SlideShare a Scribd company logo
The Dark Side of Big Data 
……………………………………………... 
CIO, StrataCare, A Xerox Company 
Michael Josephs
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data 
2 
Maslow’s Hierarchy of Needs 
Circa, 2014
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data 
3 
It’s a Gold Mine 
Growth in Data Production 
–2.5 quintillion bytes estimated to be generated from sources such as online or mobile financial transactions, social media traffic, and GPS coordinates (1) 
–450 billion transactions per day by 2020 on the internet (B2B and B2C) has been estimated by IDC. 
–44 fold increase in overall data production 2020 over 2009 predicted (2) 
Replicated Costs & Risks: Many captured transactions are replicated 5 times (or more) 
Employee BYOD: Cisco survey found 89% of companies already have employee BYOD for work. 
(1)World Economic Forum Big Data, Big Impact: New possibilities for international development 
(2)CSC –Big Data Universe 
What Can You Do With It? 
$Accelerate More Intelligent decisions: Large data sets allow for more accurate instrumentation of processes for improved business results 
$Improve Services: Optimize distribution methods, better evaluate and allocate risk and detect fraud 
$Target Sales: More granularly segment customers and potential customers for more efficient business development 
$Create New Revenue Streams: Establish derived products and services 
We Breathe Data
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data 
Big Data Has a Dark Side 
4 
It’s a Gold Mine 
What Can You Do With It? 
$Accelerate More Intelligent decisions: Large data sets allow for more accurate instrumentation of processes for improved business results 
$Improve Services: Optimize distribution methods, better evaluate and allocate risk and detect fraud 
$Target Sales: More granularly segment customers and potential customers for more efficient business development 
$Create New Revenue Streams: Establish derived products and services 
Cost and Risk Continuum 
Security 
Regulatory 
Compliance 
Liability 
Litigation and Discovery 
Infrastructure
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data 
Most Significant Risks and Costs Aren’t Always Clearly Visible 
5 
Emerging Statutory Compliance & AuditsContractual Nuance and StipulationsExisting Infrastructure and SecurityeDiscovery ObligationsEvolving the Infrastructure & Security ApproachEstablish Service Level AgreementsRefine Data Retention Policies/ProceduresPrivacy by Design
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data –Existing Infrastructure and Information Security 
6 
Data Segments Are Often Replicated Up To 5XTransactionalDB 
Mirror 
EDW 
Replicated Costs ++ 
–Standard data topologies often include 5 or more replications of data that must be protected 
–Technical and procedural approaches must be established and maintained for all of them 
–Separate (yet equally stringent) technical and procedural approaches are often needed for the business ecosystemThird Party Ecosystem 
DR/BC
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data –Existing Infrastructure and Information Security 
7 
What is Going On 
Where is it Going 
–Executives are becoming more risk averse than ever before 
–At the same time, Big Data initiatives sometimes get a hall pass from complete business case rigor 
–Evolving Standards 
•Standards for what constitutes acceptable risk for sensitive data protection is changing rapidly 
•As a result, owners of sensitive data are continually reexamining their data security standards and security programs 
–Third party vendors and data custodians are under increasing pressure (& scrutiny to reduce risk levels) 
–IT Budgets are shifting emphasis from innovation to risk reduction 
Challenge is operating one comprehensive data security program (while adhering to customers “a la carte” data security demands) 
–Experienced InfoSec staff are in great demand, making hiring and retention increasing difficult 
–More targeting of standard management frameworks (ISO 27001:2, etc.) for data hosting and the security programs aimed at its protection 
–Data custodians retaining unlimited liability for data breach (no caps) and for ensuring subcontractors meet the same data security SLA’s 
–Increasing investment in data masking is becoming foundational to any data custodianship platform
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data –Regulatory Compliance 
8 
What is Emerging 
Responding 
–Expanding Laws and Regulations: Expansion but without harmonization 
•Government Frameworks (FTC; The White House) 
•Complex international laws and regulations (EU, Canada, Australia, Asia, Latin America) 
–State Data Security and Privacy/Data Breach Laws: now 47 states have adopted laws that in many respects are far more rigorous than HIPPA/HITECH) 
–Know which laws and regulations apply to your (and your customer’s) business 
–Maintain compliance, and documented third party verification, for legally required practice standards (HIPAA, PCI, GLB, etc.) 
–Monitor emerging state data breach laws 
•Notification to affected individuals 
•Notice to state AGs (FL, MA, CA) 
•Government consent decrees (FTC) 
Organizational Design: Ensure executive compliance oversight has appropriate organizational stature and authority
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data –Contractually Speaking 
9 
Trending…. 
Some Protective Steps 
–Hot Topic: Data security is one of (if not) the most hotly negotiated Terms and Conditions in data custodianship related contracts 
–Expanding SLA Coverage: Customers are now demanding that contract SLAs cover: 
Any and all federal and state laws and industry standards will apply to SLAs (even those that don’t apply) 
Data custodian retains unlimited liability for data breach (no caps) 
Data custodian remains liable for ensuring subcontractors meet all customer data security SLAs 
Data Custodian is responsible for breach notification 
Customers have audit rights 
Return/destruction of data (Data ownership remains a gray area?) 
Minimize the custom nature of provisions and align limitation of liability with insurance caps 
–Fully understand the cost of augmenting existing, or implementing and maintain new, security practices before contractual agreement (including the cost of ongoing audits) 
–Use of standards increasing as customers tend to bemore accepting of industry adopted management frameworks (ISO 27001:2, NIST, etc.), possibly reducing audit participation efforts 
–Maintain compliance, and documented third party verification, for legally required practice standards (HIPAA, PCI, etc.) 
–Blind Data/Feedback Licenses 
–Separate the cost of breach (vendor) notification from actual notification (customer)
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data –Contractually Speaking (Third Party Ecosystem) 
10 
Realities 
Dealing 
–The Weak Link: 
•Your data security program is as strong as your weakest subcontractor/provider 
•Many niche service providers are not able to meet fundamental state of the practice information security standards 
–Data Custodians Have Two Key Duties: 
•Duty to Protect: Covers appropriate and reasonable measures to protect data against a breach 
•Duty to Disclose: Notification of breaches to affected parties and regulators; material risks for public companies 
–Take a comprehensive, no-concession approach to vendor audits/assessments. 
–Consider sharing data only AFTER a vendor is fully compliant with security and practice requirements 
–Make access to your clients dependent on keeping pace with the state of the practice 
–Engage with 3rdparty credentialing services such as 3PAS 
Ensure your 3rdparty service provider contracts are as comprehensive as the ones you establish with your clients
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data –Data Retention 
11 
What is Going On Here 
Getting Out Ahead 
–Establish a well vetted and documented data retention policy (a “default” scenario is rarely a good one) 
–Standardize customer and 3rd party vendor contracts and maintain a centralized record for reference and compliance audits 
–Implement secure data destruction mechanisms as part of the program 
Data retention policies must balance the risks of having “it” with the rewards of leveraging “it” 
–Responding to Risk: Organizations are radically re-thinking their data retention policies (where they exist) 
–Key Drivers (for revised data retention policies) include: 
•Customer contract T’s & C’s 
•Vendor record retention policies and procedures; 
•Litigation holds 
•Laws (SEC, IRS, FTC, etc.) 
•Industry standards 
•360 degree cost of retention 
–Heterogeneity: Managing client-specific data retention plans can be highly costly to administer
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
–Deploy technology for supporting eDiscovery needs OR contract for these services 
–Use data masking (data de-identification) along with an effective Data Retention program to reduce data scope for eDiscovery needs 
–Ensure close interaction of legal, IT, accounting and other organizations for common understanding of record retention, destruction, and litigation hold policies and procedures 
Big Data –eDiscovery 
12 
Growing Costs 
Some Steps to Take 
–Possession: If you have “it” (whether or not you should have it), you may have to produce and preserve it 
•Party Litigant (via eDiscovery Demand) 
•Non-party witness 
•Subject of government investigations 
–No Place to Hide: Cost or burden of production rarely matters (no excuse), especially for party litigants 
•Discovery/production-related costs can be massive Consider whether forensic experts will be required 
•Sanctions/penalties for non-production/spoliation could be worse (i.e., Contempt, monetary sanctions) 
Continuously balance the benefit (actual or perceived) of retaining data against the costs and risks of protecting and managing it
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data 
90% of an Iceberg’s Danger is Below the Visible Surface 
13 
This guy would know 
Edwin J. Smith 
Captain, RMS Titanic
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Big Data 
90% of Big Data’s Danger is Below the Visible Surface 
14 
These folks would know
© 2014 StrataCare, A Xerox Company 
All Rights Reserved. 
Thank You 
mjosephs@stratacare.com

