Knowledge Hub

Data Entitlement is normally mixed with Data Authorization which is not 100% accurate. There is no doubt, there are few places where both can be used interchangeably but mostly, they should not.

Entitlement is something which you inherit, or which comes as a default or which you get along-with something else whereas Authorization comes because of an action, or it expects an action in future. For example, you are ENTITLED to something and at the same time you are AUTHORIZED to do X, Y and Z things.

Before we understand the difference between Authorization and Entitlement, it’s very importance to understand what Prescriptive and Descriptive behaviors are.

• Prescriptive means, how it should be, and an action is expected.
• Descriptive means, how it is.

‘Authorization has a Prescriptive behavior whereas Entitlement has Descriptive behavior.’

Let’s try to understand with an example, at work you must have heard, you are ENTITLED to 20 annual leaves and maybe 12 medical leaves etc. But when you apply for a leave, your manager has the AUTHORITY to accept or reject your leave.

Authentication is the basic security feature of any organization. An organization without Authentication is like gold mine without any guard.

Authentication and Authorization works hands-in-hand and are a MUST-TO-HAVE in any organization or in any system or in any application.

Authentication is majorly tagged with Security whereas Authorization is majorly tagged with Privacy.

Let’s try to understand with an example, for example, in a hospital close relative, family or friends are allowed to come and meet the patient, but all these people normally are AUTHENTICATED or stopped by the guard at the main gate who checks their ID cards or anything which can assure that they are legitimate people e.g., guard can ask, why they are here etc. Once they are in, at the main hospital counter someone again asks them who they want to meet, if the patient’s name is there in system, then they are allowed to go ahead.

There are many ways to achieve data privacy like data generalization, data swapping, data masking, data encryption etc., all these techniques change original data which of course is not desired by most. All these are done to ensure data should not fall into wrong hands.

Data Synthetic is something which will really solve the problem statement like anonymize data before sharing with developers, data science teams for data models etc.

Data Synthetic is about generating new dataset using computer simulations. This dataset contains fake data with the right properties or attributes. For example, customer information is required in almost every application or system, but it can’t be shared to protect individual identity. Data Synthetic tools create a dummy dataset for customers with name, email, contact number, family details etc. but nothing related to original data. This way, developers can build the data pipelines and data scientists can build their data models without thinking of breaching any regulatory or compliance clauses.

In simple terms, when we talk about an Embargo, we're usually talking about a rule or limit, especially when it comes to trading or sharing information. Now, if we use "data embargo," it means there are rules or limits on using, sharing, or spreading certain information. This mostly happens for legal reasons, to keep things safe, to protect privacy, or because there are rules to follow.

Let's delve into the concept of an "embargo," especially in the context of data, using simpler language:

1. Embargo Basics: An "embargo" is like a rule that says you can't do certain things. It often happens in trade or when sharing information.
2. Data Embargo: Now, if we add "data" to the word "embargo," it means there's a rule or limit on how we can use, share, or spread specific information. Imagine it's like having a set of rules for how you can talk about or share certain details.

These rules could be there for different reasons:

Implementing a robust cybersecurity strategy involves encryption, regular audits, access controls, employee training, and staying updated on emerging threats to safeguard sensitive information effectively.

Few pointers:

• Data Encryption: Employ end-to-end encryption to protect data during transmission and at rest. Utilize strong encryption algorithms to secure sensitive information.
• Access Controls: Implement strict access controls, granting users only the permissions necessary for their roles. Regularly review and update access privileges to ensure they align with current job responsibilities.
• Regular Audits: Conduct periodic security audits to identify vulnerabilities and weaknesses. Regularly assess and update security policies based on audit findings to address new threats.
• Employee Training: Provide comprehensive cybersecurity training for employees to raise awareness about potential threats. Promote a culture of security consciousness to minimize human-related risks, such as phishing attacks.
• Incident Response Plan: Develop and regularly test an incident response plan to respond to security incidents swiftly and effectively. Clearly define roles and responsibilities to minimize downtime during an incident.
• Data Backups: Establish regular and secure data backup procedures to ensure quick recovery in case of data loss or a security breach. Store backups in a remote location to save you from being compromised.
• Network Security: Employ firewalls, intrusion detection and prevention systems to monitor and protect the network. Regularly update and patch software to address known vulnerabilities.
• Vendor Security Assessment: Assess and monitor the cybersecurity measures of third-party vendors handling your data. Ensure vendors comply with security standards and protocols.
• Security Patching: Regularly apply security patches and updates to all systems and software to address known vulnerabilities. Monitor for vulnerabilities that may require immediate attention.
• Data Lifecycle Management: Implement data retention and destruction policies to minimize the risk of unauthorized access. Clearly define how data is collected, processed, stored, and disposed of throughout its lifecycle.

Accessibility and Visibility are often used interchangeably, especially in simple terms. However, in the world of data solutions, it's crucial to distinguish between them.

Let’s decide it…..

Accessibility pertains to your ability to connect to and utilize data for decision-making purposes.

