ALTR Named a Cool Vendor by Gartner. Read the announcement »

DZone Refcard: Introduction to Data Security as a Service

Eliminating Risk to Accelerate Innovation

Published on Apr 03, 2020
Reading Time:

Contents

  • What Is Data Security as a Service (DSaaS)?
  • The Impact of Security and Compliance on Development
  • Common Security Pitfalls
  • Addressing Data Security and Compliance
  • Top DSaaS Capabilities
  • DSaaS Use Cases
  • Conclusion

What is Data Security as a Service (DSaaS)?

Data Security as a Service (DSaaS) enables application and security leaders to mitigate the risk and compliance burdens for all of your organization’s sensitive data through a simple, portable, cloud-native service. This holistic approach provides data access monitoring, access governance, and at-rest protection for sensitive PII, PHI, and PCI data — no matter where that data is stored.

The Impact of Security and Compliance on Development

The rate of data breaches is constantly increasing, making it increasingly clear that the current approach to data security isn’t working. Even with network and endpoint security, identity access, and encryption, cybercriminals are still getting access to what they want: the data.

Organizations can’t afford to continue getting breached; not only does it cost them money, but it’s a massive temporal and reputational blow. With increased pressure from competitors and high expectations from customers, it’s more important than ever for security and compliance teams to check, and double check, that their security measures are in place.

Meanwhile, the business is demanding quicker releases, which means development teams have growing security demands and less time to implement them. What’s worse is that the security is currently treated like an“aftermarket” add-on. Inexperienced developers presume that the SDLC will keep this pace until release, but the veterans have a better idea of what's around the corner.

When you add in the fact that privacy and compliance regulations are getting more and more scrupulous every year, it’s amazing that companies are even able to get new technology out the door.  

The question that many neglect to ask is: “What is the impact these security and compliance measures have on development?” The short answer: too much. These measures are a constant headache for developers, so much, in fact, that there eventually becomes a point where they stop trying to be innovative altogether; it just isn’t worth the hassle or the time. That’s not to say that there aren’t profound and exciting innovations still being released, but imagine how remarkable it would be (not to mention quicker and cheaper) if security and compliance weren’t a concern?

Data Security as a Service offers powerful data security. As a result, the business implements quicker and cheaper releases, and developers get to innovate without the risk.  

Common Security Pitfalls

In order to understand how DSaaS can give your security and compliance teams what they need, you need a quick overview of the areas that are currently falling short, both in effectiveness and efficiency.

Implementing an adequate security, privacy, and compliance strategy is a time-consuming and challenging undertaking. It can take years to plan, deploy, integrate, and then optimize your strategy. By that time, new threats could have emerged, or cutting-edge technology that makes your current approach obsolete.  

Security should be baked in from day one of development, freeing up time and money on the back-end. The traditional outlook of security being an “aftermarket” add-on to applications ends up costing organizations time and money, ultimately preventing them from getting technology out the door.

Here are the top 10 application security risks, according to the Open Web Application Security Project (OWASP):

Figure 1: OWASP Top 10

Addressing Data Security and Compliance

The goal of DSaaS is to deliver powerful security without negatively impacting development or innovation potential. So, how do you do that?

First, you need a solution that is easy to deploy and will integrate with the tools that you already have in place. It should also be able to protect different data types across the entire enterprise, from Oracle to Mongo, on-prem to cloud, integers to videos. This flexibility and portability is just one way that DSaaS is more efficient and effective for everyone involved.

In order for security to be used and optimized throughout the entire enterprise, it must also be easy to use and maintain. One of the top reasons for breaches today is not because a company didn’t have tools in place, but because those tools were so complicated to use that they were either not configured correctly or they took too much time to roll out to the enterprise.

Take the Equifax breach for example. According to the Los Angeles Times,“The company had failed to patch a coding vulnerability even though it knew for months that its data was at risk.” They also failed to encrypt the databases that stored their most sensitive data. At the end of the day, the simpler the solution, the more likely an organization will actually use it.

Finally, developing a resilient security strategy requires understanding the biggest threat to your sensitive enterprise data: people.Whether through malicious intent or pure negligence, people threaten your organization from inside and out. That’s not to imply that everything needs to become automated, but it does mean that there must be a failsafe solution in place to prevent additional exposure at the hands of your employees.

Figure 2: DSaaS enterprise-wide supporting cloud, files, on-prem, and more

Top DSaaS Capabilities

DSaaS brings together capabilities that are separate in most legacy solutions to provide comprehensive visibility, control, and protection for all sensitive data in one service. Its ease of integration, lower cost of ownership, and superior protection set it apart from every other security model. Here are the three primary capabilities of Data Security as a Service.

DATA ACCESS MONITORING AS A SERVICE

While monitoring might not sound like a game changer, it’s inconceivable how many security tools only “monitor,” so a company ends up with a front-row seat to a breach but has no way to stop it. Another big issue with traditional monitoring solutions is how easy it is to delete and/or edit important information and actions.

