Data segmentation

A non-transitory computer-readable medium having program instructions stored thereon that are executable to cause a computer system to perform operations comprising:

• generating a set of data-defined network (DDN) data structures that define a set of content classes that can be used to logically group data objects;
• using the set of DDN data structures, identifying a plurality of data objects to be grouped into a data segmentation, wherein the plurality of data objects are stored in a subset of a plurality of data stores that are in different portions of a computing network and are coupled to data managers that monitor network traffic directed at the plurality of data stores for compliance with protection policies, and wherein the data segmentation is independent of physical locations of the plurality of data objects;
• determining a baseline behavior associated with accesses of the plurality of data objects of the data segmentation;
• generating a set of protection policies for the data segmentation based on the baseline behavior, wherein the set of protection policies defines permissible types of access to data objects within the data segmentation;
• sending identifying information for the data segmentation and the set of protection policies to those data managers that monitor network traffic directed at the subset of data stores;
• determining that an attempt to access one or more data objects located within the data segmentation is inconsistent with the set of protection policies;
• and
• based at least in part on the determining, preventing the attempt to access the one or more data objects.

A method of controlling data within a computing network, the method comprising:

• receiving, by a subset of a plurality of data managers that monitor network traffic that is directed at a plurality of data stores located within different portions of the computing network, information identifying a data segmentation and a set of protection policies that is derived from baseline behavior associated with accesses of a plurality of data objects included in the data segmentation, wherein the data segmentation is independent of physical locations of the plurality of data objects;
• determining, by the subset of data managers, that a set of attempts to access one or more data objects within the data segmentation is inconsistent with the set of protection policies;
• and
• based at least in part on the determining, the subset of data managers preventing the set of attempts to access the one or more data objects within the data segmentation.