PJ Bradley

Data is everywhere within an organization, and protecting it should be a major concern for businesses, especially those that handle particularly sensitive or important information. One significant factor in data loss prevention (DLP) is behavior analytics—the actions of the users within the company affect the security of the data. There are a number of techniques, tools, and practices that an organization can implement in order to make the most of user behavior analytics for the benefit of the company and its data security. Data lineage is one method that can provide the information and context necessary to analyze user behavior for potentially risky actions.

Defining Data Lineage

Data lineage is a way for organizations to keep an eye on data throughout its life cycle, tracking it from its origins to when it leaves the company. The process allows data to keep certain classifications, access permissions, and other attributes, logging “the way it’s been modified, as well as who is using it and how.” All of this information is stored in a metadata repository. With this additional context about the movement of data, the changes made to it, and the actions taken with it, security and data management teams can better understand and respond to suspicious or risky behavior.

Data lineage works by maintaining knowledge of a piece of data and its attributes. Traditional DLP relies on scanning data for known features and signatures as it leaves the company in order to determine if the data in question is being misused or insecurely handled. In contrast, data lineage enables certainty in these cases—where traditional DLP searches the content of the data to detect facts that data lineage allows to be built in. For example, data originating from certain areas within the company can automatically be marked as sensitive, thus allowing that classification to stay attached to the data throughout its life cycle.

The Importance of Understanding User Behavior

In order to protect sensitive and important data, an organization must be able to see and understand what actions users are taking. Insider threats are a significant concern for many organizations, whether they are malicious or unintentional, and monitoring and analyzing user behavior allows them to be more easily caught and managed. Malicious users taking nefarious actions to harm an organization from within, negligent users mistakenly endangering data with their behavior, and compromised users whose accounts have been stolen via phishing or hacking all can be detected with sufficient user behavior monitoring and analysis tools.

Monitoring and analyzing user behavior is a vital part of protecting data within an organization. Not only does it allow for attacks and errors in progress to be discovered and handled before causing a breach, but it also enables the company’s security and data management teams to take proactive action to prevent future incidents. It can decrease the time required to detect and respond to threats, reduce the chance of false positives, and overall fortify the organization’s security posture. It can also help to identify previously unknown threats by recognizing when a behavior is anomalous as compared to the baseline of normal user activity.

How Data Lineage Helps

Data lineage can be of great use in a number of ways not just limited to DLP. It is often helpful in achieving and maintaining compliance with the mandates of regulatory boards, especially in industries such as financial services and healthcare, where customer data is highly sensitive. It saves security and data management teams a good amount of time and labor by automating processes that would otherwise need to be done manually, like allowing data to inherit access rights and sensitivity classifications rather than continually reassigning them. It also improves the ability to visualize and keep track of who in the company has access to which sensitive data.

In the case of discovering user behavior, data lineage helps by allowing security teams to visualize and manage information relating to data usage. The extra context of the information provided by data lineage tools means that it is possible to track how each piece of data is used, and by whom. This includes the ETL (extract, transform, load) process, editing and modifying data, collaborating with other users, downloading and sending files, and more. While the focus of data lineage is on information pertaining to the data itself, user behavior inherently affects—and is affected by—the data, making data lineage a useful tool for seeing and understanding user behavior.

Conclusion

Protecting the data created and handled by a company is a serious area of concern for security and data management teams. Preventing attacks and accidents alike requires a combination of tools and tactics to approach the issue from multiple angles and fill in security gaps. While traditional DLP solutions can be effective, data lineage is a more thorough and accurate way of classifying data and maintaining the metadata related to sensitive information. With the additional context that data lineage provides for how data is handled and transformed within an organization, it is easier to visualize and analyze user behavior and reduce the risk of breaches.

PJ Bradley is a writer on a wide variety of topics, passionate about learning and helping people above all else. Holding a bachelor’s degree from Oakland University, PJ enjoys using a lifelong desire to understand how things work to write about subjects that inspire interest. Most of PJ’s free time is spent reading and writing. PJ is also a regular writer at Bora.