Data Lake and Data Warehouse Security - Satori

Data Lake and Data Warehouse Security

In this chapter we’ll provide information about Data Lake and Data Warehouse, and cover the following topics:

Protecting data lakes and data warehouses is especially challenging, due to the following factors:

Data lakes and data warehouses are at the intersection of multiple functions. Data from multiple sources is transformed, and various functions (whether people or apps) process the output with different methods and purposes. This variety makes any security project complicated, as many components, steps, and processes may fail.
The data may be very versatile, especially in data lakes. Data can be structured (many different types), semi-structured, or unstructured.
The high rate of data technology innovation, makes securing it an ever-moving target.
The internal security controls implemented in data warehouses and data lakes are often insufficient and require additional external controls to ensure security.

What Are the Security Concerns in Building a Data Warehouse?

When building a data warehouse, or when securing an existing one, there are several important concerns to address:

Mapping existing data. You should be able to catalog the data in your warehouse, understand where sensitive data is stored, and identify who has access to it.
Implementing access controls. Begin with proper authentication, which usually includes integration with your organization’s SSO control and may require additional restrictive policies.
Proper authorization. Configure which users need access to and what type of access is required.
Granularity in the access. Set different levels of access based on specific columns, rows, or items.
Combating over-privilege. Analyze actual usage of data locations compared to access granted to users, and set workflows around rarely accessed data.
Auditing and monitoring. Maintain audit and monitoring queries and jobs running on the data warehouse.
Behavior analysis. Access to data should be analyzed for risks such as bad practices or insider threats.
Continuous security. The highly dynamic nature of data environments requires continuous security rather than one-time projects.

Security Policies for Data Warehouses

Security policies in data warehouses address security and compliance gaps in order to reduce the risks involved. Some policies can be implemented on the data warehouse itself, and others should be handled by external tools.

Examples of security policies for data warehouses:

Ensuring that only users in specific groups have access to sensitive information.
Restricting access to amounts or types of data being pulled from outside IP addresses.
Restricting users to data they have not accessed within a given period.
Restricting users only to data from their geographic region.

Implementing Security Controls for Snowflake Data Warehouse

Several common concerns to note when implementing security controls for Snowflake:

Role hierarchies may be tempting to use but may not prove effective in the long run.
Access logs and query logs are kept for a certain amount of time and may have data latency issues.
Achieving granular access to data may require implementing column and row based access controls.

For further details about securing your Snowflake data warehouse, read our Snowflake data protection guide.

Implementing Security Controls for AWS Redshift Data Warehouse

Common concerns when implementing security controls for AWS Redshift:

Access and query logs are limited in terms of retention time.
Consider investing the time to integrate Redshift access with an identity management system for enhanced visibility.

For further details about securing your AWS Redshift data warehouse, read our Redshift data protection guide.

Implementing Security Controls for GCP BigQuery

Common concerns when implementing security controls for BigQuery:

Monitor your BigQuery jobs and analyze the BigQuery jobs log.
Ensure that users only have access to the specific tables they need.

For further details about securing your GCP BigQuery data warehouse, read our BigQuery data protection guide.