SPIglass™ Dashboard

 

Overview

The Sensitive Private Information Dashboard (SPIglass™) Dashboard is a dashboard with a specific focus on:

  • Key metrics

  • Findings of interest to board members or executives

Each chart depicts a high-level roll up of data that reveals insights into your sensitive, personal, and private data, and where to focus when managing this data.

Compensating Controls

Compensating Controls: Displays the total cost of all sensitive data matches with compensating controls in place. These include:

  • Restricted Access

  • Script Execution

  • Quarantine

  • Ignore

  • Playbook User Action

Note: All costs are taken from the dollar value assigned to each data type in the global data types settings in the Data Asset Inventory. See Working with Data Asset Inventory for more information.

Remediated Risk

Remediated Risk: Displays the total cost of all sensitive data matches that have been found and subsequently removed from view via the shred or redact process.

  • Data Type:

    • Dollar Value (Default $8.00)

  • Leverage Playbook Actions:

    • Shred

    • Redact

Note: All costs are taken from the dollar value assigned to each data type in the global data types settings in the Data Asset Inventory. See Working with Data Asset Inventory for more information.

Organizational Data Risk

Organizational Data Risk displays all the scanned data in your environment.

The data is displayed by:

  • Inherent: Represents all sensitive data identified.

    • Displayed in the colored portion of the outermost bar

    • Measurement (volume) is indicated in the center of the circle labeled Sensitive Data.

  • Compensating Controls: Data that has some form of Compensating Controls in place (Managed Data in SDP).

    • Displayed in the colored portion of the middle bar.

    • Managed data represents a percent of sensitive data that has been addressed in one of the following ways:

      • Restrict Access

      • Script

      • Quarantine

      • Ignore

      • User Action

  • Residual: Displays deleted data in your environment that is exposed.

    • Displayed in the colored portion of the innermost bar

    • This is specifically matched data that still in the your environment and has not been managed to reduce accessibility or remediated.

Note: The total of Compensating Controls data and Residual data is equivalent to the total Sensitive data, but will likely not be equivalent to the total Scanned data.

Sensitive Data Distribution

  • Displays the five data types with the most matches and all other data type matches shown as Other.

  • Hover over a section to view more detail.

  • Click Details to view the Sensitive Data Distribution across all repository types.

  • This displays the version of the Scans Dashboard Sensitive Data Distribution chart. (See Using Scans Dashboard for more information.)

Inherent Risk

Inherent Risk displays the risk of the data in your environment at any given point in time.

  • It is the combination of Compensating Controls data and Residual data (Residual data, also known as ambient data, refers to information that remains on storage devices even after attempts to delete or erase it).

  • All Remediated items are filtered out as they are no longer At Risk

  • The File Count is Managed vs Unmanaged (Playbook Actions for Managed Data)

  • Y Axis

    • Indicates the total number of locations with sensitive data

    • Total Residual Data is represented stacked on top of the total Compensating Controls data

    • Residual Data is represented in Alert Pink

    • Compensating Controls data is represented in Amber

  • X Axis

    • Indicates the month of the year in which the inherent risk was at the level indicated on the Y axis.

Repository Type Risk

  • Repository Type Risk displays the SDV3™ risk score of each repository type in your environment (Asset Assignment for all Scanned Targets)

  • The score is calculated by averaging the risk score associated with all assets within a specific repository

Note: This feature requires that Data Type Values and Asset Security Measures are entered.

  • Repository Types: You can hover over a type to view its details:

    • Cloud

    • Email

    • Local (Scans)

    • Database

    • Files & Folders (Remote Scans)

    • Website

    • Collaboration Tools

  • Repository Type Risks score is indicated by the relative square size in the chart

    • Each square is color-coded based on a set risk score threshold with the highest risk score always highlighted in Alert Pink

  • The Risk/Monetary toggle enables you to display the chart by monetary value, which may not correspond with the highest risk if the repository has a low vulnerability but a high value

  • The monetary values are indicated in the chart in the same manner as risk score

Areas of Exposure

Areas of Exposure displays the total sensitive data matches in each department as identified in the Data Asset Inventory (DAI).

  • Sensitive data distribution (by percent %) by department

  • Percent of each data type for Total Findings (Scan for Data Types)

  • Areas of exposure for each department

  • Asset department assignment in Data Asset Inventory

    • Department examples: Administration, Finance, IT, Dev

  • Scanned Targets assigned to assets in Data Asset Inventory

  • Each section represents a department or matches without a corresponding department

  • Hover over a section to view a total match count of each department

  • The total match count for the environment is displayed in the center of the chart

  • The legend lists the percent of matches for each department

    • For example: Human Resources, Sales, Engineering, etc.

Regulation Exposure

Regulation Exposure displays the dollar value and match count of data identified in Assets with a regulation property.

  • Regulation Exposure: GDPR, HIPAA, etc.

  • Asset Regulation Assignment in Data Asset Inventory

  • Scanned Targets Assigned to Assets in Data Asset Inventory

  • The dollar value of each regulation is indicated by the size and color of the squares in the chart

  • The highest Dollar value is always depicted in Alert Pink

  • Hover over a section for more detail


Note: For Regulation Exposure to be accurate, you must set up Assets in your Data Asset Inventory (DAI) and include relevant regulations. (See Getting Started with DAI for more information.)