How to adopt a data-centric approach to data security
April 2023
IT in Manufacturing
By Gary Allemann, MD at Master Data Management.
Gary Allemann.
There is no doubt that data protection regulations, like the Protection of Personal Information Act (PoPIA), are driving investment in data security. Typically, investments have included beefing up firewalls and other barriers to external threats; locking down the ability to extract data via devices such as memory sticks, and ensuring encryption of databases and hard drives. However, while these broad measures are important, they do not provide the level of protection required. This is because data privacy is context sensitive.
Sometimes, specific data is private, and in other contexts, it is not. That means that, to comply with PoPIA, a data-centric approach to data security must be applied that takes into account the purpose for which data is being used, and who is accessing it. So how do we adopt a data-centric approach to data security?
Data access must be restricted by purpose
In general, data privacy regulations such as PoPIA limit processing and access to data based on purpose. In short, data may only be accessed as required for a specific purpose. Blanket, all-or-nothing approaches such as encryption do not limit access based on specific roles. All users are either locked out, or have full access.
The General Data Protection Regulation (GDPR) requirement for a process register can be a great place to start. By linking business processes to roles, systems, and data, we can identify which roles require access to which data sets, and even to which attributes or rows of data. Using a data stewardship platform that makes it easy to identify and trace these relationships can speed up the process and make it easier to track.
Data classification processes need to consider purpose too. Generic classifications, such as PII or Restricted have limited value as they do not provide sufficient context for purpose-based security. Classification systems need to be more precise – for example, identifying telephone numbers, email addresses, names, and ID numbers. This allows data access policies to combine roles with the data that are required to support specific tasks.
Row and attribute
Fine-Grained Access Control (FGAC) combines roles with access to specific attributes. This is not enough. FGAC must also enable row-based filters. For example, data associated with children is treated as special data under PoPIA. A row-based policy could make all data for customers under 18 years old inaccessible, or we could restrict access to data based on location, or any other criteria. FGAC extends role-based access control to make access data-centric.
Future proof
As organisations increasingly embrace hybrid cloud, so the complexities of enforcing policies increase. It is very difficult to enforce policies if different technical implementations are required for each dataset, or each cloud provider. A single, centralised platform to manage data access policies on-premise and across various cloud platforms makes this easy, and protects against future changes in cloud provider.
Further reading:
Bringing brownfield plants back to life
Schneider Electric South Africa
IT in Manufacturing
Today’s brownfield plants are typically characterised by outdated equipment and processes, and face challenges ranging from inefficient operations to safety hazards. However, all is not lost, as these plants stand to gain a lot from digitalisation and automation.
Read more...
What’s next for artificial intelligence?
IT in Manufacturing
Generative AI has brought computer intelligence into the mainstream. It has already been helping us power the digital world through search engines, social media, map directions, online shopping, ride-sharing and cybersecurity. But now it’s in the hands of the people. What can we expect from this new era?
Read more...
The key to cybersecurity success
IT in Manufacturing
Cybersecurity threats are constantly evolving and becoming more sophisticated, requiring organisations to recognise that their employees are both their greatest asset and their greatest vulnerability.
Read more...
This looks like a job for industrial AI
Schneider Electric South Africa
IT in Manufacturing
Following a recent annual meeting of the World Economic Forum, industrial artificial intelligence has joined the ranks of the world’s superheroes.
Read more...
Modernising world’s best espresso machines
Siemens South Africa
IT in Manufacturing
Olympia Express, a world leader in handcrafted espresso machines, is using the Siemens Xcelerator portfolio to digitally transform the design and production of its world-renowned espresso machines.
Read more...
Pioneering sustainable aviation
Siemens South Africa
IT in Manufacturing
Sustainable aviation company, Dovetail Electric Aviation, has selected the Siemens Xcelerator portfolio of software to design zero-emission battery and hydrogen-electric propulsion systems for commercial aircraft.
Read more...
Revolutionising traditional DCS architecture
IT in Manufacturing
SUPCON has unveiled the world’s first Universal Control System (UCS) at the highly anticipated global product launch conference, marking a groundbreaking innovation in the automation sector. This revolutionises the concept of industrial control systems, pioneering a new era in automatic control technology.
Read more...
Advanced industrial software solutions
ABB South Africa
IT in Manufacturing
Finding better ways to manage energy and manufacturing resources is a key concern for businesses in Africa right now. However, achieving this can be a complex challenge.
Read more...
Risks facing the engineering sector
IT in Manufacturing
The engineering, construction, and real estate sector is facing significant challenges in the year ahead, with natural catastrophes, fire and explosion risks emerging as the primary concerns, according to the Allianz Risk Barometer.
Read more...
African data centres: if you build it, they will come
Schneider Electric South Africa
IT in Manufacturing
Africa’s data centre market is growing at an unprecedented rate, driven by a soaring demand for digital services, artificial intelligence, crypto currencies and cloud computing. This is good news indeed, as Africa’s burgeoning digital landscape also presents significant opportunities for investors, technology companies and local businesses.
Read more...
printer friendly version