数据分类体系实战指南：用 GitHub Copilot 的 data-breach-blast-radius 技能构建敏感数据分级清册

数据分类体系实战指南：用 GitHub Copilot 的 contenteditable="false">【免费下载链接】awesome-copilotCommunity-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot.项目地址: https://gitcode.com/GitHub_Trending/aw/awesome-copilot

导读

本文以># Sensitive fields typically appear in models.py class User(models.Model): email = models.EmailField() # Tier 3 date_of_birth = models.DateField() # Tier 2 (combined with name) ssn = models.CharField(max_length=11) # Tier 1

8.2 TypeScript / Prisma

model User { email String // Tier 3 phoneNumber String? // Tier 3 dateOfBirth DateTime? // Tier 2 (when combined) cardNumber String? // Tier 2 PCI-DSS }

8.3 Java / Spring / JPA

@Entity public class Patient { @Column(name = "diagnosis") // Tier 1 PHI private String diagnosis; @Column(name = "ssn") // Tier 1 private String ssn; }

8.4 C# / EF Core

public class UserProfile { public string Email { get; set; } // Tier 3 public string PassportNumber { get; set; } // Tier 1 public DateTime DateOfBirth { get; set; } // Tier 2 }

8.5 日志语句模式（高风险——最常被忽略）

# BAD — logs PII logger.info(f"User {user.email} logged in from {request.remote_addr}") logger.debug(f"Payment for card {card_number}") # Look for these in logging calls: # .info(), .debug(), .warn(), .error(), console.log(), System.out.println()

依据：hardening-playbook.md 明确：邮箱、IP（须掩码最后一段）、全名、电话等 Tier 1–3 字段不得进入结构化日志；安全可记的是内部 UUID、短期会话 ID、事务/关联 ID、错误码、时间戳、HTTP 状态码与耗时。从日志中移除 PII 可使日志暴露向量爆破半径降低 40–60%。

8.6 API 响应泄露（序列化器 / DTO 模式）

// Check if these fields are included in response objects // even if not requested — over-fetching is a common exposure vector { "id": "...", "email": "...", // Tier 3 "phone": "...", // Tier 3 "dateOfBirth": "...", // Tier 2 — should this be returned? "passwordHash": "...", // Tier 1 — should NEVER be returned "ssn": "...", // Tier 1 — should NEVER be returned }

依据：过度抓取（over-fetching）是常见暴露向量。加固方案是显式投影（.select('id name email createdAt')）或 Pydantic/DTO 响应模型，将 Tier 1 字段从响应中剔除，可降低受影响字段 85% 的爆破半径。

九、聚合风险评估：组合攻击

分类体系的关键洞察：数据在组合后变得更加敏感。必须始终以组合视角评估字段，而非孤立判断：

规则：评估字段时永远考虑组合，而非只看孤立值。

这条规则在评分侧有硬性体现：blast-radius-calculator.md 规定——当同一暴露向量中出现来自不同等级的 3 个及以上字段时，在最高等级权重基础上+0.5（聚合攻击加成）；同时"完整性因子"（Completeness Factor）也区分了"完整档案（1.0）"与"仅邮箱（0.5）"的差异，完整身份记录比孤立字段的暴露后果严重得多。

十、从清册到报告：分级如何驱动完整分析闭环

data-classification.md在 contenteditable="false">【免费下载链接】awesome-copilotCommunity-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot.项目地址: https://gitcode.com/GitHub_Trending/aw/awesome-copilot