Ulf Mattsson

This conversation is closed.

How Data Security Tips the Scales in Privilege vs. Protection

In his recent blog post on ZDNet, Larry Seltzer exposed the current issues with excess privileges in many organizations. Most importantly, how the principle of “Least Privilege” is often being ignored, either due to difficulties in being unable to tell what information would be required to perform specific job functions, or being afraid of not giving employees enough information to do their jobs.

In any organization that requires the storage and use of sensitive data for operational functions, there will always be a tug of war between access and security. While some operating systems such as Windows or Linux now provide simpler privilege management for access controls, they are not an ideal overall solution for large, complicated organization structures. The “all-or-nothing” security of access controls can create numerous problems in day to day operations, including roadblocks to benign data that happens to be stored next to highly sensitive data. In many cases, this approach leads to granting unnecessary privileges beyond what the user actually needs to do their job.

But obviously, there needs to be some sort of security. The old adage, “it’s better to have it and not need it, then need it and not have it” applies well, in the sense that you are better off securing your data beyond requirements and adjusting if needed, than applying too little and being compromised before you can do anything about it. The damage is limited when one person needs to request privileges to get at data, but could be massive if someone is abusing data without limitation.

One solution to this problem is utilizing fine-grained data security, such as encryption, masking, or tokenization. Applying security to the data fields themselves allows for a wider range of authority options and levels than typical access controls. Users without privileges to access sensitive data can still access non-sensitive data to perform job functions, even in files or tables that contain a mixture of both.

  • thumb
    Nov 2 2013: I'd like to add that more flexible options, such as some forms of masking or tokenization, can also provide different levels of security that either generalize the data or expose certain parts of sensitive data without revealing it completely.

    However, these fine-grained data security options also require proper privilege management. Step one in this process is usually assigning a security-specific role or team in the organization, if they don’t already have one. Isolating security policy administration to a security team can provide a separation of duties between users or system administrators from security privilege assignments. The security team must develop a comprehensive data security policy, preferably one that can be centrally managed and administrated across the enterprise, in line with the needs and expectations of the operations of the business, and the roles contained therein. Often the simpler way of assigning policy privileges, or authority to access sensitive data, is by specifying the few people who have access, rather than those who don’t. Finding a data security vendor that can provide easy policy management with push-button configuration can go a long way to assisting you in implementing this process.

    While access controls remain an integral function in data security and privilege management, organizations now need to get down to the data level in order to avoid either inhibiting business processes or opening the door to a data breach.