Data Security and Rapid Data Retrieval
There is an ever increasing number of ways to process and analyse data in the Cloud or on premise, however, the key to these tools is getting access to the data to be processed quickly and in an organised fashion so that the analytics tools can focus on the analytics rather than on data access and cleansing.
Rapid Data Retrieval addresses this issue by making data available quickly, normalised and with no coding. However, whether this is in the Cloud or on premise, there is always the mantra about data security. This is a reasonable concern but not to the extent that you don’t do it simply because you’re worried.
It has been clear for a number of years now that there is an acceptance that you cannot secure your data 100% no matter how tight your security is.
User ID , passwords, personal identity details have all shown a propensity to be hacked in surreptitious ways through the use of malware or people just innocently giving their details to people they shouldn’t. Other breaches occur through unencrypted laptops being left on a train or perhaps printed documents being thrown in the waste without shredding.
Modern Security Paradigms
While none of the above should occur, it is clear that we are human and they do. It is also clear that there are far more instances of breaches occurring within organisations than outside where there is a greater fear. Therefore the newer security paradigms are around good enough from a technology perspective so:
- Identifying people with better authentication mechanisms than a simple user ID and password such as an SSL certificate or finger print identity. Alas it seems that even the biggest organisations still continue to use user ID and passwords which are perhaps the easiest form of authentication to hack.
- Strong encryption on the wire so that your data cannot be seen as it travels across the networks.
- Robust policy based security which only allows you to access what you are entitled to see. This should ideally be role based rather than based on individual users as it’s far easier to define access policies around roles than individuals.
Analysing the systems usage
So once you have done this (and even this is not easy), what is next? What is now essential is a comprehensive logging and analysis of how users are using the applications and data in your systems.
By monitoring and analysing this logged information, it’s possible to identify behaviour that is not standard based on the role and to trigger alerts which can simply result in a phone call to the person involved or can immediately lock down the user account.
Consider your credit card company and how they work; they now disable your card if they see it being used in a way that is not compatible with what they know about you which is frustrating if you are in Hong Kong and have not been there before but better if you are not in Hong Kong and someone is using your card. This is an excellent example of acceptance that it’s impossible to get 100% so it’s all about the quality of the monitoring and logging of access.
RDR and cloud security
People tend to feel that working in the cloud is the riskiest thing that you can do with data but consider the fact that all cloud providers will have state of the art access control mechanisms and monitoring systems to track suspicious behaviour and in many cases are possibly more secure than your on-premise protection mechanisms….now there’s a thought!