Data Security and Compliance: 5 Essential Considerations
With data continuously growing in complexity and quantity, ensuring data security is more important than ever when choosing to buy a business intelligence (BI) solution.
From data protection to data governance, having a BI platform that enables you to control, audit, encrypt and manage user access and usage of sensitive data is essential.
What is equally important is whether a BI vendor offers the expected level of data security and compliance in their platform that adheres to international regulatory standards. Here are the 5 essential considerations for data security and compliance.
#1 - Secure Meta-Data Layer
Meta-data is what describes and provides information about every data object in a database. It gives necessary context about the data, underlying how what you see of the data in columns and rows. Think elements like when said data was uploaded, who uploaded it, the type of data, and so on, as well as components such as data formatting, calculated fields and table structures. The meta-data layer sits between the user interface (UI) your users will use to build reports, and the queries they send to the database. Having a well-designed meta-data layer means you can support self-service analytics dashboards and queries with high performance and security. The most secure BI vendors position their metadata layer as core to their data security offering. For example, Yellowfin implements its data security capabilities primarily at the metadata layer via several different components:- Access Filters: Access filters are designed to restrict the availability of data based on the user running a report. It limits the dataset at the row-level, adding mandatory filters, and is only able to be changed by users with the appropriate security access level. Access filters define a user/row-level-value mapping, and then associate that mapping with the appropriate column in the metadata layer. For example, a manager might be only able to see staff details from reports within their own department.
- Column Level security: In most cases, a report or dashboard view is designed for general use, but the information within some columns may be highly sensitive and not intended for general consumption. Yellowfin offers the capability to secure columns individually to prevent and protect sensitive information from being queried in an ad-hoc report creation (i.e. self-service) capacity. This means only users with appropriate access can see the item/restricted columns when creating or viewing the report.
- Data Source Substitution: This is a multi-tenancy feature paired with client organizations that enables the ability to switch what data source a report is running against, based on what organization the user is in at the time the report is run. It is a helpful and protective data security feature useful if an organization separates their client data by databases with shared schemas, but only wants to create a single report.
#2 - Role-based Access Control (RBAC)
Role-based access controls and authentication is an important modern capability that every analytics solution should provide. A role is essentially a collection of available security functions, which each intended analytics user is associated with to manage their available system functions within the application (report creation, data story authoring, etc), as well as links and permissions over what data is made available for reporting. Having role-based access in an analytics solution allows for clearly defined control over what data is able to be accessed and shared based on users’ needs, departments, etc. For example, you may have a group of BI users who only need to view reports your team creates for them; in this case, their role may limit their functionality to read-only capacity. Another example would be assigning a specific group of BI users access to certain AI-powered features (not to be confused with AI capabilities of non-analytics tools such as ChatGPT) of the analytics platform in question, such as Yellowfin Guided NLQ. Yellowfin provides both pre-built roles and the ability to create your own roles and assign whatever system functions are required for that specific role, helping enterprise and smaller organizations enforce fine-grained access controls over their most critical and sensitive content. Roles and other user attributes can be modified programmatically using Yellowfin’s extensive administration controls. Meanwhile, having the ability to synchronize each user’s attributes and security access is an integral step of a standard SSO implementation, which is the next major consideration. Learn More: Yellowfin Security Model - Functional, Content and Data Security#3 - Single-Sign On (SSO)
Single sign-on (SSO) is an authentication capability that allows users to log in different applications and websites using a common ID. It’s an increasingly important security measure, and it’s just as important your chosen BI vendor supports this authentication method, so your analytics users can access their BI tools securely and seamlessly. Modern SSO is generally expected to provide the capabilities and granularity to control the session state for users’ interactions with the analytics suite, as well as the ability to manage session times and/or terminate sessions, with, at minimum, a global setting for single lockout and session management. This is in addition to supporting other user authentication methods, such as Security Assertion Markup Language (SAML) and Multi-Factor Authentication (MFA), both of which make secure connections and the secure transfer of identity data between two entities (the identify provider used (such as Okta) and the service provider (your analytics suite). Yellowfin allows for integration with all third-party authentication processes mentioned above. Its SSO implementation is based on a model of user replication, which ensures every Yellowfin user only has access to what the admin wants them to via synchronization of the user’s role (which governs content access and available system functions) and their authentication services. An custom authentication bridge is used when connecting Yellowfin with a third party authentication process, matching it with the user’s credentials/attributes in the Yellowfin system for airtight security. Once the match is made, the bridge will execute a SSO of that user into Yellowfin. Yellowfin also allows for a prebuilt SAML Bridge for SSO (for organizations that use identity access providers like ADFS or Okta) which allow for even more seamless configuration for user authentication. These are just some of the options available; you can read more in the link below. Learn more: Single-Sign On in Yellowfin - How Does It Work?