Align Data Governance with Business Goals in Streaming Era

Compliance in Motion:
Aligning Data Governance Initiatives with
Business Objectives in the Streaming Era
Paige Bartley,
Cameron Tovey,

2
Cameron Tovey is the head of information security at Confluent. With
nearly 20 years of experience protecting data, he ensures that Confluent’s
information security program is complete and running smoothly. Before
Confluent he protected data for technology startups, healthcare
organizations, retail companies, banking institutions and other Fortune
100 entities.
Cameron Tovey
Head of Information Security, Confluent
Paige specializes in all aspects of the data lifecycle including creation,
cleansing, security, privacy and productivity. Working across the
information management space, Paige researches how data use affects
both large organizations and individuals alike. Paige’s other areas of
expertise include regulatory and legal matters, data preparation, data
quality, unstructured data, master data and records management, as well
as neuroscience and cognitive science.
Paige Bartley
Senior Analyst, Data and Enterprise Intelligence, Ovum

3
Session Overview
● This session will be one hour
● The last 10-15 minutes will consist of Q&A
● Submit questions by entering them into the GoToWebinar panel
● The slides and recording will be available

Ovum | TMT intelligence | informa4 Copyright © Informa PLC
GDPR: The Business Challenge…
and Opportunity

GDPR was designed to give consumers and citizens more control over the personal data that, today, is
increasingly part of the exchange for goods and services.
▪ Personal data under GDPR has a broader definition than personal data under existing regulations.
▪ Personal data = any data that can directly, or indirectly, identify a natural person
A Very Brief Overview of the EU’s General Data Protection Regulation (GDPR)
Goods and Services
Personal Data
“This Regulation protects fundamental
rights and freedoms of natural persons
and in particular their right to the
protection of personal data.”

Does GDPR apply to my organization? Yes, if it:
▪ Has customers that are EU residents
▪ Has employees or contractors that are EU-based
▪ Markets or advertises to EU prospects
▪ Collects personal data from EU residents
Fines exist in two tiers depending on severity of the violation:
GDPR is Global in its Reach, with Enforcement Across Borders
(Less Severe) 2% annual global revenue, OR €10 million
(More Severe) 4% annual global revenue, OR €20 million
Fines
Lawsuits
Reputational Damage

Because of business pressure, many countries are modeling their own data protection policies after GDPR.
GDPR Has Started a Global Trend of Data Protection Regulation
Regional motivation for adopting policy mirroring GDPR:
Outcomes:
• Proliferation of slightly different regulations across different regions
• Increasing consumer awareness of data privacy and data rights
• Increasingly complicated regulatory landscape for the enterprise
GDPR-Modele
d Regulation
EU Adequacy
Decision
Facilitated
Data Transfer
Lower Cost of
Doing
Business

GDPR’s core objective is to protect the rights and freedoms of natural persons.
However, the core technical requirement to achieve this is the absolute, granular control of data.
To fulfil subject rights, the enterprise must be able to:
▪ Know where all personal data resides in the IT ecosystem
▪ Associate all relevant data with the correct person/identity
▪ Restrict access to data based on employee roles and data attributes
▪ Quickly and efficiently delete or modify data if necessary
▪ Keep an audit trail and lineage of all data-related activities within the enterprise
The Core Requirements of GDPR and Data Protection

This level of understanding and control
requires end-to-end management of the
data lifecycle, from the point of data creation,
to consumption, to disposition.
• Data-in-Motion
• Data-at-Rest
GDPR Requires End-to-End Data Control
Data
Ingestion
Data Storage
Data
Consumption
Data
Disposition
Data
Creation
Data
Lifecycle

Complete control of data is the foundation for all data leverage within the enterprise.
▪ Data control for “reactive” purposes: compliance
▪ Data control for “proactive” purposes: data exploitation
Better control of data results in better data-driven outcomes:
→ Improved data quality
→ More accurate analysis
→ Facilitated self-service
→ Reduced processing times
→ Opportunity to build consumer trust
The Business Opportunity of Compliance

Two Top IT Trends Share the Same Common Requirement

Aligning Compliance Objectives with Business Objectives
The enterprise can benefit from
compliance if it is aligned with
existing business objectives.
Any business initiative that benefits
from the control of data will benefit
from a robust data privacy and
compliance program.

