If the devil is in the details, data warehouses might be the IT security manager's gateway to a fiery underworld.
The relentless accumulation of facts, increasing access by increasingly mobile and geographically scattered users, and the need for governments to improve management are putting these giant databases under enormous pressure. They must be always available, produce results instantly yet remain eternally secure.
In many organizations, the data warehouse has become the centre of the universe, importing data from disparate sources, linking it to internal and external-facing applications and connecting to employees, suppliers, regulators and customers in ever more complex and creative ways.
In the business world, the value of data warehousing has gone from knowing what has happened to knowing what is going on right now. The next stage will be controlling the future by literally creating demand for products at specific places and times.
In that environment, users are encouraged to use the warehouse creatively, mining for patterns and possibilities across every piece of information they have, something that most governments would consider extremely risky.
The security challenges of big databases are unique, and unfortunately governments sometimes cannot learn from their private sector counterparts.
Because businesses use data warehouses to identify trends first and then the consumers they want to reach, Adriaan Veldhuisen, security product manager at data warehouse company, Teradata, said, "In the government sector, the analytical processing is typically not done for trend analysis but for detecting abnormalities, fraud and terror and all that."
As well, he said outside contractors often do not get close enough to secure government databases to transfer knowledge.
When the number of people who can touch a database goes up, so does the security risk, because users, whether malicious or ignorant, remain the single greatest IT security threat.B (As if to underline the magnitude of the problem, immediately after this column was first filed a new e-mail alert announced, "8,500 mobile devices lost at UK airports".)
Without a strong and well-managed access policy, chunks of data can leave the organization on flash drives, CDs and DVDs, PDAs and laptops. Without encryption, the data on those devices will be readable.
Protegrity, a data warehouse security company, has focused on encryption as the ultimate best answer for protection.
"You put the data there for a reason," said Protegrity's, president Gordon Rapkin. "You probably wanted to get value out of it. In order to get value out of it, somebody has to touch it, and so with an encryption solution we can provide methods for allowing the right people to have the right kind of access."
He believes good management can allow governments to avoid walling off useful data. "If instead, they could protect the data, know who touched it, know what rights that person has, and be alerted in a real-time manner when someone attempts to touch it, it is a much more effective way to utilize data. Otherwise, why keep it?"
Management involves setting policy, but it also means auditing and compliance reporting, so managers need to know that the policy is enforced and which database users attempted unauthorized access, deliberately or unwittingly.
Teradata's Veldhuisen points to database privacy as a dominant concern for government managers.
"More and more political issues come up with whether or not you should or could hold that data even though a scientist can find a terrorist, find somebody that defrauds the government systems or find somebody else that needs help, maybe," he said.
Privacy Commissioner Jennifer Stoddart said recently that Canadians feel less sure their personal information is protected than they did ten years ago.
Pressure from Canadian and international law enforcement agencies to receive even more data is not likely to decrease any time soon.
Nobody who lived through the furor seven years ago about the Longitudinal Labour Force File that Human Resources Development Canada was forced to renounce needs to be reminded how difficult an issue privacy can be.
Richard Bray is an Ottawa-based freelance journalist specializing in high technology and security. Contact him at rbray@itworldcanada.com
Related content:
Scotiabank aiming to master data management
Outsourcing data centre works wonders for Calgary
BI cuts path through data jungle
icon.