More Related Content

What's hot

Cyber Resilience - Welcoming New Normal - Eryk
Cyber Resilience - Welcoming New Normal - ErykCyber Resilience - Welcoming New Normal - Eryk
Cyber Resilience - Welcoming New Normal - Eryk
Eryk Budi Pratama
 
Cybersecurity in Oil & Gas Company
Cybersecurity in Oil & Gas CompanyCybersecurity in Oil & Gas Company
Cybersecurity in Oil & Gas Company
Eryk Budi Pratama
 
Data privacy and security in uae
Data privacy and security in uaeData privacy and security in uae
Data privacy and security in uae
RishalHalid1
 
The Rise of Data Ethics and Security - AIDI Webinar
The Rise of Data Ethics and Security - AIDI WebinarThe Rise of Data Ethics and Security - AIDI Webinar
The Rise of Data Ethics and Security - AIDI Webinar
Eryk Budi Pratama
 
IRJET- An Approach Towards Data Security in Organizations by Avoiding Data Br...
IRJET- An Approach Towards Data Security in Organizations by Avoiding Data Br...IRJET- An Approach Towards Data Security in Organizations by Avoiding Data Br...
IRJET- An Approach Towards Data Security in Organizations by Avoiding Data Br...
IRJET Journal
 
Looking Forward - Regulators and Data Incidents
Looking Forward - Regulators and Data IncidentsLooking Forward - Regulators and Data Incidents
Looking Forward - Regulators and Data Incidents
Resilient Systems
 
Boards' Eye View of Digital Risk & GDPR v2
Boards' Eye View of Digital Risk & GDPR v2Boards' Eye View of Digital Risk & GDPR v2
Boards' Eye View of Digital Risk & GDPR v2
Graham Mann
 