Compliance requires an orchestration of people,
process, and technology across the organization.
Challenges to enterprise-wide coordination and
alignment with business objectives include:
▪ Poor communication across teams/units
▪ Lack of robust IT integration
▪ Proliferation of specialty point solutions
▪ “Checkbox” mentality towards requirements
Compliance Efforts Cannot be “Siloed,” Organizationally or Technically
People
• Roles, titles, responsibilities
• Positive team dynamics
Process
• Building efficient workflows
• Effective task management
Technology
• Ensuring IT integration
• Contributing to control of data

Streaming Data: A Growing Need
for Governance

GDPR does not differentiate between streaming data and data-at-rest when it comes to data privacy and
protection for personal information.
Examples of data protected by GDPR:
▪ Sensor data related to health metrics
▪ Data from wearables
▪ Certain social media activity data
▪ IP address data
Streaming Data Falls Under the Protection of GDPR
Streaming Data
Requirements for control:
▪ Records of how data was processed
▪ Who handled and accessed data
▪ Full data lineage and audit capabilities
▪ Documentation of retention periods
▪ Ability to restrict access based on user

To fully reap the benefit of real-time and streaming data
sources while avoiding compliance risk, the enterprise
needs to have granular control of data access, data
sovereignty, and lineage.
All of the following depend on understanding the full data
lifecycle:
▪ Result reproducibility
▪ Accurate ROI calculation
▪ Demonstration of compliance
Data Control: It’s NOT just about GDPR
Data Control
• Data-in-Motio
n
• Data-at-Rest
Proactive
Benefits
• Accuracy
• Visibility
• Data quality
• Self-service

Streaming data is left inadequately governed by many organizations.
Governance of the Full Data Lifecycle is Needed
Creation
Ingestion
Storage
Consumption
Disposition
Traditional data governance frameworks and technologiesUnderserved data governance needs

Apache Kafka has emerged as a leading open
source distributed streaming platform for the
enterprise.
Kafka is following a maturation curve common to
nearly all open source technologies.
→ Initial focus on use cases and business problem
→ Secondary focus on integration and compatibility
→ Tertiary focus on governance and security
Apache Kafka: A Streaming Platform, Still in the Process of Maturing
Apache Kafka, in its native form, currently lacks
certain governance and security features:
▪ Lacks group or role-based security support
▪ Does not currently track data lineage
Like most maturing open source
technology, Kafka has “rough edges”
in terms of enterprise-grade
governance and security features.

Following a similar maturity curve to Hadoop, Apache Kafka is now supported by commercial software that
helps fill in its gaps for security and governance.
Commercial products help provide:
▪ A polished front-end for management and administration
▪ Integration capabilities to embed streaming data enterprise-wide
▪ Centralized monitoring of performance and replication
▪ Optimization of resource utilization and reliability
Commercial products provide the tooling that help “operationalize” streaming data in the enterprise.
Commercial Software Helps Fill Kafka Functionality Gaps

Without commercial software to support security and governance in Kafka, the enterprise must rely on
extensive hand-coding.
This poses several challenges:
▪ Slow, tedious process
▪ Bottlenecked with skilled users
▪ Prone to human error
▪ Not easily scalable
Challenges Face the “DIY” Streaming Open Source Approach
Native Kafka
Hand-Coding
Commercial
Software
Support
Integrated
Governance

Operationalization: the scaling of infrastructure and processes throughout the entire organization, so that
so that anyone, in any role, can contribute directly or indirectly to the creation of business value.
Without strong data governance and data control, operationalization of any data initiative will fail.
Operationalization: The “Holy Grail” for Data Initiatives
Data Initiative Outcomes of Operationalization
Compliance Shift from cost center to profit center. Strengthened consumer trust. Better data quality.
Streaming Data Contextual insight: streaming + historical data. Streaming data leverage across business units.
Self-Service Reduced end user dependency on IT. Rapid time to accurate insight. Crowdsourced knowledge.
Machine Learning & AI Rapid model development and deployment. ML & AI leveraged consistently in business decisions.

