The Challenge of Implementing Data and
Content Security
It is critical that the policies that govern such access must be understandable, both to the business and IT. They must be accurately implemented and auditable, so that any risks can be identified and their impact and likelihood understood. Authorizing access to information quickly moves from being a high level business issue to a hands-on technology challenge. Surprisingly, only a few key IT administrators in every large organization really understand how significant the challenge is.
IT needs an integrated and flexible authorization process to access information; however, the business doesn’t understand how complex and expensive this is. TAuthorizing access in a typical BI reporting application can easily require hundreds of thousands of manual steps to implement. Manual processes are not reliable, or repeatable in any timeframe – short or long term.
Implementing “policies” requires that IT create groups to limit access to content and data – these are known as “policy groups.” There can easily be thousands of “policy groups” within a typical business intelligent application. IT needs to be able to design and implement centralized control of the policies to ensure integrity of information access. It needs to know when the changes will be applied and to be able to verify that the changes have been successfully applied. Once that policy groups are created, users are assigned to these groups as “members.”
IT’s challenges are as follows:
- Creating Policies. Without automation, IT cannot possibly create the policy groups necessary to adequately secure BI applications. The number of steps involved to create and manage policies is staggering and cannot be completed by manual means.
- Managing Memberships. IT cannot realistically keep track of memberships in an organization. Which manager took over from which other manager and must now assume their responsibility. Who is on vacation for 2 weeks and must temporarily delegate their information access for that period and then reliably revoke it. These changes are only known by the business
- Changing Policies. Because policies change over time, IT needs to be able to design or change policies in the development environment, quality assure them in a test environment and then deploy them into production. Testing, quality assurance, and promotion to production has to happen quickly and reliably. A failure here could lead to unauthorized access (e.g. Kmart seeing Walmart’s data) which can be a costly mistake.
- Limited Human Capital. A further challenge is that typically an IT organization has very few people responsible for the complex task of security administration. Managing fine-grained security on content and data manually object by object is not cost effective, neither is it very reliable.
The Solution
The answer has to be software that designs sophisticated policies and automates the design, testing and implementation across the application lifecycle. The software must facilitate the process cost effectively without increasing existing IT human resources.
Enter FirstQuarter Security Studio
The first commercially developed software solution that addresses these issues. It dramatically reduces the cost of addressing all of these challenges. It reduces the time from man-months to minutes. The software was initially designed specifically with IBM Cognos in mind.
Learn more about how FirstQuarter addresses: