Data Governance in a Hybrid Cloud Architecture: Can DSaaS Solutions Help?
The rise in hybrid cloud computing and the use of multiple cloud security solutions has complicated data governance. Here’s how data governance can be optimized through DSaaS platforms.
Over 96% of organizations worldwide use cloud platforms for a variety of reasons. But massive cloud adoption has propped up fresh data governance challenges. Moreover, organizations struggle to maintain visibility over sprawling cloud accounts. Here, ALTR’s chief technology officer and their VP of Marketing offer valuable insights on the state of data governance in the hybrid cloud era and how organizations can overcome it.
In a newly released report, Varonis, a data security services provider, revealed organizations worldwide are struggling to govern vast amounts of unsupervised identities and shadow privileges across fragmented SaaS and IaaS environments. The firm found that an alarming 43% of cloud identities are abandoned or unused and are sitting ducks for account takeover attempts, reflecting that organizations are not focussing on or are unable to deactivate unused cloud identities.
The report also found that as many as 75% of cloud identities belonging to external contractors remain active after leaving organizations, ensuring that these individuals continue to enjoy access to organizations’ cloud resources. This makes organizations wide open to IP and data theft. Even for cloud accounts that are monitored, Varonis found that organizations misconfigured 44% of cloud privileges, enabling employees to access sensitive data they aren’t supposed to access.
What’s more, Varonis found that most of those enjoying administrator-level privileges are shadow admins, which means that IT doesn’t know these employees can perform admin-level changes. A lack of visibility has also ensured that 15% of employees are transferring business-critical data to their personal accounts, and 20% of all cloud users enjoy access to sensitive corporate data.
“Cloud apps make collaboration a breeze, but unless you’re keeping a close watch on identities, behavior, and privileges across each and every SaaS and IaaS you rely on, you’re a sitting duck,” says Rob Sobers, VP Marketing at Varonis. “If you’re not watching closely, users can silently copy, delete or expose your mission-critical data to just about anyone. And that data can be anything from your Salesforce customer list, your source code in GitHub, and your documents in Box and Google Drive.”
Based on these findings, it is now apparent that organizations need to get their hands dirty and do more to secure their data, and this requires putting in place a strong data governance paradigm that caters to both public cloud and hybrid cloud environments.
This detailed explainer on data governance covers what the term means, the key components of a data governance process, the importance of putting in place a data governance policy in the post-COVID era, the key challenges that put roadblocks in the effective implementation of data governance, and the top data governance practices that organizations should adopt to ensure the success of their respective policies.
Learn More: Top 10 Data Governance Tools for 2021
The Importance and Rising Profile of Data Governance
Data governance can be a challenge, depending on the sector an organization is in, the amount of consumer data it collects and processes, whether the data it stores or processes is tied to national security or how much intellectual property it owns. While it may seem complicated for many, Toolbox spoke to Data Security as a Service provider ALTR to gauge what it takes to govern data optimally.
Dean Cruse, the VP of Marketing at ALTR, says that data governance is certainly a priority for organizations, considering the recent cyber attacks that exposed a large number of organizations to data exfiltration and encryption via ransomware. “The data governance and protection market is rapidly growing and is garnering a lot of interest. In fact, we’re seeing a lot of investment in the space, and we expect to continue to see more.
“As data increasingly becomes more and more important to businesses, data governance and protection will likewise increase in value to businesses as the best way to secure and manage their assets. At the same time, recent cyberattacks and data breaches have underscored the critical role governance and protection play within organizations. Per MarketsAndMarkets, this sector may have a $5.1 billion value by 2025, making the next 12 months a critical window for investment into the technologies driving that transformation,” he says.
James Beecham, the company’s CTO, says that while some vendors are trying to narrow the definition of “data governance” to simply mean data discovery and classification, which are certainly critical first steps in the data governance process, it’s not enough to simply know where your data is.
“If you can’t control who’s accessing that data and prevent threats to it, you’ll never be in compliance with GDPR and CCPA, because the fines for loss are staggering, regardless of company size,” he says.
Learn More: In the Age of Multi-Cloud, Is Data Governance Receiving the Attention It Deserves?
