Levels of Data Protection

Wednesday, I spoke at ISSA’s monthly chapter meeting in Colorado Springs. Speaking at ISSA chapter events is great, because it’s always an intelligent crowd that quickly grasps issues around data governance.

At this particular event I gave a presentation on how we can reduce organizational risk by leveraging metadata and automation—coincidentally enough, two things that Varonis excels at. The basic argument was that data protection centers around three control areas:

• Authentication
• Authorization
• Access Auditing and Analysis

Authentication is the mechanism by which we identify that the person who’s trying to access a system—in this case our unstructured and semi-structured data—is who he says he is. This is something we have a lot of good options for. With strong passwords, one-time password tokens, biometrics and other authentication factors, an organization can have reasonable confidence about who’s actually accessing the data.

The next step control area is authorization, which is making sure that the user is actually allowed to access the data. Unlike authentication, this is usually much harder. If a SharePoint site is open to Authenticated Users, for example, we’re not making any attempt at authorization since we’re assuming everyone who’s authenticated is also authorized, which isn’t always the case. Much of what we do with data governance is helping to increase the accuracy and effectiveness of our authorization. Making sure only the right people have access to the right data means making sure that only the right people are authorized.

The final control area is access auditing, which is about ensuring that the controls we’ve put in place for authentication and authorization are working as designed. With unstructured data, a complete audit trail of file activity traditionally hasn’t been available, which has meant it’s been difficult to audit the access to that data,  difficult to check potential access against actual access, and difficult to spot possibly abusive behavior.

The presentation we gave at ISSA showed how an automated data governance solution can be used to address these data protection levels. We’ll share some of the specifics in future posts.