Organizations need to ensure that they have appropriate access and authorization controls, strong identity management and audit processes in place. Most importantly, they need a robust and well-tested incident response plan “that can quickly determine what, how much, and to what extent data has been compromised in the enterprise, and how to quickly restore not only functionality but trust in data once an attack has been successfully executed,” Hockenberry says.
Deploying data encryption where it makes sense is another key step. “Each data lake becomes an endpoint with unique vulnerabilities,” Aron says. “Data at rest should always be encrypted, without exception. Self-encrypting drives make it easier to ensure data is secure from the get-go.”
The recent string of high-profile hacks is serving to remind organizations that security should remain a top concern in any data architecture, Aron says. “The world is producing exponentially more data, and inevitably enterprises are creating more and more data lakes to house these new streams of data,” he says. “These disparate data silos create a headache for the security community because there are inevitably more doors for hackers to try and penetrate.”
It’s safe to assume that threats against data lake technologies will increase significantly as they become more mainstream, Steenland says. “However, the biggest threat will likely be insider threats due to inadequate deployment and configuration of these technologies,” he says.
All the more reason for executives to add data lakes to their list of key resources to protect.
“Companies should take the same types of steps as they would securing any type of data to include giving consideration as to who needs access to the data and how it will be used, ensuring strong access controls exist and logging is in place,” Steenland says. “Some level of information governance is still required, especially if the data includes regulated data.”
Sign up for CIO Asia eNewsletters.