On the other hand, Visibility involves having a comprehensive understanding of what's happening behind the scenes with your data.

For instance, if you request your Data Warehousing or Data Lakehouse datastore owners to extract data from source systems and transform it into the desired format for decision-making, two key concepts come into play:

Accessibility: This is achieved when your database administrator or datastore owner grants you privileges within the database, allowing you to read, write, or update your data.

Visibility: This extends beyond mere access. It encompasses a deep understanding of various aspects of your data, such as what was sourced, the business rules used for transformations, the presence of business, technical, or operational metadata, the formula for golden records, data quality assurance methods, data loading approaches (e.g., CDC, batch, real-time), SLAs, and lineage information, among other things. All of these elements collectively provide you with comprehensive Visibility into your data.

Sandbox typically refers to a controlled and isolated environment where data scientists, analysts, or developers can explore, test, and experiment with data without affecting the production environment. The concept is borrowed from the idea of a children's sandbox, where they can play and experiment freely within a confined area.

Here are key aspects of a Data Sandbox:

• Isolation: A Data Sandbox is isolated from the production environment to prevent any unintended consequences or disruptions. It allows users to experiment without affecting critical systems or data.
• Experimentation and Testing: Users can perform various activities, such as running queries, testing algorithms, or developing and refining code, in a risk-free environment. This is crucial for data analysis, machine learning, and software development.
• Data Exploration: Data Sandboxes often provide a space for exploring datasets, trying out different queries, and gaining insights without altering the original data or systems.
• Prototyping: Data scientists and developers can use the sandbox to prototype new solutions, algorithms, or models before deploying them to the production environment.
• Learning and Training: Sandboxes are valuable for training purposes. Data professionals can use them to train and educate others without the risk of impacting live systems.
• Security and Access Control: While sandboxes are designed for experimentation, they still need to adhere to security best practices. Access controls and permissions are implemented to ensure that sensitive or confidential data is not misused.
• Version Control: Some Data Sandboxes incorporate version control mechanisms, allowing users to track changes and revert to previous states if needed.
• Data Masking and Anonymization: To comply with privacy regulations, data in a sandbox may be masked or anonymized to protect sensitive information while still allowing meaningful analysis.
• Integration with Development Processes: Sandboxes are often integrated into the overall development and deployment processes, enabling a seamless transition from testing and experimentation to production deployment.

GDPR, or the General Data Protection Regulation, is a significant law in the European Union focused on data protection and privacy. In very simple terms, it's a set of rules about how companies and organizations should handle personal information of individuals. It gives people more control over their personal details like their names, addresses, and photos, ensuring that this information is handled in a secure and lawful manner.

The main principles of the GDPR center around responsible data management.

• Transparency is key, requiring clear communication about how personal data is used.
• Purpose limitation means data can only be used for specific, clearly stated reasons.
• Data minimization insists on collecting only the data that is absolutely necessary.
• The principle of accuracy ensures that personal information is kept up-to-date and correct.
• Storage limitation mandates that data should not be kept longer than necessary.
• Integrity and confidentiality require that the data is kept safe and secure, protected from unauthorized access or breaches.
• Accountability places the responsibility on organizations to ensure all these principles are adhered to, making sure personal data is managed in a compliant and ethical way.

During the years of industrialization and first process automations, there was the first batch of international standards which has become the core of ISO “framework”. When data stormed through various industries, ISO/IEC 27001 was necessary to be defined. It is an international standard specifying the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). From a data perspective, this standard is core, essentially pivotal to ensure the confidentiality, integrity, and availability (CIA) of data. It consists of 3 main sections, which encompasses policies, processes, and technical measures to manage information security risks.

There are 6 Key Components when dealing with data and data management.

• The foundational aspect for ISO/IEC 27001 is the systematic assessment of information security risks in your own data. Risk assessment includes identifying potential threats to data, assessing vulnerabilities, and risk impacts’ evaluation. The outcome guides the prioritization of security processes, monitoring and controls.
• Managing risk effectively, data must be classified according to its sensitivity and importance to the organization and its departments. Such classification influences how data is handled, stored, and transmitted, ensuring that more sensitive data receives higher levels of protection. The processing phase is called data classification.
• ISO/IEC 27001 highlights massive importance for limiting access to data based on the principle of least privilege. Access control lineage and its measures ensure that only authorized individuals can access or modify data, reducing the risk of unauthorized disclosure, alteration, partial loss, or total destruction.
• Encrypting data (both at rest and in transit], is a very common control in data protection process for keeping confidentiality and integrity. Encryption makes data unreadable to unauthorized parties, safeguarding it against spying or undesired interfering.
• Next component the ISO standard 27001 requires for all organizations to have procedures for managing information security incidents. Incident Management includes detecting, reporting, and investigating each incident to mitigate their impact on data and prevent recurrence.
• Last but not least ISO/IEC 27001 brought into place Business Continuity Management to keep development of any business continuity plan which includes data recovery procedures. “Continuity” ensures that critical data remains available or can be restored in the event of a disruption. Under “event” you can imagine a typical cyber-attack or natural disaster.