Enabling Data Governance - Data Trust, Data Ethics, Data Quality
Enabling Data Governance - Data Trust, Data Ethics, Data QualityEnabling Data Governance - Data Trust, Data Ethics, Data Quality
Enabling Data Governance - Data Trust, Data Ethics, Data Quality
Eryk Budi Pratama
 
iKnow Solutions Laura Eisenhardt
iKnow Solutions Laura EisenhardtiKnow Solutions Laura Eisenhardt
iKnow Solutions Laura Eisenhardt
BigDataExpo
 
The impact of regulatory compliance on DBA(latest)
The impact of regulatory compliance on DBA(latest)The impact of regulatory compliance on DBA(latest)
The impact of regulatory compliance on DBA(latest)Craig Mullins
 
Defensible cybersecurity-jan-25th-
Defensible cybersecurity-jan-25th-Defensible cybersecurity-jan-25th-
Defensible cybersecurity-jan-25th-
IT Strategy Group
 
Solving the Data Management Challenge for Healthcare
Solving the Data Management Challenge for HealthcareSolving the Data Management Challenge for Healthcare
Solving the Data Management Challenge for Healthcare
Delphix
 
Common Practice in Data Privacy Program Management
Common Practice in Data Privacy Program ManagementCommon Practice in Data Privacy Program Management
Common Practice in Data Privacy Program Management
Eryk Budi Pratama
 
Getting Your House in Order: Cost-effective Litigation Readiness
Getting Your House in Order: Cost-effective Litigation ReadinessGetting Your House in Order: Cost-effective Litigation Readiness
Getting Your House in Order: Cost-effective Litigation ReadinessIron Mountain
 
Threat Ready Data: Protect Data from the Inside and the Outside
Threat Ready Data: Protect Data from the Inside and the OutsideThreat Ready Data: Protect Data from the Inside and the Outside
Threat Ready Data: Protect Data from the Inside and the Outside
DLT Solutions
 
Database auditing essentials
Database auditing essentialsDatabase auditing essentials
Database auditing essentials
Craig Mullins
 
William A. Tanenbaum Association of Benefit Administrators April 2015
William A. Tanenbaum  Association of Benefit Administrators April 2015William A. Tanenbaum  Association of Benefit Administrators April 2015
William A. Tanenbaum Association of Benefit Administrators April 2015William Tanenbaum
 
Cross border - off-shoring and outsourcing privacy sensitive data
Cross border - off-shoring and outsourcing privacy sensitive dataCross border - off-shoring and outsourcing privacy sensitive data
Cross border - off-shoring and outsourcing privacy sensitive data
Ulf Mattsson
 
Data Governance Overview - Doreen Christian
Data Governance Overview - Doreen ChristianData Governance Overview - Doreen Christian
Data Governance Overview - Doreen ChristianDoreen Christian
 

What's hot (20)

Cyber Resilience - Welcoming New Normal - Eryk
Cyber Resilience - Welcoming New Normal - ErykCyber Resilience - Welcoming New Normal - Eryk
Cyber Resilience - Welcoming New Normal - Eryk
 
Cybersecurity in Oil & Gas Company
Cybersecurity in Oil & Gas CompanyCybersecurity in Oil & Gas Company
Cybersecurity in Oil & Gas Company
 
Data privacy and security in uae
Data privacy and security in uaeData privacy and security in uae
Data privacy and security in uae
 
The Rise of Data Ethics and Security - AIDI Webinar
The Rise of Data Ethics and Security - AIDI WebinarThe Rise of Data Ethics and Security - AIDI Webinar
The Rise of Data Ethics and Security - AIDI Webinar
 
IRJET- An Approach Towards Data Security in Organizations by Avoiding Data Br...
IRJET- An Approach Towards Data Security in Organizations by Avoiding Data Br...IRJET- An Approach Towards Data Security in Organizations by Avoiding Data Br...
IRJET- An Approach Towards Data Security in Organizations by Avoiding Data Br...
 
Looking Forward - Regulators and Data Incidents
Looking Forward - Regulators and Data IncidentsLooking Forward - Regulators and Data Incidents
Looking Forward - Regulators and Data Incidents
 
Boards' Eye View of Digital Risk & GDPR v2
Boards' Eye View of Digital Risk & GDPR v2Boards' Eye View of Digital Risk & GDPR v2
Boards' Eye View of Digital Risk & GDPR v2
 
Enabling Data Governance - Data Trust, Data Ethics, Data Quality
Enabling Data Governance - Data Trust, Data Ethics, Data QualityEnabling Data Governance - Data Trust, Data Ethics, Data Quality
Enabling Data Governance - Data Trust, Data Ethics, Data Quality
 
iKnow Solutions Laura Eisenhardt
iKnow Solutions Laura EisenhardtiKnow Solutions Laura Eisenhardt
iKnow Solutions Laura Eisenhardt
 
The impact of regulatory compliance on DBA(latest)
The impact of regulatory compliance on DBA(latest)The impact of regulatory compliance on DBA(latest)
The impact of regulatory compliance on DBA(latest)
 
Defensible cybersecurity-jan-25th-
Defensible cybersecurity-jan-25th-Defensible cybersecurity-jan-25th-
Defensible cybersecurity-jan-25th-
 
Solving the Data Management Challenge for Healthcare
Solving the Data Management Challenge for HealthcareSolving the Data Management Challenge for Healthcare
Solving the Data Management Challenge for Healthcare
 
