This document discusses security considerations for data lakes. It notes that data lakes consolidate an organization's most valuable data, making them an attractive target for hackers. The document outlines key risks like housing all customer data in a single repository and in the cloud. It proposes security design principles like zero trust and least privilege. The document then presents a protection framework with components like access controls, network security, data protection policies and governance. Specific capabilities are described for areas like platform access, policies, network isolation, and data protection. The goal is to properly secure the data lake while still enabling data sharing and analytics.

1. Data Lake Analytics
Information Security
Finto Thomas
3rd January 2019

2. Agenda
1. Current Industry Trend
2. Key Risks to address
3. Security Design Principles
4. Protection Framework
5. Security Capabilities to be established

3. Big data projects are proliferating at a rapid rate across organizations of all
kinds, in all industries. In recent years , 65 percent of data and analytics
decision-makers had implemented big data solutions, according to Forrester.
That number should reach almost 100 percent in the next few years.

4. “Data lakes often bring together an enterprise’s most valuable data to
perform analytics and/or build predictive models. Hackers would like nothing
more than to engineer a single breach with access to all of it,” according to
Forrester Research analysts Mike Gualtieri, John Kindervag, and Kelley
Another key requirement is to meet Regulatory Compliance such as GDPR.

5. Data in the data lake will include a large amount of data from many systems. The data will include
some of the most valuable and sensitive information that the organization has - in particular,
personal information about customers.
• How is the right information located and fed into data lake with Integrity ?
• How is this information protected while still being open for sharing ?
• How is the Data lake itself protected and maintain the business continuity ?
Data Lake is great but has Challenges

6. Risk - Could turn lake water muddy !!
• Single Repository of all Customer data
• Data resides in cloud
• Type of Cloud
• Geo location
• Security Visibility
• Data Sources and validation
• Identification of data sources and dataset
• Data classification and tagging for applying adequate controls
• Regulatory
• Country or Geo specific ( GDPR)
• Retention

7. Security Design Principles
• Zero trust
• Least privilege
• Data-centric security
• Cloud First

8. Data Lake Protection Framework
Data Lake
Platform
Access
and
Privileges
Network
security
and
isolation
Data
Protection
Policies and
Governance
People , Tool , Process

9. Platform Access and Privileges
• Sign-On and Single Sign-On
• Data – HDFS File System
• Data – External (Federation Server, SAML)
• Batch Environment Security
• Query Data Security
• LDAP Authentication
• Administering Security (Roles, groups)
• Access Control Lists (ACLs)
• Cooperate wide schema system
Policies and Governance
• Business continuity planning or disaster recovery
• Integrate with Document management
• Roles and responsibilities (RACI ) defined
• Log Files, Audit and Controls
• Backups and retentions
• Access management approval process
• CIS standards for hardening benchmark
• Regular Compliance and access validation process
Security Capabilities

10. Security Capabilities (continue..)
Network Security and Isolation
• Operating systems and Hardware Vulnerability
Management and hardening
• Web and API interfaces and Virtual private
Network
• Application Data Security
• Network isolation or Multi tenancy at cloud
service
• Integration to Security incident and event
management system (SIEM)
• Backup to protect from ransomware
Data Protection
• Data Owner
• Data Classification and tagging
• Classification of data produced by
conversion/aggregation
• Database activity Monitoring
• Data encryption
• Data masking and tokenization
• External Databases

11. Data lake is first step in the big data journey for any organization.
Thank You