Many organizations are looking to Hadoop clusters in order to store and manage an ever-increasing amount of data. As the volume and variety of data in these systems grows, administrators are being confronted with more information, from more sources, than they have ever seen concentrated in a single place. The responsibility for securing all this data can be daunting to an administrator, even intimidating. Could the answer lie in Accumulo? Conventional approaches to data security usually do not suffice for this scenario. They are often coarse-grained, applying only at the file or table level. In a world where arbitrary compute tasks can be pushed into the cluster, defining a security perimeter is difficult or impossible. On the other hand, relegating access policy enforcement to the application level instead of the database level ultimately invites a security disaster. This is the world that Chief Security Officers, Chief Information Officers, and Chief Data Officers live in, and the problem of security for big data is the single biggest impediment to delivering a Hadoop-based solution in the enterprise’s production network. Numerous organizations have implemented Hadoop as a pilot, but find themselves blocked by similar considerations when the time to move into production: • How do you implement fine-grained access controls in a Hadoop system? • What about encryption at rest? Encryption in motion? • How will this tie into our identity infrastructure? • How will this fit into our operational workflow? This keynote will explore the ways in which Apache Accumulo is uniquely positioned to mitigate or resolve problems around access control and security for big data, thus enabling Hadoop clusters to move from pilot to production. – Speaker – Russ Weeks Software Architect, PHEMI Systems Russ Weeks is a Software Architect at PHEMI. Prior to joining PHEMI Systems, Russ worked in the network management groups at Ericsson and Cray Supercomputers, where he discovered a passion for distributed data structures and algorithms. PHEMI Systems is a Vancouver, BC-based startup focused on the storage, retention and governance of structured and unstructured data. — More Information — For more information see http://www.accumulosummit.com/

1. Accumulo in the
Enterprise

3. Hadoop Production Heebie-Jeebies
• Concentration of data: different sources, different types, different
owners.
• Multiple access models: batch, interactive, real-time
• No conventional security perimeter: compute nodes execute
arbitrary user-defined tasks

4. (like any Distributed Key/Value Store)
Flexible Schema!

5. Low-Latency Reads+Writes!
(like any Distributed Key/Value Store)

6. Because the same
operations on the
same data can return
different results to
different people.

7. SQL

8. pt_demographics
pt_id given_name surname dob sex home_address
1024 Neil Armstrong 1930-08-05 M 1981 Orland Dr…
1138 Buzz Aldrin 1930-01-20 M 887 Northern Way…
4242 Michael Collins 1930-10-31 M 3091 Clark Ave…
8080 John Glenn 1921-07-18 M 2857 Commercial Blvd…

9. tabular_data
Row ID CF CQ TS Vis Value
pt_demo:1024 - dob - PHI 1930-08-05
pt_demo:1024 - given_name - PHI Neil
pt_demo:1024 - home_address - PHI 1981 Orland Dr…
pt_demo:1024 - sex - NON_PHI M
pt_demo:1024 - surname - PHI Armstrong

10. pt_demographics_deident
pt_id given_name surname dob sex home_address
1024 N A 1930-01-01 M Vancouver
1138 B A 1930-01-01 M Coquitlam
4242 M C 1930-01-01 M New Westminster
8080 J G 1921-01-01 M Burnaby

11. Doctor Researcher
PHI NON_PHI DE_IDENT

12. tabular_data
Row ID CF CQ TS Vis Value
pt_demo:1024 - dob - PHI 1930-08-05
pt_demo:1024 - dob - DEIDENT 1930-01-01
pt_demo:1024 - given_name - PHI Neil
pt_demo:1024 - given_name - DEIDENT N
pt_demo:1024 - home_address - PHI 1981 Orland Dr…
pt_demo:1024 - home_address - DEIDENT Vancouver
pt_demo:1024 - sex - NON_PHI M
pt_demo:1024 - surname - PHI Armstrong
pt_demo:1024 - surname - DEIDENT A

14. Concentration of Data
Protect and share data with cell-level
security
Multi-Use Cluster
Different views for different users,
managed at the database level
Ambiguous Security Perimeter
Distributed policy enforcement
provided by tablet servers.