1 Background
·
Enterprise security spending is
$75B+
·
93% of enterprises feel
vulnerable to security threats
·
61% have had data breach
·
781 breaches compromising
169M records happened in 2015. This figure is rising since then.
·
$217 per record is the cost of
data breach
The proliferation of customer identifiable data processed by financial
firms drives increased scrutiny of practices to ensure end customer rights. These
regulations impose obligations and penalties for non-compliance on the
treatment of customer data, storage, distribution and access. The person’s data
access changes based on location. There is a hard requirement to lock down
customer identifiable data (CID) with infrastructure, regional, services and
people based boundaries using compliant policies.
The above stringent conditions have put the organizations on
tenterhooks and these organizations continue to spend a lot in this area. As a
result, lot of potential for outsourcing and cost savings have become difficult
to realize. Moreover, as data becomes proliferated through horizontal and
vertical lines, few organizations have a grip on what constitutes sensitive
data, where the data is lying and complete intelligence on them.
EU's GDPR regulation came into effect on May 2018. The GDPR imposes specific requirements on data controllers (for
example, Deutsche Bank or Credit Suisse) and data processors (for example, a
FinTech or IT Service provider). Both the data controller and processor are
held accountable for ensuring Subject Rights enforcement, including Right to
Access (what customer data is held, how is it processed, what is it used for
and who is it shared with), and Right to Forget. Similar laws are applicable in
the US and UK.
2 FS(Financial Services) space & Use Cases
Currently, the intelligence on sensitive data is driven by human
declarations, and process driven enforcement to policy. This can turn out to be
extremely costly for a firm in the event of a breach or non-compliance.
First, there is an urgent need to perform scientific identification the
sensitive data. Today, many financial organizations have little clue when it
comes to categorizing and inventorying the data. This has many dimensions like
attribute, location, access rights etc. Most banks tend to keep the sensitive
roles in the same location as they deal with the data. Even within the
function, the question becomes more relevant when it comes to considering
different roles.
DBAs have enhanced levels of access, not just from an application,
but also using back-end entry points such as database client applications and
scripts, and access to log files, which may contain sensitive data. In order to
unlock the benefits of right-shoring for talent and cost, the definition of DBA
security policies must provide comprehensive and effective anonymization
mechanisms to ensure DBAs, irrespective of location, access mechanism etc.. are
productive in their roles.
3 ESDM (Enterprise Sensitive Data Management) Solution
The ESDM solution is about achieving the
following:
·
Establish a complete
intelligence system on the sensitive data lying throughout the organization
·
Eliminate roadblocks in
adoption of location strategy or cloud deployments driving faster TCO (Total Cost of Ownership)
Optimization
·
Drive responsive compliance and
evidence based reporting to evolving data protection regulations
·
Achieve total protection of
sensitive data
There are many by-products of implementing
a solution on ESDM. Some of them are:
· A dynamic repository of
complete sensitive data and its whereabouts
·
Optimal access based on such
sensitive data
·
Freeing up resources at onsite
to move to other locations based on clear implementation of ESDM solution
·
Amenability for outsourcing or
elimination of roadblocks for more outsourcing
·
Elimination of barriers for
adoption of new technologies
Here are few examples of sensitive data
grouped by different categories:
1.
Personal Identification (Name,
Gender…)
2.
Address
3.
Personal IDs
4.
Customer Identification
5.
Career details
6.
Birth details
7.
Family details
Any ESDM solution should look at the entire
stack and be tool driven. Our guiding principles are:
-
- Right tool: selecting the right tool is critical. For this, a technical PoC is recommended. This can be used for verifying the usefulness of the tool, scalability of the model and the cost-benefit analysis. Possible operations for managing sensitive data could be static masking, dynamic masking and finally retirement.
- Easy adoption: Critical use cases are to be covered first.
- Scalable operating model: The service delivery model should be aligned to the outcome.
- Co-existence: The solution must co-exist in a heterogeneous environment supporting non-greenfield estate.
4 A point of view
Many products have come to address this with each one advertising various features, ability to do statics / dynamic data masking etc. Gartner has also published its ranking too. Whatever be the product, it should be used to discover the sensitive data accurately, mask
seamlessly, monitor continuously and retire securely.
The product
or tool should address the challenges posed by different environments in the
life cycle such as Test, Pre-production, Production etc. covering data, code
and the user community as depicted below.
The approach starts with the PoC,
development of business pilot, realizing quick wins before rolling out to the
rest of the organization.
Subsequently, the solution can be rolled
out to other units over the next year. By end of this, the organization has
control on its sensitive data and its usage, access and deployment. Any future
regulation in this area can be easily addressed.
Organizations should adopt ESDM culture
from top down.
Potential Benefits
They accrue
in the form of an established sets up an ecosystem with:
· Complete
inventory of sensitive data lying in the organization covering type of data, repository,
artefacts, programs accessing the data, users, locations etc.
· Ability
to consume mature IT services delivery
· Optimise
Infrastructure spend by adoption of multi-location models and platforms (Cloud)
· Clear
segregation of roles with respect to data access
· Unlocking
of previously held roles at the customer’s location to other low cost locations
after analysing and implementing a suitable solution
· Elimination
of roles that are no longer required in this connection
· Compliance
to the local laws and ability to report clearly