3 Tips: Aligning Enterprise
Objectives with Compliance

1
▪ A process-based framework first needs to be defined to support the achievement of business objectives
▪ Technology will fit within this framework, not determine it.
▪ Ensure that related business objectives “piggyback” off of each
other and share processes and human roles
▪ Avoid silos: the technological kind, and the communicative organizational kind
▪ Technology should facilitate existing processes and roles, not vice versa.
▪ Processes should not have to be radically reshaped to accommodate technology tools.
Technology should facilitate existing processes, not force the creation of new ones.
1: Define and codify human processes first, implement technology second

2
▪ Build a list of all relevant stakeholders in the compliance and data leverage process.
▪ IT, line of business, risk and compliance, security, privacy, legal; even business end users that consume data should have a representative to
speak on their behalf
▪ Ensure adequate communication between parties.
▪ Agree on objectives for the business, and for data’s role in the business.
▪ The organization will likely find that most of these objectives all require better control of data.
▪ Build use cases that can be “sold” to high-level leadership. Focus on data control.
▪ What can be achieved with better control of data? What use cases would be possible? What is the potential ROI?
What potential risks can be mitigated?
Compliance should NOT exist in a bubble. Compliance requirements “touch” all business units.
2: Get all relevant stakeholders at the table, and buy-in from leadership

3
▪ Streaming data and data-in-motion are often overlooked by
the enterprise when it comes to security and governance.
▪ Take stock of all data types ingested, processed,
consumed, and stored within the enterprise.
▪ Evaluate the level of control that can be applied to
these varying data types. Do differing data types have
equal control mechanisms?
Streaming data needs to be governed with the same rigor as data-at-rest.
3: Ensure equal governance for ALL data types within the enterprise
Data Governance
Framework
Data-in-Motio
n
Data-at-Rest

3
Questions to considers when evaluating mechanisms for data control:
▪ Can personal data be consistently identified among other non-sensitive data types?
▪ Is encryption used for both data-in-motion and data-at-rest?
▪ Can lineage be tracked for both streaming data and historical data?
▪ Can access controls be consistently applied based on user role or data attribute, across data sources and repositories?
▪ Is there a central platform or “pane of glass” for the administration of data policies?
The more control of data can be centralized, the more streamlined the governance process is.
3: Ensure equal governance for ALL data types within the enterprise (cont.)

27
What is driving compliance in your organization?
Confluent
Cloud
Managing risk
Shortening the
sales cycle

28
Managing Risk
Governmental Regulations:
● General Data Protection Regulation (GDPR)
● Health Insurance Portability and Accountability
(HIPAA)
● Federal Risk and Authorization Management
Program (FedRAMP)
Many organizations must address these regulatory
requirements, either by directly processing or storing
protected information, or by their customers’ need for
them to process or store protected information.
Data Protection Standards:
● ISO/IEC 27000 series standards
● Payment Card Industry Data Security Standard
(PCI DSS)
● Service Organization Control 2 (SOC 2)
The ability of these standards to change at a
reasonable rate to match and stay inline with industry
trends is what helps them remain applicable and
reusable in an effective data security and compliance
program.

30
Regulations and Standards
Health Insurance Portability and Accountability (HIPAA)
Health Information Technology for Economic and Clinical Health Act (HITECH)
Compliance with this regulation includes performing a gap assessment to understand what holes need to
be fixed in order to properly comply, putting together and beginning implementation on a remediation plan.
General Data Protection Regulation (GDPR)
This European regulation identifies the rights of individuals to request a copy of, make changes to or have
personal information completely deleted from systems. It also requires clear communication to individuals
regarding the purposes for which their information is being used.
Federal Risk and Authorization Management Program (FedRAMP)
Federal Information Security Modernization Act (FISMA)
The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that
provides a standardized approach to security assessment, authorization, and continuous monitoring for
cloud products and services. Required by U.S. government entities for cloud services, FedRAMP requires
implementation of National Institute of Standards and Technology (NIST) standards for data protection.

