Data-centric security


Data-centric security is an approach to security that emphasizes the security of the data itself rather than the security of networks, servers, or applications. Data-centric security is evolving rapidly as enterprises increasingly rely on digital information to run their business and big data projects become mainstream.
Data-centric security also allows organizations to overcome the disconnect between IT security technology and the objectives of business strategy by relating security services directly to the data they implicitly protect; a relationship that is often obscured by the presentation of security as an end in itself.

Key concepts

Common processes in a data-centric security model include:
From a technical point of view, information -centric security relies on the implementation of the following:

Data access controls and policies

Data access control is the selective restriction of access to data. Accessing may mean viewing, editing, or using. Defining proper access controls requires to map out the information, where it resides, how important it is, who it is important to, how sensitive the data is and then designing appropriate controls.

Encryption

Encryption is a proven data-centric technique to address the risk of data theft in smartphones, laptops, desktops and even servers, including the cloud. One limitation is that encryption is not always effective once a network intrusion has occurred and cybercriminals operate with stolen valid user credentials.

Data masking

Data Masking is the process of hiding specific data within a database table or cell to ensure that data security is maintained and that sensitive information is not exposed to unauthorized personnel. This may include masking the data from users, developers, third-party and outsourcing vendors, etc.
Data masking can be achieved multiple ways: by duplicating data to eliminate the subset of the data that needs to be hidden, or by obscuring the data dynamically as users perform requests.

Auditing

Monitoring all activity at the data layer is a key component of a data-centric security strategy. It provides visibility into the types of actions that users and tools have requested and been authorized to on specific data elements. Continuous monitoring at the data layer combined with precise access control can contribute significantly to the real-time detection of data breaches, limits the damages inflicted by a breach and can even stop the intrusion if proper controls are in place. A 2016 survey
shows that most organizations still do not assess database activity continuously and lack the capability to identify database breaches in a timely fashion.

Privacy-enhancing technologies

A privacy-enhancing technology is a method of protecting data. PETs allow online users to protect the privacy of their personally identifiable information provided to and handled by services or applications. PETs use techniques to minimize possession of personal data without losing the functionality of an information system.

Cloud computing

is an evolving paradigm with tremendous momentum, but its unique aspects exacerbate security and privacy challenges. Heterogeneity and diversity of cloud services and environments demand fine-grained access control policies and services that should be flexible enough to capture dynamic, context, or attribute-based access requirements and data protection.

Data-centric security in the public cloud environments

In recent decades many organizations rely on managing database services in public clouds such as Amazon Web Services, Oracle Cloud, Google Cloud Platform or Microsoft Azure to organize their data.
Such approaches have their own limitations on what users can do with managing the security of their sensitive data. For instance, hardware security appliances or agents running on the database servers are no longer an option. This requires innovative ways to secure data and databases such as using a reverse proxy sitting in between clients / applications and database servers. The requirements, such as supporting a load balancing, high availability and fail-over in data-centric security bring additional challenges that database security vendors must meet.