Helen Patton - Governing Big Data: Security, Privacy & Data Management
- 1. Who’s Who in Data Oversight
- 3. • Authorization• Data to Collect? What Who
- 4. • Data Collection Method • Authorization• Data to What Who How
- 5. • Data Collection Method • Business/Legal Justification • Authorization• Data to Collect? What Who HowWhy
- 7. Data Officer › Utilization of Information – Data Processing, Analysis, Data Mining, etc. Norma Dove-Edwin CDO Places for People Group Ltd JoAnn Stonier CDO Mastercard
- 8. Privacy Officer › Manage Personal Information – Authorization, Revocation, Incident Response, etc. Erin Egan CPO Facebook Michelle Finneran Dennedy CPO Cisco
- 9. › Security Officer – System and Data Protection Alissa Johnson CISO Xerox Cheri McGuire CISO Standard Chartered Bank
- 10. 10 CISO • Protecting Data & Systems CPO • Authorizing Data Usage CDO • Using/Managing Data
- 11. › Information Security: – Is a process – Themes › Confidentiality/Correct Access › Integrity › Availability – Ensures business systems and processes behave as expected CISO • Protecting & Systems
- 12. › Data Management: – Is a tool – Process Centered – Themes: › Velocity › Volume › Variety › Veracity – Ensures that usage satisfies business objectives CDO • Corporate Use
- 13. › Privacy: – Is a right – Person-Centered – Themes: › Unlinkability › Untraceability › Unobservability › Anonymity › Pseudonimia – Legally Intelligent – Verifies compliance of Privacy Practices CPO • Authorizing Data Usage
- 14. 14 D/P/S Officers Senior Leadership Human Resources Fiscal Support Legal/Compliance
- 15. 15
- 17. 17 For the Company • Results-Focused • Demonstrate Ownership • Align to Common Good • Be Proactive
- 18. 18 For the Analyst • Take classes on Data/Privacy/Security Concepts • Privacy: IAPP.org • Security: SANS.org • Data: ISCDO.org • Take your partners to lunch/coffee • Learn what they care about • Teach what you care about • Talk about your initiatives, find common ground
- 19. 19 For the Company • “Shift Left” • Security Throughout Development • Private-From-The-Start • Provide real-time analysis tools • Enable/Support self-correction
- 20. 20 For the Analyst • Know how to use scanning/analysis tools • Talk to your project leads about incorporating governance into the work plan • Continue to talk to governance groups about your initiatives
- 21. 21 For the Company • Training – Values – Rules – Processes • Transparency • Respect and Support
- 22. 22 For the Analyst • Ask a governance person to be your mentor • Review your oversight/operational processes with governance
- 23. 23 • Employees • Leadership • Partners • Customers
- 24. • Data Collection Method • Business/Legal Justification • Authorization• Data to Collect? What Who HowWhy TRUST SUPPORT
- 25. 25 Helen Patton [email protected] Enterprise Security Ohio State University @OSUCISOHelen https://medium.com/@Hpatton
Editor's Notes
- #2: Background – what is my grounding for this topic? Why Governance? What question am I answering?
- #3: Students at OSU have indicated they know they are being analyzed, and that’s OK. They’ve also indicated that they find collection of location data to be creepy/scary
- #4: Who owns the data? The patient? The customer? The partner? Who can see the data? Access management In big data, there is often more than 1 owner – who decides who can see the data?
- #5: Self Reported? Buying from a vendor? Surveys? Internal company systems? Do you duplicate the data source, or analyze the data in place? Timing is important – do you need the data now, or can it come later?
- #6: Need to know why we are doing what we’re doing Is it legal? Is it necessary? Is it nice to do/have?
- #7: Tell a story about being an analyst: constrained by OTOSOB, now also data governance. Signs of issues in this space: Rework Governance requirements coming in after design Changes in regulations during a multi-year project
- #8: If you hear the term Data Cookbook, you know you’re dealing with a CDO
- #9: Representing the Individual, not the Company
- #17: I “Invite You To Think About” the following items
- #18: This is organizational management 101. I would argue that if your work culture is not already like this, your ability to be a successful Data Analyst will be limited Applies to large and small companies
- #20: This is where analysts and governance collide