Access to confidential data is a complicated issue. The methods a company employs to protect its sensitive information can be diverse, and they could change as business practices change. To ensure the highest level of control, companies should employ a central method that permits administrators to establish policies based on the type of data that is used for what purposes. These policies must then be implemented across all platforms and consumption methods (such as internal data and external data).
One method to accomplish this is through mandatory access control. By defining the data that each team must have to perform their job, and then providing access based upon that, DAC eliminates many security risks by ensuring that employees have access only to the information needed for their jobs. However, it can be difficult to maintain DAC because the process involves granting permissions manually and keeping track of what has been granted to whom.
Another method that is popular is to limit access to data by using an approach of access control that is based on role. It is easy for administrators to establish policies that give access to users based on roles within an organization, and not just on individual user accounts. This is less prone to errors and provides an even more precise model of “least privilege”, where only the most basic level of access is granted to users with an emphasis on their need to be aware.
The best way to ensure that all sensitive information remains secure is to regularly review and update the policies and the technologies used to control access to data. This requires a collaboration between the legal team, the data platform team that handles and applies those policies as well as the business teams who create them.
