily incremental (delta) scan.
• Scan Name: TIER3-General-Corporate-Monthly
• • Targets: All general employee shared drives, intranet team sites, public-facing staging servers.
  • Detectors / Rules: Broad baseline PII rules (SSN, Credit Cards).
  • Schedule: Monthly off-peak weekend scan.

4. By Network Topology & Data Sovereignty

• Scan Name: GEO-EU-Frankfurt-Sovereign-Scan
• • Targets: Frankfurt AWS S3 buckets (s3://eu-central-1-customer-data), EU file shares.
  • Agent Assignment: Assigned strictly to the EU-Frankfurt-Agent-Pool (ensures scan data and result processing remain within EU jurisdiction for GDPR compliance).
  • Detectors / Rules: EU National Identification Numbers (NIN, IBAN, Passport numbers).
• Scan Name: GEO-US-East-DataCenter-FileShares
• • Targets: On-premises NAS/SAN storage arrays located in US-East data centers.
  • Agent Assignment: Local US-East-OnPrem-Agent-Pool to avoid pulling terabytes of data over WAN links.

5. By Scan Cadence & Trigger Type

• Scan Name: CADENCE-Daily-Delta-FileShares
• • Targets: Enterprise file shares (\\fileserver\company).
  • Configuration: Incremental Mode (only scans files created or modified in the last 24 hours).
  • Schedule: Every weeknight at 11:00 PM.
• Scan Name: CADENCE-Weekend-Deep-Archive-OCR
• • Targets: Historical archive repositories and scanned document stores.
  • Configuration: Full Scan with heavy processing enabled (deep Zip/7z archive extraction up to 5 levels, full OCR image scanning enabled).
  • Schedule: Runs Saturday at 1:00 AM through Sunday.

6. By Remediation Action / Automated Playbook

• Scan Name: ACTION-AutoQuarantine-Public-Storage
• • Targets: Publicly accessible S3 buckets, external-facing OneDrive/Box folders.
  • Playbook Rule: Auto-Quarantine & Notify. Any high-confidence finding (for example, unencrypted Credit Card list or SSN dump) immediately triggers a playbook to revoke external sharing, move the file to a secure quarantine Target, and open a High-Severity Jira incident.
• Scan Name: ACTION-AuditOnly-RiskMapping
• • Targets: Newly acquired subsidiary infrastructure during M&A discovery.
  • Playbook Rule: Read-Only / No Alteration. Generates risk heatmap reports and Tag findings without modifying or moving any files.