Harbor Data / 02 / PRACTICE GUIDE
Sensitive-data discovery and finding validation
Separate a scan match from a validated finding. Plan coverage, blind spots, false positives and minimal sampling.
Download guide and workpapersOriginal AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.
EVIDENCE REVIEW DESK
Move from observations to decisions.
Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.
The scan finished / Incomplete decision
Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.
s => s.scanRan === trueA finished scan does not establish complete coverage. Do not generalize no findings across the organization without authorization, source scope and blind-spot evidence.
Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.
01 / EXPLANATION
Authorized discovery scope
Harbor wants to inspect a file share, SaaS repository and database. Define owner, authorization, sampling method, scan load and protection of collected records for each source. Installing a connector does not establish access to every area. Encrypted archives, unsupported formats and inaccessible repositories create blind spots. This lesson installs no connector and collects no file content. Learners separate included and excluded sources in an authorized plan instead of drawing organization-wide conclusions from one completed scan. Coverage evidence must accompany the result it qualifies.
02 / EXPLANATION
Match versus validated finding
A number sequence might be a real customer identifier, test value or unrelated text. Assess format, context, nearby fields and owner confirmation together. A confidence score is not certainty; understand what the product measures. Test with positive and negative synthetic examples. Harbor’s metadata desk accepts declared classes and performs no regex or machine-learning discovery. During actual validation, collect only necessary evidence with appropriate access so the sample does not become another uncontrolled sensitive copy. The goal is a justified finding, not a larger collection of exposed data.
03 / EXPLANATION
Roles of discovery tools
Enterprise catalogs, DLP and DSPM tools may focus on different sources and use cases. Microsoft Purview is an example product family, not a guarantee of coverage across every SaaS service, endpoint and database. Verify supported sources, licensing, deployment mode, access needs and evidence retention. Start with the business question: where is sensitive data, who can access it, or which channel permits inappropriate sharing? These are different measurements. This lesson is not a purchasing recommendation or a claim that vendor capabilities are interchangeable; tool outputs still require context and validation.
04 / EXPLANATION
Turn a finding into accountable work
A validated finding names the owner, source, affected scope, evidence reference and corrective work. Reducing copies, correcting labels, restricting access and tuning a false positive are different actions requiring appropriate authority and outcome checks. Harbor uses synthetic references rather than copied sensitive content. Revalidation states whether the same scope was compared; losing access to a source is not remediation. Track remaining gaps through ownership and dates. A discovery result does not itself establish a legal breach or reporting decision, and this local exercise makes neither determination.
Build the evidence yourself.
Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.
Full guide with code, outputs and reasoning ↓Primary references
Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.