31
Regulations and Standards
Payment Card Industry Data Security Standard (PCI DSS)
PCI DSS has specific technical requirements designed to protect credit card data used in processing
payments. It strictly controls which pieces of data normally contained on the magnetic stripe of a credit
card may be retained by a company and what controls must be in place in order to do so.
Service Organization Control (SOC 2)
Defined by the American Institute of Certified Public Accountants (AICPA), this audit standard provides an
external and independent assessment of a service provider’s controls environment. Well recognized in the
U.S., this audit assessment covers how well a security program has operated their security controls over a
period of time.
ISO 27001 & ISO 27018
The International Standards Organization (ISO) has provided guidance on how to implement an effective
information security management system (ISMS). The 27001 standard provides requirements for
establishing, implementing, maintaining and continually improving an ISMS. The 27018 standard focuses on
protection of personal data in the cloud.

32
Three Pillars of Data Protection
Data is only
accessible to
those to whom it
is intended.
The ability to
access data at
the moment
required
Ensuring that
data does not
change
inappropriately
Confidentiality Availability Integrity

33
Emerging Technology
Streaming Technology
● Confidentiality
● Integrity
● Availability
● Authentication
● Authorization
● Audit/Non-Repudiation/Logging
Cloud Services
● Shared Responsibility Model
● What does your provider control?
● What controls do they evidence for you?
● Are their controls good enough for you?
● What do you control?
● What are your requirements for the
things in your control?

34
Confidentiality – What controls are available for data confidentiality?
● Does the system encrypt data in transit?
● Does the system encrypt data at rest?
● How are these accomplished?
● Does the system provide role-based access controls?
● Does the system integrate with directory services or use single sign-on (SSO)?
Integrity – What controls are available to maintain data integrity?
● Who has access to make changes?
● How do you know your data is accurate?
● What is the backup model (i.e., traditional data or system backups or distributed copies of data)?
● How long does it take to recover from a problem?
Availability – What controls are utilized for availability and performance scaling to accommodate growth?
● What level of service is guaranteed?
● How do I measure compliance with your commitments for uptime?
● What is your plan to resolve issues in the event of downtime?

35
Authentication – What controls are available to authenticate both customer users and service provider users?
● Can customer authentication services like LDAP, Active Directory or single sign-on be integrated?
● Can password and other authentication settings be managed by the customer?
● Can users utilize multi-factor authentication?
● How do automated processes integrate with the service?
● How are authentication credentials protected?
Authorization – What different activities can the customer control or limit?
● Are role-based controls available?
● Are roles able to be defined to match my organization in your system?
● What are the critical functions that should or could be limited?
● Is the ability to limit read, write, delete, and administration functions available?
Audit – How can a customer monitor access and changes to data and environments?
● Are system activities logged?
● How are these logs available to the customer?
● Are the logs available in a format that can be automatically consumed and processed by customer
systems?

36
Cloud Services
Shared Responsibility Model
Responsibility for security of data and systems deployed in any cloud provider is always shared.
Cloud Service Provider Controls
There are controls clearly provided by the cloud service provider over which the customer has little or
no influence.
Optional Controls
There are controls made available by the cloud service provider which the customer can choose to
implement at their discretion.
Customer Controls
There are controls that are completely in control of the customer who utilizes a cloud service.

37
Is an external opinion or
audit report available that
explains the controls they
put in place?
Does the customer have
an accounting of the
customer-responsible
controls?
?
What controls does the
cloud service provider make
available to all customers?
What controls are the
responsibility of the
customer?
Are the documented
controls sufficient?
Cloud Services
Are the available customer
controls and settings
configured correctly?
How does a customer
monitor for when
changes made expose
customer data or systems?
Are customer controls
and settings documented?

38
Resources and Next Steps
https://confluent.io
http://cnfl.io/slack
#security
@confluentinc

Align Data Governance with Business Goals in Streaming Era

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Align Data Governance with Business Goals in Streaming Era

Similaire à Align Data Governance with Business Goals in Streaming Era (20)

Plus de confluent

Plus de confluent (20)

Dernier

Dernier (20)

Align Data Governance with Business Goals in Streaming Era