How to protect sensitive customer data without a single line of code

Are you the product owner of customer data, including personal data like name, email, and address, and sensitive data such as bank account or credit card numbers? On top of that, does this data relate to a range of countries where your company is doing business? Then there’s no doubt you’re in for a real challenge. Find out how Collibra Protect enables you to handle that challenge.

Plenty of reasons to start worrying about protecting your customer data

For a start, regulations require you to handle sensitive customer data carefully and only grant access to user roles that need it as part of their job assignment. You certainly don't want the whole company to see this information. Moreover, you have to consider that there are business unit owners per country. According to company policy, they should only have insight into their country, not the other countries for which they are not responsible. And finally, you need to remember that the Finance department needs full access to data across all countries.

As a result, many different user roles with distinct access rights are required. That’s not just a lot of work. There’s also a considerable risk of making mistakes. Plenty of reasons to start worrying, then.

Managing access to sensitive customer data is walking a thin line

There are several ways you could manage access to sensitive customer data.

• You could give no one access, so there is zero risk of misusing the data. People should request access when needed, and you'll approve case by case. The trouble with such an approach is that you'll lose a lot of time approving or rejecting access if your data product is in high demand. You’re making yourself the bottleneck, with data users experiencing friction and increased wait times to start analyzing the data. If your company wants to enable data-driven decision-making through self-service BI (which is where a lot of companies want to go), you’re definitely moving in the wrong direction.

• You could make different materialized views (or even different data sets) depending on the audience that asks for it, and provide view-based access. You could, for example, make different tables per country and per country lead, along with a general table that doesn’t include the sensitive data columns that other users can access. That comes with the apparent downside of data duplication, which leads to higher storage costs and makes it much more difficult for end-users to find the data they need.

Such approaches, however, often create a strong dependency on IT teams to develop and implement access policies, increasing costs and the time needed to get insights from the data. In addition, they complicate matters from a compliance point of view: it's difficult to see which policies are in place and whether they are actually complied with.

That’s where Collibra Protect comes in

Collibra Protect is a new solution enabling users to create and manage data access policies centrally from the Collibra Data Intelligence Cloud. Then, these policies can automatically be implemented in AWS Lake Formation, BigQuery, or Snowflake without a single line of code!

Securing sensitive customer data through Data Protection Standards

Let's go back to the example we started with: you want to restrict access to the sensitive part of the customer data you’re in charge of for anyone but the Finance department - wherever the data is stored in AWS Lake Formation, BigQuery, or Snowflake.

Using Collibra Protect, you can create a Data Protection Standard, selecting the data category "personal information" to be hashed by default for a specific target group of users.

Once the Data Protection Standard has been saved and run, the result is pushed into AWS Lake Formation, BigQuery, or Snowflake - hashing, for example, the data field cust_name for every person in the target group…

… except for people from the Finance department. As they are not part of the target group, they have more extensive access rights to see the data field cust_name unhashed and can fully access other sensitive data.

And all of this has been achieved without writing a single line of code. No technical expertise was needed!

Creating Data Access Rules to grant or deny access

While Data Protection Standards enable you to secure data columns containing a specific type of sensitive data, more is needed in the context of the current use case. You also need row-based access policies to ensure business unit owners can only access the data rows corresponding to their country, not the entire dataset of financial results by country. The Finance department, however, should still be able to see and analyze the financial results for all countries.

Again, Collibra Protect enables you to achieve this goal without a single line of code. Simply create a Data Access Rule for the dataset of financial results by country, and select 'SHOW' rows where 'Country = USA' for a specific target group of users.

Again, save and run the Data Access Rule to automatically push the result into AWS Lake Formation, BigQuery, or Snowflake.

Users from the USA will only see the row(s) for which 'Country = USA’…

…whereas people from the Finance department will be able to see the whole table.

Benefits of using Collibra Protect

By enabling you to define and control data access from a single location, Collibra Protect brings you a bunch of benefits.

• Handle access to data products as close to the business as possible.

As a product owner, you’re accountable for the customer data you manage. Using Collibra Protect, you can decide (together with a data steward, and without a strong dependency on IT teams) which data can be seen by whom and which data should be restricted. ​

• Implement access policies by default, reducing friction & access requests.

You can give more people default access to your data without any risk. After all, they can only see what you defined as accessible through the data access policy. Access management should, therefore, become less of a bottleneck, increasing the time available to analyze the data.

• Shift left.

Instead of managing governance after the fact, Collibra Protect enables you to implement governance policies directly on your customer data source.

• Save on cloud costs.

With Collibra Protect, there is no longer any need to create a series of different "materialized views" of the data depending on the persona that needs it. You just need one product with default access rules, which helps you save on cloud costs.​

If you want to reap those benefits, your data catalog needs to be documented in the Collibra Data Intelligence Cloud so that the information is available to run your data access policies. You can use Collibra's connectors for AWS Lake Formation, BigQuery, or Snowflake to get you started!

Need a hand?

Need help to protect your sensitive customer data without a single line of code? Reach out to us, and we’ll happily review what’s needed to help implement Collibra Protect!