Encryption As The Cornerstone Of Big Data Security

Big data programmes benefit organisations in many ways, driving competitiveness and innovation. But they can also increase security risks. One of the most important issues for organisations running big data projects is balancing the need to protect data from misuse, fraud or loss, while ensuring the ability to perform big data analysis is preserved.

Big data sets harness information from multiple sources, such as databases, data warehouses, log and event files, security controls, and user-generated data such as from emails and social media posts. The information collected can be in either structured form, such as in the columns of a database, or unstructured, such as information contained in a word processing document.

Big data sets contain vast swathes of sensitive information

All of this information is fed into a centralised big data management system so the data can be correlated for analysis. Much of the data will be highly sensitive, including information related to customers, employees and suppliers, financial data, and intellectual property.

Breaches of sensitive information expose organisations to many risks, including theft of intellectual property, loss of revenue or reputation damage, and financial penalties and other sanctions for non-compliance with regulations that demand that high levels of security be applied to sensitive data.

Compliance of the forthcoming EU General Data Protection Regulation (GDPR) is mandatory as of late May 2018 and sanctions for non-compliance can be severe.

Security is therefore a key consideration when designing big data analysis projects and programmes.

Encryption should be considered the cornerstone of data security

Encryption and key management should be considered the cornerstone of any data security strategy, and big data programmes are no exception. Encryption can dramatically lower the risks associated with data compromise.

All sensitive data should be encrypted, including that in databases, spreadsheets, word documents, presentations and archives. At some point, data may move out of the organisation, perhaps communicated among employees and business partners, or placed in the cloud for storage, where it can be accessed via mobile devices. When this happens, it is vital that the encryption keys remain within the organisation to prevent anyone inappropriately accessing keys, which will allow them to decrypt and read the data.

Many laws that demand that affected parties and authorities be notified in the event of a breach provide a safe harbour if the data that is stolen has been adequately encrypted so that notification is not necessary. Even where a regulation does not provide this safe harbour, the use of encryption will be considered when the safeguards that an organisation has put in place are investigated, potentially reducing the sanctions that could be applied.

Whilst encryption should be the cornerstone of data security for any organisation, it is not sufficient in isolation. Rather, it should be tightly integrated with other security controls, including endpoint security, network security, application security and physical security systems, which are increasingly being run over IP-based networks.

Data security is a must for any organisation for protecting the business. Encryption should be a key part of any big data environment to ensure that sensitive information is adequately protected.

This post is a condensed version of an article written by Colin Tankard, Managing Director of Digital Pathways, that was published in Network Security newsletter. Click here to view the full article.