Maximizing data value while keeping it secure
How can organizations create an environment that allows the broadest access across distributed warehouses, databases, object stores and data exchanges, while at the same time maintaining consistent data oversight?
There’s no single template for enacting robust and effective data controls. Still, it’s possible to build a unified data control framework that optimizes data sharing while elevating protection to a best practice level.
Sharing the wealth
It’s impossible to construct such a best-practice data framework without acknowledging two seemingly contradictory things: data must be easily available and accessible to those who need it, but it also must be always protected (and kept away from others who don’t need it).
Ultimately, there’s a need to focus on five critical concepts to achieve a unified data control framework:
Discovery and visibility. You can’t protect what you don’t know you have. Many organizations stumble and fail because they lack complete visibility into all data assets in clouds and beyond.
To take visibility to a higher level, it’s vital to have a catalog of all managed and shadow assets, along with their owners, locations, security and governance measures enabled for the data. Without a central repository and a single view, there’s no way to know what data exists, how it’s stored, where it’s used and how it’s shared. Essentially, an organization winds up flying blind.
Yet the advantages of robust discovery and visibility don’t stop there. With this information it’s possible to adapt and expand security profiles as needs and conditions change.
Auditing access to shared sensitive data. Sharing data in the cloud involves complexity and risk. That’s a given. To maximize the opportunity—including harnessing the full functionality of cloud-native tools—an organization must know who is accessing data and how they are using it.
Therefore, a robust identity management framework is crucial. Administrators and others must be able to analyze roles and permission settings in data assets that reside in clouds and across multi-cloud frameworks. The ability to map this data and audit usage helps deliver a more complete picture of the environment. It’s possible to spot weaknesses and vulnerabilities before they become full-fledged problems.
Optimizing permission settings. Ensuring that a data protection model enforces minimum privileges and permissions for people, applications, systems or connected devices can prove daunting.
A least privileged model is vital in today’s shared data frameworks. Without it, users of shared data can have many unintended routes to access, including through inherited permissions.
Consequently, it’s important to have tools in place to identify who has access to data—but also the ability to easily change access and permissions. Some tools can spot issues, make recommendations, and even close vulnerabilities—often using highly automated and efficient processes.
Detecting data access anomalies. Controlling who has access to sensitive data helps protect it. Yet, these permissions and protections aren’t infallible. For instance, an unsanctioned internal or external user who gains access to a real profile with valid credentials can do severe damage.
The solution? It’s essential to have a way to detect and flag anomalous behavior. This includes software that can spot unusual patterns, such as when a user is downloading large volumes of data, or the network is behaving in an unusual way. With these tools, it’s possible to take swift and decisive action—before the situation deteriorates.
Masking of shared sensitive data. Data sharing isn’t an all-or-nothing proposition. Oftentimes, it’s necessary to share certain data but limit what different users can see and use. Data masking can do this.
The best frameworks automate the classification of sensitive data across all columns and within all tables of critical systems. This includes multi-cloud environments such as Google BigQuery and Snowflake. Behind the scenes, a centralized policy engine simplifies tasks for data stewards and others, including handling policy grammar.
Security equals business value
Although every organization must blaze its own path when it comes to data sharing and data protection, there’s a common denominator: strong governance and robust security are at the center of monetizing data.
As clouds and multi-cloud frameworks proliferate, agility, flexibility and comprehensive unified data controls aren’t negotiable. Locking down sensitive data in the enterprise and beyond is at the foundation of minimizing risk and maximizing business results.