Common Practice in Data Privacy Program Management
Common Practice in Data Privacy Program ManagementCommon Practice in Data Privacy Program Management
Common Practice in Data Privacy Program Management
 
Getting Your House in Order: Cost-effective Litigation Readiness
Getting Your House in Order: Cost-effective Litigation ReadinessGetting Your House in Order: Cost-effective Litigation Readiness
Getting Your House in Order: Cost-effective Litigation Readiness
 
Threat Ready Data: Protect Data from the Inside and the Outside
Threat Ready Data: Protect Data from the Inside and the OutsideThreat Ready Data: Protect Data from the Inside and the Outside
Threat Ready Data: Protect Data from the Inside and the Outside
 
Database auditing essentials
Database auditing essentialsDatabase auditing essentials
Database auditing essentials
 
William A. Tanenbaum Association of Benefit Administrators April 2015
William A. Tanenbaum  Association of Benefit Administrators April 2015William A. Tanenbaum  Association of Benefit Administrators April 2015
William A. Tanenbaum Association of Benefit Administrators April 2015
 
Cross border - off-shoring and outsourcing privacy sensitive data
Cross border - off-shoring and outsourcing privacy sensitive dataCross border - off-shoring and outsourcing privacy sensitive data
Cross border - off-shoring and outsourcing privacy sensitive data
 
Data Governance Overview - Doreen Christian
Data Governance Overview - Doreen ChristianData Governance Overview - Doreen Christian
Data Governance Overview - Doreen Christian
 
Internal Audit
Internal AuditInternal Audit
Internal Audit
 

Similar to Michael Josephs

Ciso round table on effective implementation of dlp & data security
Ciso round table on effective implementation of dlp & data securityCiso round table on effective implementation of dlp & data security
Ciso round table on effective implementation of dlp & data securityPriyanka Aash
 
Information Governance, Managing Data To Lower Risk and Costs, and E-Discover...
Information Governance, Managing Data To Lower Risk and Costs, and E-Discover...Information Governance, Managing Data To Lower Risk and Costs, and E-Discover...
Information Governance, Managing Data To Lower Risk and Costs, and E-Discover...
David Kearney
 
Data Privacy and Security in UAE.pptx
Data Privacy and Security in UAE.pptxData Privacy and Security in UAE.pptx
Data Privacy and Security in UAE.pptx
Adarsh748147
 
Who changed my data? Need for data governance and provenance in a streaming w...
Who changed my data? Need for data governance and provenance in a streaming w...Who changed my data? Need for data governance and provenance in a streaming w...
Who changed my data? Need for data governance and provenance in a streaming w...
DataWorks Summit
 
Big Data LDN 2017: Applied AI for GDPR
Big Data LDN 2017: Applied AI for GDPRBig Data LDN 2017: Applied AI for GDPR
Big Data LDN 2017: Applied AI for GDPR
Matt Stubbs
 
Institute for the entrepreneur v1r3
Institute for the entrepreneur v1r3Institute for the entrepreneur v1r3
Institute for the entrepreneur v1r3
Dawn Simpson
 
Addressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to Success
Addressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to SuccessAddressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to Success
Addressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to Success
Sirius
 
Hadoop: Making it work for the Business Unit
Hadoop: Making it work for the Business UnitHadoop: Making it work for the Business Unit
Hadoop: Making it work for the Business UnitDataWorks Summit
 
Data Privacy: The Hidden Beast within Mergers & Acquisitions
Data Privacy: The Hidden Beast within Mergers & AcquisitionsData Privacy: The Hidden Beast within Mergers & Acquisitions
Data Privacy: The Hidden Beast within Mergers & Acquisitions
TrustArc
 
Asset Management: Climbing the Asset Maturity Curve
Asset Management: Climbing the Asset Maturity CurveAsset Management: Climbing the Asset Maturity Curve
Asset Management: Climbing the Asset Maturity Curve
Information Services Group (ISG)
 
2016 01-05 csr css non-confidential slide deck
2016 01-05 csr  css non-confidential slide deck2016 01-05 csr  css non-confidential slide deck
2016 01-05 csr css non-confidential slide deck
Richard (Dick) Kaufman
 
Big Data is Here for Financial Services White Paper
Big Data is Here for Financial Services White PaperBig Data is Here for Financial Services White Paper
Big Data is Here for Financial Services White Paper
Experian
 
Webinar #2 - Transforming Challenges into Opportunities for Credit Unions
Webinar #2 - Transforming Challenges into Opportunities for Credit UnionsWebinar #2 - Transforming Challenges into Opportunities for Credit Unions
Webinar #2 - Transforming Challenges into Opportunities for Credit Unions
Denodo
 
GDPR: Leverage the Power of Graphs
GDPR: Leverage the Power of GraphsGDPR: Leverage the Power of Graphs
GDPR: Leverage the Power of Graphs
Neo4j
 
Compliance in Motion: Aligning Data Governance Initiatives with Business Obje...
Compliance in Motion: Aligning Data Governance Initiatives with Business Obje...Compliance in Motion: Aligning Data Governance Initiatives with Business Obje...
Compliance in Motion: Aligning Data Governance Initiatives with Business Obje...
confluent
 
Data Governance
Data GovernanceData Governance
Data Governance
Axis Technology, LLC
 
