1 / 15

Information Security for the Data Management Professional

Information Security for the Data Management Professional . Micheline Casey Chief Data Officer Federal Reserve Board. Agenda. Governance, Privacy, and Data Security Balance of Power: Enabling while Protecting Data Security Management Data and Security Organizational Alignment

teal
Download Presentation

Information Security for the Data Management Professional

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Information Security for the Data Management Professional • Micheline Casey • Chief Data Officer • Federal Reserve Board

  2. Agenda • Governance, Privacy, and Data Security • Balance of Power: Enabling while Protecting • Data Security Management • Data and Security Organizational Alignment • New Areas of Focus in Data Security

  3. Why Should You Care? • Explosion of data and analytical possibilities • Really, really smart bad guys • Increasing pressures to share data across ecosystem • Regulatory compliance • Confusion over what is allowable • Conflicting laws and rules • Requirement to minimize business risk • Increasing privacy and ethics requirements (esp. around big data uses) • Complexity in technology environment - cloud, BYOD, big data The data security governance rules are business rules that security and technology professionals help us implement!

  4. Can We Predict if We Don’t Have all the Information?

  5. Governance, Privacy, and Data Security • Governance is the exercise of authority, control and shared planning over the management of data assets. • Decision making rights, responsibilities, accountabilities, stewardship • Privacy is the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others. • Many laws that govern and protect • Use-control oriented • Data security management is the planning, development, and execution of security policies and procedures to provide proper authentication, authorization, access, and auditing of data and information assets. • Business rules drive the planning and development of policies and procedures • Technology controls execute those policies and procedures

  6. Balance of Power: Enabling While Protecting • As data management professionals and business leaders, you still need to support organizational mission: • Programmatic and business unit goals • Policy and decisioning goals • Risk management and compliance goals • Ensure the authorized act appropriately - privacy* • Keep the unauthorized out - security* *Decentralized Information Group - DIG is part of the Computer Science & Artificial Intelligence Lab at the Massachusetts Institute of Technology.

  7. Data Security Management Text Text Source: Data Management Association International, DM-BOK 2009

  8. Inputs: Understanding Your Environment • What are the business goals? • What are the business requirements? • What are the business rules? • What is the regulatory environment? - binds what you can and can’t do with data • Understanding the organizational risk landscape • All risks are not created equal; can be costly to assume so • Internal, across business partners, at rest, in movement Finally: Ethics is important as well - just because you can doesn’t mean you should!

  9. Data Management Lifecycle - Supports Usage

  10. Inventory of PII Systems Development Lifecycle Control Points - Supports Design

  11. Outputs and Deliverables: Enabling and Protecting Your Environment

  12. Data and Security Touchpoints: Organizational Alignment • Business and data governance council coordinate policy and process • CPOs and Legal provide insight and oversight on data privacy legal and regulatory requirements • CIOs and CISOs implement technology control points Business Body of Policies and Processes IT Legal

  13. New Areas of Focus in Data Security • Policy and Process • Support common data management and data governance frameworks to improve data quality, data integration, information sharing • Big need in alignment and coordination of federal and state laws and policies • Organizations need consistency in data sharing agreements • Technology Research • Data element level work necessary • Meta level tagging will be increasingly important • Real-time consent will be increasingly important and can leverage ICAM and mobile technologies • How can technology support the governance and policy aspects?

  14. Information Accountability “When information has been used, it should to possible to determine what happened, and to pinpoint use that is inappropriate.” “Information Accountability,” Weitzner, D. J., Abelson, H., Berners-Lee, T., et al. Communications of the ACM (Jun. 2008), 82-87.

  15. Thank You! Micheline Casey @michelinecasey

More Related