DSaaS provides a tamper-proof log of who is accessing what data, when, where, and how often. Not only does it provide an immutable audit trail for compliance teams, but there are also detailed reports to help you understand the relationship between users and the data they are accessing. If that’s not enough, that log is then stored offsite in a tamper-proof cloud vault that leverages blockchain-derived technology to ensure its integrity.

For privacy and compliance teams, the regulatory risk around possession of PII, PHI, and PCI data continues to grow with regulations such asCCPA and GDPR. All regulations require that companies be able to report not only on their compliance with statutes (CCPA 1978.115/GDPR Article 30) but also to individuals who have requested details about their data use. This means you must have an up-to-date audit trail in real time, anytime.

DATA ACCESS GOVERNANCE AS A SERVICE

Once an organization has a trusted view of how data is being consumed, it's time to develop and implement data access policies. The first part of Governance as a Service is just that: deciding on what data users can see. This can be done in groups of users and data all the way down to the individual user and individual data set. It becomes simple to group your most sensitive data, such as PII, PHI, and PCI, and then mask specific fields from anyone, whether it’s third parties, employees, or a certain geographic region.  

Data Governance as a Service not only has the capability to control what users can see, but it can also enforce “when and how much.”  If certain roles only need access during specific hours or should only access a certain number of records per hour, you have the ability to create thresholds. If a user exceeds that threshold, you have three choices: flag it, slow down access while you figure out what’s going on, or cut off all access. What makes this truly amazing is that you can finally stop a breach in real time.  

No matter how astounding it is to believe, the average time from incident to breach discovery right now is 197 days; it’s completely manual and requires combing through hundreds or thousands of logs. While an incident like that can be prevented with Governance as a Service, Monitoring as aService shows in real time where the incident started from, turning 197 days into less than one.

Not only will DSaaS prevent a breach in real time, but it also helps avoid exorbitant economic consequences from violating CCPA, HIPAA, or PCI DSS regulations. Privacy leaks that expose unauthorized users to private data, in both their use and development, now come with a multitude of violations.  

DATA AT-REST PROTECTION AS A SERVICE

What’s the only way to keep your sensitive enterprise data 100% secure? Don’t have it in your environment anymore. Many are under the impression that encryption or tokenization are adequate security solutions. While, in theory, they can remove data from the database by leaving behind meaningless values, the biggest difference between these two solutions and DSaaS is that DSaaS is keyless and mapless.

At the beginning of this Refcard, we discussed the human threats to data – if a human has the key or map to put the encrypted or tokenized data back together, then it is definitely not secure. Furthermore, the success of your data protection solution is dependent upon easy installation and updates, without adding latency to your applications. As with the Equifax breach, if it’s too hard to use and maintain, it becomes a liability.

On a column-by-column basis, protection through DSaaS is as easy as the push of the button. Using advanced deterministic tokenization to replace sensitive data inside of data stores, DSaaS then fragments it across a distributed cloud vault, rendering it useless for bad actors while still keeping it fully functional for the enterprise.

If someone with direct access to the database tried to take the data, they would only be left with physical access to servers, and administrative rights to database systems are a tremendous source of risk to sensitive data. This is particularly true as data moves to the cloud and control over infrastructure diminishes. A threat such as this is often the only barrier in the way of an enterprise’s ability to make the savings and efficiency of the cloud a reality.

Companies need sensitive data to serve their customers, but just possessing it immediately creates regulatory requirements that are costly. The evolution of those requirements is unpredictable and ever-changing, but because DSaaS removes the sensitive enterprise data from scope and stores in the cloud vault, compliance burdens are significantly reduced.

DSaaS Use Cases

Data Security as a Service addresses a myriad of use cases. Because it is easy to install and even easier to use, it frees up resources like time and money to be spent in other areas. This is why it can make such a tremendous impact across the entire enterprise. From migrating to the cloud to eliminating insider threats or protecting data warehouses to getting CCPA/GDPR compliant, you’ll see in the table below some of the top ways that DSaaS can help.

Figure 3: ALTR Use Cases

Conclusion

Security isn’t a one-and-done process; there’s no Band-Aid or umbrella to place over an organization that magically secures all of its sensitive data. But envision a world where security doesn’t impact speed, performance, or innovation.  

The traditional security model cannot last much longer. Threats to data are not going to magically disappear, and regulations are not going to get more lenient, so it’s time to protect the asset that cybercriminals really want and to do so efficiently. To be successful in today’s competitive landscape, enterprises must be secure, compliant, and exceptionally innovative.

DSaaS promotes innovation by becoming part of the development process and strategy, so from day one, you have best-in-class visibility, control, and security of valuable data. Security is no longer the final roadblock to getting a release out the door; it becomes a launching point to accelerate innovation.

Download this resource

Authors

Speakers

Chris Struttmann

Chris attended Florida Institute of Technology College of Engineering and is a member of ALTR's founding team. Over the years he has served ALTR as Chief Engineer, Director of Engineering and Chief Architect.