IAPP Canada Privacy Symposium- "Data Retention Is a Team Sport: How to Get It...
IAPP Canada Privacy Symposium- "Data Retention Is a Team Sport: How to Get It...IAPP Canada Privacy Symposium- "Data Retention Is a Team Sport: How to Get It...
IAPP Canada Privacy Symposium- "Data Retention Is a Team Sport: How to Get It...
Blancco
 
The Most Wonderful Time of the Year for Health-IT...NOT
The Most Wonderful Time of the Year for Health-IT...NOTThe Most Wonderful Time of the Year for Health-IT...NOT
The Most Wonderful Time of the Year for Health-IT...NOT
Compliancy Group
 
Ethyca CodeDriven - Data Privacy Compliance for Engineers & Data Teams
Ethyca CodeDriven - Data Privacy Compliance for Engineers & Data TeamsEthyca CodeDriven - Data Privacy Compliance for Engineers & Data Teams
Ethyca CodeDriven - Data Privacy Compliance for Engineers & Data Teams
Cillian Kieran
 
GDPR and NIS Compliance - How HyTrust Can Help
GDPR and NIS Compliance - How HyTrust Can HelpGDPR and NIS Compliance - How HyTrust Can Help
GDPR and NIS Compliance - How HyTrust Can Help
Jason Lackey
 

Similar to Michael Josephs (20)

Ciso round table on effective implementation of dlp & data security
Ciso round table on effective implementation of dlp & data securityCiso round table on effective implementation of dlp & data security
Ciso round table on effective implementation of dlp & data security
 
Information Governance, Managing Data To Lower Risk and Costs, and E-Discover...
Information Governance, Managing Data To Lower Risk and Costs, and E-Discover...Information Governance, Managing Data To Lower Risk and Costs, and E-Discover...
Information Governance, Managing Data To Lower Risk and Costs, and E-Discover...
 
Data Privacy and Security in UAE.pptx
Data Privacy and Security in UAE.pptxData Privacy and Security in UAE.pptx
Data Privacy and Security in UAE.pptx
 
Who changed my data? Need for data governance and provenance in a streaming w...
Who changed my data? Need for data governance and provenance in a streaming w...Who changed my data? Need for data governance and provenance in a streaming w...
Who changed my data? Need for data governance and provenance in a streaming w...
 
Big Data LDN 2017: Applied AI for GDPR
Big Data LDN 2017: Applied AI for GDPRBig Data LDN 2017: Applied AI for GDPR
Big Data LDN 2017: Applied AI for GDPR
 
Institute for the entrepreneur v1r3
Institute for the entrepreneur v1r3Institute for the entrepreneur v1r3
Institute for the entrepreneur v1r3
 
Addressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to Success
Addressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to SuccessAddressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to Success
Addressing the EU GDPR & New York Cybersecurity Requirements: 3 Keys to Success
 
Hadoop: Making it work for the Business Unit
Hadoop: Making it work for the Business UnitHadoop: Making it work for the Business Unit
Hadoop: Making it work for the Business Unit
 
Data Privacy: The Hidden Beast within Mergers & Acquisitions
Data Privacy: The Hidden Beast within Mergers & AcquisitionsData Privacy: The Hidden Beast within Mergers & Acquisitions
Data Privacy: The Hidden Beast within Mergers & Acquisitions
 
Asset Management: Climbing the Asset Maturity Curve
Asset Management: Climbing the Asset Maturity CurveAsset Management: Climbing the Asset Maturity Curve
Asset Management: Climbing the Asset Maturity Curve
 
2016 01-05 csr css non-confidential slide deck
2016 01-05 csr  css non-confidential slide deck2016 01-05 csr  css non-confidential slide deck
2016 01-05 csr css non-confidential slide deck
 
Big Data is Here for Financial Services White Paper
Big Data is Here for Financial Services White PaperBig Data is Here for Financial Services White Paper
Big Data is Here for Financial Services White Paper
 
Webinar #2 - Transforming Challenges into Opportunities for Credit Unions
Webinar #2 - Transforming Challenges into Opportunities for Credit UnionsWebinar #2 - Transforming Challenges into Opportunities for Credit Unions
Webinar #2 - Transforming Challenges into Opportunities for Credit Unions
 
GDPR: Leverage the Power of Graphs
GDPR: Leverage the Power of GraphsGDPR: Leverage the Power of Graphs
GDPR: Leverage the Power of Graphs
 
Compliance in Motion: Aligning Data Governance Initiatives with Business Obje...
Compliance in Motion: Aligning Data Governance Initiatives with Business Obje...Compliance in Motion: Aligning Data Governance Initiatives with Business Obje...
Compliance in Motion: Aligning Data Governance Initiatives with Business Obje...
 
Data Governance
Data GovernanceData Governance
Data Governance
 
IAPP Canada Privacy Symposium- "Data Retention Is a Team Sport: How to Get It...
IAPP Canada Privacy Symposium- "Data Retention Is a Team Sport: How to Get It...IAPP Canada Privacy Symposium- "Data Retention Is a Team Sport: How to Get It...
IAPP Canada Privacy Symposium- "Data Retention Is a Team Sport: How to Get It...
 
