MENTIS iDiscover

MENTIS is a data and application security platform that offers a range of modules that cover all necessary functions for discovering, protecting and monitoring sensitive data, regardless of the use case. For the purposes of this paper, we will be focusing on the sensitive data discovery capabilities MENTIS offers via its iDiscover module. Other modules include iSubset (data subsetting), iScramble (static data masking), iMask (dynamic data masking), iRetire (data retirement) and iMonitor (data monitoring). These modules are all delivered via the MENTIS engine. Each one (including iDiscover) can be used either by itself or with any number of others, and metadata can be freely shared between them.

We will also discuss the complementary discovery capabilities provided by MENTIS’ iSecure API. In contrast to the modules described above, it does not sit within the MENTIS engine; rather, it works in tandem with it to provide NLP (Natural Language Processing) driven data discovery and rules-based anonymisation.

Once MENTIS is deployed, users can interact with it via an application server. The MENTIS engine itself can be hosted on-premises or, if you are running an Oracle agent, in the cloud via Amazon EC2. Regardless, it can integrate with data sources located both on-premises and in the cloud. It includes support for the mainframe, big data, and unstructured data as well as relational data. MENTIS products are available via perpetual license, subscription, or as a service.

Customer Quotes

“We could never have found all the sensitive data locations that were identified by MENTIS discovery… even with 22 years of PeopleSoft application knowledge.”
Fortune 15 US head quartered conglomerate

“MENTIS Sensitive Data Discovery is an incredible solution. The number of false positives is around 10%.
The application it replaced has 85% false positives.”
Top Swiss Bank

Mutable Award: Gold 2020

iDiscover profiles and classifies your data. In doing so, it discovers the sensitive data within your system, as well as the users and programs that have access to that data. Notably, it offers several distinct methods for data discovery, including dictionary matching, pattern matching, data matching and even code matching. Although each of these methods can be used individually, in general you will want to (and, in MENTIS, are able to) combine many or all of them while looking for sensitive data. For each method used, MENTIS will estimate the likelihood that – according to the method in question – your piece of data is sensitive. If multiple methods are used, this will increase accuracy and reduce the number of false positives.

MENTIS also offers an additional discovery method, based on NLP, via the iSecure API. This capability leverages NLP and NER (Named Entity Recognition) based on the spaCy.io library as an additional method for discovering sensitive data. The actual process for this is not dissimilar to using iDiscover: iSecure discovers entities within your data and exports that information to the MENTIS engine, which in turn scores those entities using NLP, as well as other MENTIS methods, as above. iSecure can also be used for masking these entities, but that discussion extends beyond this paper’s remit.

Fig 01 – MENTIS dashboard

In addition to multiple discovery methods, the product also offers a choice of full scans (covering your entire database), sample scans (a selected number of rows) and incremental scans (updated or new tables). The results of the discovery process are presented via a visual dashboard as seen in Figure 1. Notably, you can drill down into these results to see how and why your data was classified as it was. You can also
see a ‘snapshot’ of the state of your system (see Figure 2) as well as a history of the same.

Fig 02 – System summary in MENTIS

iDiscover supports a wide variety of data sources and formats which now includes unstructured data, although at present this is limited to data located on file servers or accessed via REST APIs. In particular, it does not currently include NoSQL databases. Even so, this is a notable step forward given the inherent difficulty of classifying unstructured data (for which NLP based discovery is particularly useful). For file servers in particular, a file gateway is used to transfer metadata and file data from the server to the MENTIS engine, which converts them to Oracle tables before performing the discovery process as normal.

Whenever possible, MENTIS will discover your sensitive data using an agent. This classifies data where it sits, without needing to bring it inside the MENTIS engine (only metadata is moved). This method is favoured because it is highly performant (MENTIS estimates it as 3-4 times faster than the alternative), scalable and parallelisable, allowing you to scan any number of data sources concurrently and in a federated fashion, while also enabling compliance with corporate policies that restrict unnecessary data movement. Unfortunately, this feature is not universally available, although several data sources, including Oracle and SQL Server, are currently supported.

MENTIS is appealing in part because it is not just a point solution, but a complete data security platform: sensitive data discovery is simply one feature among many. Therefore, if you are interested in data security, data privacy, data retirement (for example, to comply with GDPR) and so on, MENTIS will provide a solution for those as well. Moreover, the modular nature of the platform means that you only need to license the products that are relevant to your use case(s).

Beyond that, MENTIS’ faculties for discovery and classifying data is its standout feature, even as a platform. For example, the discovery options on offer, such as the ability to introspect code, or to classify data using NLP, are highly advanced and sophisticated. On top of that, MENTIS supports a wide variety of data sources and formats, including relational databases, documents, spreadsheets, flat files, CSV, XML and JSON.

The Bottom Line

MENTIS is a broadly capable data security platform with excellent data discovery capabilities that can now be brought to bear on both structured and unstructured data.