Data Security Posture Management (DSPM) and databases build a unified cloud data security operations view, enabling you to gain full visibility into the distribution and access of cloud data assets and sensitive data. By combining cloud-native behavior logs with a dynamic risk detection engine, the system performs end-to-end monitoring of public and private network entry points, covering asset discovery, access permission control, and risk identification. This enables data assets to be visualized, controlled, and precisely protected, ensuring data security and compliance in the cloud and truly achieving "visibility, controllability, and precise defense."
Key Data Security Issues
Data assets have blind spots and are difficult to manage: data such as tables, files, code, and images is scattered, with no asset catalog and unclear ownership. For example, sensitive buckets may be publicly exposed or internal databases may be exposed to the public network, resulting in low management efficiency and high compliance audit pressure.
Data access is opaque and traceability is costly: there is no unified view of key information such as who accessed the data (public/private IP addresses), through what means (accounts/APIs), which data was called, and which files were operated on. Administrators need to manually piece together logs across multiple platforms, resulting in low traceability efficiency and a high risk of missing the golden window for response.
Data risks are difficult to locate and response priorities are unclear: traditional rule engines rely solely on single-point feature matching and cannot identify combined behavioral risks (such as public network access + sensitive data + batch downloads). Enterprises often suffer from "alarm fatigue," making it difficult to determine response priorities and quickly contain the impact.
Permissions are difficult to clean up when they remain in place, leading to a high risk of leakage: in scenarios such as employee departure or third-party collaboration, if temporary account permissions are not revoked in a timely manner, sensitive data can easily be leaked due to lapses in account and password management.
Use Cases
Core data asset protection: perform full access auditing on sensitive data in cloud databases (such as personal information and transaction records) to provide traceability evidence for events such as data leakage and unauthorized access.
Cybersecurity Classified Protection Compliance and Regulatory Adherence: meet the requirements of laws and regulations for log retention and auditing capabilities, as well as the compliance audit needs of industries such as finance and telecommunications for cybersecurity classified protection standards.
Database attack and risk monitoring: monitor and alert on malicious activities targeting databases in real time, enabling in-process blocking and post-incident accountability.
Ops and development security auditing: audit high-risk operations performed by Ops personnel through tools such as the console (for example, DROP/ALTER and batch export). At the same time, identify risks in development and testing environments caused by sensitive data exposure or unauthorized export.
Advantages
Access relationships at a glance: access relationships are visualized and clearly displayed.
All operations are traceable: every database operation is recorded, supporting post-incident restoration.
Real-time risk monitoring: monitor abnormal access and sensitive operations in real time to promptly identify potential risks.
Automatic sensitive data discovery: proactively identify the distribution of sensitive data to provide a basis for permission reduction.
Billing Instructions
CDS uses a prepaid yearly/monthly subscription model and is sold in packages. You can select an appropriate number of packages based on your actual needs. The billable items and billing standards are listed in the following table. For detailed billing instructions, see CDS Billing Instructions. Note:
Packages are billed using tiered pricing (flat rate for all). When the total number of active packages under an account falls into a corresponding tier, all packages are billed uniformly at the per-package price of that tier, rather than using a progressive pricing model. (Monthly total cost = total number of active packages × monthly per-package price of the current tier)
Each Enterprise Edition supports binding one database instance and includes an audit throughput of 1,000 SQL statements/second, 20 million online SQL logs, and 100 GB of total storage space. When online logs reach 20 million entries or online storage utilization reaches 80%, the system automatically archives older logs. When total storage reaches 100 GB, the system automatically cleans up the earliest backup logs to ensure continuous writing of new logs. When SQL throughput exceeds 1,000 statements/second, the excess traffic will be throttled and dropped.
Each log storage expansion pack adds 1 TB of storage capacity. The purchasable quantity and stacking rules are subject to the purchase page. Expansion packs only increase storage capacity and do not increase the number of online SQL logs or audit throughput. They must be used together with an active CDS Enterprise Edition package.
|
Enterprise Edition | 1 - 3 sets | USD 280/set/month |
| 4 - 20 sets | USD 270/set/month |
| 21 - 50 sets | USD 255/set/month |
| 51 - 100 sets | USD 240/set/month |
| 101 - 200 sets | USD 225/set/month |
| 201 - 300 sets | USD 210/set/month |
| 301 - 400 sets | USD 195/set/month |
| 401 - 500 sets | USD 180/set/month |
| More than 500 sets (excluding 500) | USD 150/set/month |
Log storage expansion pack | 1TB | USD 150/month |
Supported Versions
TencentDB for SQL Server supports CDS on both cloud disk architectures (two-node, RO instance, single-node, and multi-node) and local disk architectures (two-node and RO instance).
TencentDB for SQL Server 2012 Enterprise and later editions support CDS.
Region Dimension
The regions where TencentDB for SQL Server supports CDS are: Guangzhou, Shanghai, Beijing, Nanjing, Chengdu, Chongqing, Shanghai Finance, Beijing Finance, Shenzhen Finance, Tokyo, and Frankfurt.
Documentation
|
Purchase Data Security Audit | Describes how to purchase CDS in the console. | |
Enable or Disable Data Security Audit | Describes how to enable/disable CDS in the console. | |
Data Identification | Describes operations related to the data identification capability of CDS. | |
Access topology | Describes the CAM capability of CDS. | |
Audit logs | Describes the audit log capability of CDS. | |
Alarm | Describes the alarm capability of CDS. | |
Risk | Describes the risk monitoring capability of CDS. | |