The Most Wonderful Time of the Year for Health-IT...NOT
The Most Wonderful Time of the Year for Health-IT...NOTThe Most Wonderful Time of the Year for Health-IT...NOT
The Most Wonderful Time of the Year for Health-IT...NOT
 
Ethyca CodeDriven - Data Privacy Compliance for Engineers & Data Teams
Ethyca CodeDriven - Data Privacy Compliance for Engineers & Data TeamsEthyca CodeDriven - Data Privacy Compliance for Engineers & Data Teams
Ethyca CodeDriven - Data Privacy Compliance for Engineers & Data Teams
 
GDPR and NIS Compliance - How HyTrust Can Help
GDPR and NIS Compliance - How HyTrust Can HelpGDPR and NIS Compliance - How HyTrust Can Help
GDPR and NIS Compliance - How HyTrust Can Help
 

More from daveGBE

Suren Gupta
Suren GuptaSuren Gupta
Suren Gupta
daveGBE
 
Scott Strickland
Scott StricklandScott Strickland
Scott Strickland
daveGBE
 
Richard Rushing
Richard RushingRichard Rushing
Richard Rushing
daveGBE
 
Jay Ferro
Jay FerroJay Ferro
Jay Ferro
daveGBE
 
J Schwan
J SchwanJ Schwan
J Schwan
daveGBE
 
Emmet B. Keeffe iii
Emmet B. Keeffe iiiEmmet B. Keeffe iii
Emmet B. Keeffe iii
daveGBE
 
Douglas Briggs
Douglas BriggsDouglas Briggs
Douglas Briggs
daveGBE
 
Brian Mc callister
Brian Mc callisterBrian Mc callister
Brian Mc callister
daveGBE
 

More from daveGBE (8)

Suren Gupta
Suren GuptaSuren Gupta
Suren Gupta
 
Scott Strickland
Scott StricklandScott Strickland
Scott Strickland
 
Richard Rushing
Richard RushingRichard Rushing
Richard Rushing
 
Jay Ferro
Jay FerroJay Ferro
Jay Ferro
 
J Schwan
J SchwanJ Schwan
J Schwan
 
Emmet B. Keeffe iii
Emmet B. Keeffe iiiEmmet B. Keeffe iii
Emmet B. Keeffe iii
 
Douglas Briggs
Douglas BriggsDouglas Briggs
Douglas Briggs
 
Brian Mc callister
Brian Mc callisterBrian Mc callister
Brian Mc callister
 

Recently uploaded

Cracking the Workplace Discipline Code Main.pptx
Cracking the Workplace Discipline Code Main.pptxCracking the Workplace Discipline Code Main.pptx
Cracking the Workplace Discipline Code Main.pptx
Workforce Group
 
Lookback Analysis
Lookback AnalysisLookback Analysis
Lookback Analysis
Safe PaaS
 
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
BBPMedia1
 
anas about venice for grade 6f about venice
anas about venice for grade 6f about veniceanas about venice for grade 6f about venice
anas about venice for grade 6f about venice
anasabutalha2013
 
Role of Remote Sensing and Monitoring in Mining
Role of Remote Sensing and Monitoring in MiningRole of Remote Sensing and Monitoring in Mining
Role of Remote Sensing and Monitoring in Mining
Naaraayani Minerals Pvt.Ltd
 
Sustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & EconomySustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & Economy
Operational Excellence Consulting
 
BeMetals Presentation_May_22_2024 .pdf
BeMetals Presentation_May_22_2024   .pdfBeMetals Presentation_May_22_2024   .pdf
BeMetals Presentation_May_22_2024 .pdf
DerekIwanaka1
 
Discover the innovative and creative projects that highlight my journey throu...
Discover the innovative and creative projects that highlight my journey throu...Discover the innovative and creative projects that highlight my journey throu...
Discover the innovative and creative projects that highlight my journey throu...
dylandmeas
 
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBdCree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
creerey
 
The-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic managementThe-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic management
Bojamma2
 
Affordable Stationery Printing Services in Jaipur | Navpack n Print
Affordable Stationery Printing Services in Jaipur | Navpack n PrintAffordable Stationery Printing Services in Jaipur | Navpack n Print
Affordable Stationery Printing Services in Jaipur | Navpack n Print
Navpack & Print
 
3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx
tanyjahb
 
Brand Analysis for an artist named Struan
Brand Analysis for an artist named StruanBrand Analysis for an artist named Struan
Brand Analysis for an artist named Struan
sarahvanessa51503
 
Putting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptxPutting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptx
Cynthia Clay
 
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
Kumar Satyam
 
Set off and carry forward of losses and assessment of individuals.pptx
Set off and carry forward of losses and assessment of individuals.pptxSet off and carry forward of losses and assessment of individuals.pptx
Set off and carry forward of losses and assessment of individuals.pptx
HARSHITHV26
 
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
BBPMedia1
 
20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf
tjcomstrang
 
What are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdfWhat are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdf
HumanResourceDimensi1
 
Project File Report BBA 6th semester.pdf
Project File Report BBA 6th semester.pdfProject File Report BBA 6th semester.pdf
Project File Report BBA 6th semester.pdf
RajPriye
 

Recently uploaded (20)

Cracking the Workplace Discipline Code Main.pptx
Cracking the Workplace Discipline Code Main.pptxCracking the Workplace Discipline Code Main.pptx
Cracking the Workplace Discipline Code Main.pptx
 
Lookback Analysis
Lookback AnalysisLookback Analysis
Lookback Analysis
 
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
 
anas about venice for grade 6f about venice
anas about venice for grade 6f about veniceanas about venice for grade 6f about venice
anas about venice for grade 6f about venice
 
