Privacy data protection is a very hot topic. There are many regulations about privacy protection in the world, such as GPDR, HIPAA, CCPA, PCI DSS, POPI and so on. How to better protect the data in the data lake is the topic we want to discuss. We can find the privacy data scattered in the data lake by Watson Knowledge Catalog(WKC) and protect it at the source by Guardium.
1.Find private data with Watson Knowledge Catalog
WKC provides a rich set of features for data discovery, data governance, data quality, and data consumption. We can find private data by following the steps below.
a. Define the Business Term of the private data, such as name, address, gender, date of birth, education level, marital status, etc.
b.Define classification for privacy data to associate with business term. Such as Sensitive Personal Information.
c.Associate business term with classfication. In the blow example, we associate Marry Status with Sensitive Personal Information.
d.Through Data Discovery, we could scan the data source and associate business term with columns. For those columns associated with the business terms with the classification Sensitive Personal Information are the objects we would protect.
2.Send the metadata of found private data to Guardium for protection
a.In the results of data discovery, change the view Asset Type to Table, then select the table, in the below example, it's CUST_BASE_INFO， where the column you want to protect is within, and the Audit assets button will appear above the table. Click it. If you don't see the button, you should follow the guide in knowledge center to configure the integration.
b.Fill which Guardium appliance and group you'd send.
3. Audit and protect data inside Guardium
a.First we check if CPD sends the Metadata for the data to be protected. This can be done by looking at Groups. We find pre-defined groups by searching for Group Builder in the global search box, e.g.cp4d.
b.Select the group and click the Edit button, then switch to the Members tab. View Meta data. If necessary, you can make minor changes, such as keeping only the table names.
c.Click Comply on the left navigation bar and then click Audit Process Builder to create a new Audit.
d.The core elements for Audit are as follows:
Task Type:Entity Audit Trail
Entity Type:Object Group
Entity Group:cp4d
e.Then run that Audit. if the table was previously accessed, the data from the Audit will be captured.
4. Blocking suspicious user access
a. First we can add some users to the list of users who are denied access. For example, in the following example we have added db2inst3 to the list of memers in the Terminated DB Users group.
b.Create a Security Policy to disable access to certain users.
c. Terminate illegal accesses by adding two Rules for a security Policy, one for S-GATE ATTACH and one for S-GATE TERMINATE.
d.As shown in the figure below, db2inst3's access to the privacy table is interrupted
[db2inst3@guardiumdb2 ~]$ db2 “select * from demo.cust_base_info”
SQL1224N The database manager is not able to accept new requests, has
terminated all requests in progress, or has terminated the specified request
because of an error or a forced interrupt. SQLSTATE=55032
5.Summary
In summary, we can find the privacy data scattered in the data lake by Watson Knowledge Catalog(WKC) and protect it at the source by Guardium.
#CloudPakforDataGroup