Data Governance Isn’t Industry-Specific and Is Critical for All Organizations
According to Beecham, healthcare and fintech organizations have traditionally worried more about regulatory issues or other requirements compared to organizations in other sectors. However, the growing importance of data now ensures that every organization has to implement some form of data governance policy to monitor the collection and use of sensitive information.
“Every company is now a data company, and that means every company must follow the relevant state, federal and international data privacy regulations around storing, processing, deleting and retaining customers’ identifiable information. Businesses from grocery stores to wellness centers to makeup brands now must understand where their customer data is and how that data is being accessed and be able to prove that they are utilizing best practice governance and security over this data.
“This is a challenge, because traditionally, companies outside of fintech and healthcare typically never had to deal with these types of regulatory issues or requirements. This creates a skills gap that makes it difficult for these companies to very quickly meet regulatory demands. It’s going to be incumbent upon partners like ALTR to provide easy-to-use, high-impact tools that help close that gap fast to help businesses get back to providing value to their customers and not necessarily focusing on the minutiae of data governance, privacy and security,” he says.
How ALTR Differentiates Its Data Governance Offerings From Competing Solutions
According to Cruse, ALTR offers Data Security as a Service solutions that solve the two hardest challenges related to data governance and security: cost and complexity. Most DSaaS solutions, even though they enable data governance, are costly and difficult to implement, often relying on on-premise or proxy-based architectures and significant amounts of code-writing. This traditional approach requires time, implementation resources and other costs that are frankly out of sync with modern data architectures.
“ALTR solves these challenges in a way that accounts for the realities of new data infrastructures. ALTR is born in the cloud, and our no-code approach to governance represents the simplest and fastest path to value for our customers. We bring down the silos between security and data teams, empowering an organization to make data protection and control a central value of its business operations,” he says.
According to Beecham, the data security solutions company has also aligned its solutions to suit the rise in the adoption of hybrid cloud computing. He says that while the cloud is great at delivering scale, giving companies a global reach and providing enterprise-level security, the cost can be untenable once utilization reaches a certain point. Many organizations may also not be too keen on migrating all of their data to the cloud, hence the need for a hybrid cloud structure.
“Traditionally, ALTR has focused on these on-premise and hybrid workloads, but lately, we’ve shifted to cloud migrations. We’re helping companies identify data sets that meet the criteria to move to the cloud from a cost, ROI, or scale need but that also have security and governance concerns.
“We can help companies address their on-premise security and governance concerns so the workload can be migrated to the cloud safely. This helps companies thin out their hybrid infrastructure, leaving only those workloads that have to be on-premise for security or cost reasons and quickly migrating the rest. By moving all the possible workloads to the cloud, the surface area individual company security teams have to protect and maintain is reduced to a minimum,” he adds.
Learn More: 3 Questions To Drive Better Data Governance
Leveraging DSaaS to Optimize Your Data Governance Efforts
Cruse says that it is sometimes difficult to find a one-size-fits-all solution to meet all of your data governance needs. Hence many organizations end up deploying a range of policies and solutions to enhance visibility over their data. When so many now rely on a complex multi-cloud or hybrid environment to house their data, there’s a new threat to data security: the risk that multiple policies layered over each other miss something.
Organizations can use solutions provided by leading Data Security as a Service providers to enhance visibility and governance. Many such solutions are custom-made for certain industries and come with subscriptions instead of huge upfront costs, enabling smaller organizations to leverage their benefits.
For instance, ALTR recently partnered with Snowflake to enable organizations to augment robust access controls offered by Snowflake with additional governance controls offered by ALTR.
“Snowflake offers robust access control and governance capabilities, including their RBAC model and the ability to provide classification of sensitive data natively within the platform,” says Beecham. “ALTR aims to supplement and extend those native capabilities by simplifying the implementation of governance controls and enabling non-technical users to become comfortable with governance in Snowflake.
“Additionally, ALTR’s ability to layer in years of data security expertise on top of data governance provides a complete solution that allows customers to increase their use of Snowflake, without fear of privacy and compliance issues. Our ultimate goal is to empower Snowflake customers to feel comfortable putting more data into Snowflake. That’s a win for our partnership,” he adds.
Do you think organizations need to do more to address data security concerns associated with rising hybrid cloud usage? Comment below or tell us on LinkedIn, Twitter, or Facebook. We would love to hear from you!