Role of Remote Sensing and Monitoring in Mining
Role of Remote Sensing and Monitoring in MiningRole of Remote Sensing and Monitoring in Mining
Role of Remote Sensing and Monitoring in Mining
 
Sustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & EconomySustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & Economy
 
BeMetals Presentation_May_22_2024 .pdf
BeMetals Presentation_May_22_2024   .pdfBeMetals Presentation_May_22_2024   .pdf
BeMetals Presentation_May_22_2024 .pdf
 
Discover the innovative and creative projects that highlight my journey throu...
Discover the innovative and creative projects that highlight my journey throu...Discover the innovative and creative projects that highlight my journey throu...
Discover the innovative and creative projects that highlight my journey throu...
 
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBdCree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
 
The-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic managementThe-McKinsey-7S-Framework. strategic management
The-McKinsey-7S-Framework. strategic management
 
Affordable Stationery Printing Services in Jaipur | Navpack n Print
Affordable Stationery Printing Services in Jaipur | Navpack n PrintAffordable Stationery Printing Services in Jaipur | Navpack n Print
Affordable Stationery Printing Services in Jaipur | Navpack n Print
 
3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx
 
Brand Analysis for an artist named Struan
Brand Analysis for an artist named StruanBrand Analysis for an artist named Struan
Brand Analysis for an artist named Struan
 
Putting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptxPutting the SPARK into Virtual Training.pptx
Putting the SPARK into Virtual Training.pptx
 
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
 
Set off and carry forward of losses and assessment of individuals.pptx
Set off and carry forward of losses and assessment of individuals.pptxSet off and carry forward of losses and assessment of individuals.pptx
Set off and carry forward of losses and assessment of individuals.pptx
 
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
RMD24 | Retail media: hoe zet je dit in als je geen AH of Unilever bent? Heid...
 
20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf
 
What are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdfWhat are the main advantages of using HR recruiter services.pdf
What are the main advantages of using HR recruiter services.pdf
 
Project File Report BBA 6th semester.pdf
Project File Report BBA 6th semester.pdfProject File Report BBA 6th semester.pdf
Project File Report BBA 6th semester.pdf
 

Michael Josephs

  • 1. The Dark Side of Big Data ……………………………………………... CIO, StrataCare, A Xerox Company Michael Josephs
  • 2. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data 2 Maslow’s Hierarchy of Needs Circa, 2014
  • 3. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data 3 It’s a Gold Mine Growth in Data Production –2.5 quintillion bytes estimated to be generated from sources such as online or mobile financial transactions, social media traffic, and GPS coordinates (1) –450 billion transactions per day by 2020 on the internet (B2B and B2C) has been estimated by IDC. –44 fold increase in overall data production 2020 over 2009 predicted (2) Replicated Costs & Risks: Many captured transactions are replicated 5 times (or more) Employee BYOD: Cisco survey found 89% of companies already have employee BYOD for work. (1)World Economic Forum Big Data, Big Impact: New possibilities for international development (2)CSC –Big Data Universe What Can You Do With It? $Accelerate More Intelligent decisions: Large data sets allow for more accurate instrumentation of processes for improved business results $Improve Services: Optimize distribution methods, better evaluate and allocate risk and detect fraud $Target Sales: More granularly segment customers and potential customers for more efficient business development $Create New Revenue Streams: Establish derived products and services We Breathe Data
  • 4. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data Big Data Has a Dark Side 4 It’s a Gold Mine What Can You Do With It? $Accelerate More Intelligent decisions: Large data sets allow for more accurate instrumentation of processes for improved business results $Improve Services: Optimize distribution methods, better evaluate and allocate risk and detect fraud $Target Sales: More granularly segment customers and potential customers for more efficient business development $Create New Revenue Streams: Establish derived products and services Cost and Risk Continuum Security Regulatory Compliance Liability Litigation and Discovery Infrastructure
  • 5. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data Most Significant Risks and Costs Aren’t Always Clearly Visible 5 Emerging Statutory Compliance & AuditsContractual Nuance and StipulationsExisting Infrastructure and SecurityeDiscovery ObligationsEvolving the Infrastructure & Security ApproachEstablish Service Level AgreementsRefine Data Retention Policies/ProceduresPrivacy by Design
  • 6. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data –Existing Infrastructure and Information Security 6 Data Segments Are Often Replicated Up To 5XTransactionalDB Mirror EDW Replicated Costs ++ –Standard data topologies often include 5 or more replications of data that must be protected –Technical and procedural approaches must be established and maintained for all of them –Separate (yet equally stringent) technical and procedural approaches are often needed for the business ecosystemThird Party Ecosystem DR/BC
  • 7. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data –Existing Infrastructure and Information Security 7 What is Going On Where is it Going –Executives are becoming more risk averse than ever before –At the same time, Big Data initiatives sometimes get a hall pass from complete business case rigor –Evolving Standards •Standards for what constitutes acceptable risk for sensitive data protection is changing rapidly •As a result, owners of sensitive data are continually reexamining their data security standards and security programs –Third party vendors and data custodians are under increasing pressure (& scrutiny to reduce risk levels) –IT Budgets are shifting emphasis from innovation to risk reduction Challenge is operating one comprehensive data security program (while adhering to customers “a la carte” data security demands) –Experienced InfoSec staff are in great demand, making hiring and retention increasing difficult –More targeting of standard management frameworks (ISO 27001:2, etc.) for data hosting and the security programs aimed at its protection –Data custodians retaining unlimited liability for data breach (no caps) and for ensuring subcontractors meet the same data security SLA’s –Increasing investment in data masking is becoming foundational to any data custodianship platform
  • 8. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data –Regulatory Compliance 8 What is Emerging Responding –Expanding Laws and Regulations: Expansion but without harmonization •Government Frameworks (FTC; The White House) •Complex international laws and regulations (EU, Canada, Australia, Asia, Latin America) –State Data Security and Privacy/Data Breach Laws: now 47 states have adopted laws that in many respects are far more rigorous than HIPPA/HITECH) –Know which laws and regulations apply to your (and your customer’s) business –Maintain compliance, and documented third party verification, for legally required practice standards (HIPAA, PCI, GLB, etc.) –Monitor emerging state data breach laws •Notification to affected individuals •Notice to state AGs (FL, MA, CA) •Government consent decrees (FTC) Organizational Design: Ensure executive compliance oversight has appropriate organizational stature and authority
  • 9. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data –Contractually Speaking 9 Trending…. Some Protective Steps –Hot Topic: Data security is one of (if not) the most hotly negotiated Terms and Conditions in data custodianship related contracts –Expanding SLA Coverage: Customers are now demanding that contract SLAs cover: Any and all federal and state laws and industry standards will apply to SLAs (even those that don’t apply) Data custodian retains unlimited liability for data breach (no caps) Data custodian remains liable for ensuring subcontractors meet all customer data security SLAs Data Custodian is responsible for breach notification Customers have audit rights Return/destruction of data (Data ownership remains a gray area?) Minimize the custom nature of provisions and align limitation of liability with insurance caps –Fully understand the cost of augmenting existing, or implementing and maintain new, security practices before contractual agreement (including the cost of ongoing audits) –Use of standards increasing as customers tend to bemore accepting of industry adopted management frameworks (ISO 27001:2, NIST, etc.), possibly reducing audit participation efforts –Maintain compliance, and documented third party verification, for legally required practice standards (HIPAA, PCI, etc.) –Blind Data/Feedback Licenses –Separate the cost of breach (vendor) notification from actual notification (customer)
  • 10. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data –Contractually Speaking (Third Party Ecosystem) 10 Realities Dealing –The Weak Link: •Your data security program is as strong as your weakest subcontractor/provider •Many niche service providers are not able to meet fundamental state of the practice information security standards –Data Custodians Have Two Key Duties: •Duty to Protect: Covers appropriate and reasonable measures to protect data against a breach •Duty to Disclose: Notification of breaches to affected parties and regulators; material risks for public companies –Take a comprehensive, no-concession approach to vendor audits/assessments. –Consider sharing data only AFTER a vendor is fully compliant with security and practice requirements –Make access to your clients dependent on keeping pace with the state of the practice –Engage with 3rdparty credentialing services such as 3PAS Ensure your 3rdparty service provider contracts are as comprehensive as the ones you establish with your clients
  • 11. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data –Data Retention 11 What is Going On Here Getting Out Ahead –Establish a well vetted and documented data retention policy (a “default” scenario is rarely a good one) –Standardize customer and 3rd party vendor contracts and maintain a centralized record for reference and compliance audits –Implement secure data destruction mechanisms as part of the program Data retention policies must balance the risks of having “it” with the rewards of leveraging “it” –Responding to Risk: Organizations are radically re-thinking their data retention policies (where they exist) –Key Drivers (for revised data retention policies) include: •Customer contract T’s & C’s •Vendor record retention policies and procedures; •Litigation holds •Laws (SEC, IRS, FTC, etc.) •Industry standards •360 degree cost of retention –Heterogeneity: Managing client-specific data retention plans can be highly costly to administer
  • 12. © 2014 StrataCare, A Xerox Company All Rights Reserved. –Deploy technology for supporting eDiscovery needs OR contract for these services –Use data masking (data de-identification) along with an effective Data Retention program to reduce data scope for eDiscovery needs –Ensure close interaction of legal, IT, accounting and other organizations for common understanding of record retention, destruction, and litigation hold policies and procedures Big Data –eDiscovery 12 Growing Costs Some Steps to Take –Possession: If you have “it” (whether or not you should have it), you may have to produce and preserve it •Party Litigant (via eDiscovery Demand) •Non-party witness •Subject of government investigations –No Place to Hide: Cost or burden of production rarely matters (no excuse), especially for party litigants •Discovery/production-related costs can be massive Consider whether forensic experts will be required •Sanctions/penalties for non-production/spoliation could be worse (i.e., Contempt, monetary sanctions) Continuously balance the benefit (actual or perceived) of retaining data against the costs and risks of protecting and managing it
  • 13. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data 90% of an Iceberg’s Danger is Below the Visible Surface 13 This guy would know Edwin J. Smith Captain, RMS Titanic
  • 14. © 2014 StrataCare, A Xerox Company All Rights Reserved. Big Data 90% of Big Data’s Danger is Below the Visible Surface 14 These folks would know
  • 15. © 2014 StrataCare, A Xerox Company All Rights Reserved. Thank You mjosephs@stratacare.com