OpenText home page.
Tech topics

What is data access governance?

Illustration of IT items with focus on a lightbulb

Overview

Data access governance (DAG) is a market segment that focuses on identifying and addressing the malicious and non-malicious threats that can come from unauthorized access to sensitive and valuable unstructured data.

Organizations look to data access governance to: 

  • Determine if sensitive and valuable files are being stored in secure locations
  • Identify who has access to these files
  • Correct and enforce access permissions

Data access governance

Why is data access governance important?

Network repositories storing unstructured data are oftentimes poorly managed. The extension of unstructured data storage to cloud and collaboration platforms have made management even more challenging. Securing this data against cyberthreats and meeting privacy regulations add further complications.

Data access governance provides the ability to identify what unstructured data is being stored, who has access to it, and the data’s relevance. Data access governance can also provide active protection for repositories storing sensitive and high-value data, as well as attestation through access reviews certifying that only authorized users have access to this data.

Which industries are deploying data access governance today?

Today data access governance is being deployed by all types of organizations storing mission-critical data that must be protected from unauthorized access. With its ability to address data security and privacy regulations, industries such as healthcare, insurance, banking and financial services, retail, manufacturing, energy, pharmaceuticals, government and defense were early adopters of data access governance.

With many terabytes or even petabytes of stored data, will implementing data access governance be a monumental task?

We recommend that you start with a business risk mindset, rather than a technology mindset, and do so in a phased approach. In other words, prioritizing first on identifying and protecting network folders storing your most sensitive or high-value data. In consultation with line-of-business data owners who know the importance of the data, use data access governance reporting to identify if the right users have the right access to the right data. Then establish policies that remediate access permissions and protect repositories from unauthorized access. After securing your most sensitive or high-value repositories, repeat these steps for other locations.

Can data access governance protect organizations from ransomware?

We’ve written how “Ransomware Relies on Poor Data Governance.” Organizations tend to grant excessive access to users, enabling them to pass along ransomware and other types of malware to areas of the network storing critical data. Data access governance lets you perform an analysis of access permissions and then remediate them using the principle of least privilege—restricting access to minimum levels to perform job functions.

What exactly is unstructured data and why is unauthorized access to it so concerning?

Unstructured data is file-based data that is not structured as records in an application database. It includes word processing, spreadsheet, presentation, media, virtual images, and countless other file types. Unstructured data makes up about 80 percent of an organization's stored data.

While PII, PCI, PHI, and other regulated structured data is protected through identity and access management systems and privacy regulations, sensitive and high-value data—including mission-critical data stored in network repositories and in the cloud—is perhaps the most vulnerable to data breaches. This is because it is normally secured by network administrators via NTFS and Active Directory access permissions normally without the involvement of line-of-business data owners who are familiar with the data.

What are some examples of sensitive and high-value unstructured data that could be better secured through data access governance?

Personal information copied from an application’s database and stored on the network is an obvious example. But there are also the “crown jewels” of the organizations that if they were to be breached, could have catastrophic results. Examples might include legal documents, product development plans, yet-to-be-released quarterly sales results, upcoming marketing promotions, business acquisition meeting minutes, and more.

How can data access governance streamline efficiencies for the organization?

Objectives of data access governance include not only identifying risks, but providing the means of remediating them. For example, sending an automated message to data owners that access permissions to a folder storing high-value data have changed. Continuing with that example, automatically restoring the access permissions back to the original settings. Additionally, data access governance software could provide the means of automatically moving sensitive and high-value data to more secure locations on the network.

Does data access governance require an identity and access management (IAM) system?

No, but data access governance solutions are closely tied to IAM approaches and support an identity-centric security approach to data access. In other words, just as IAM systems grant or restrict access to applications and structured data based on identity and role, forward-thinking data access governance developers grant or restrict access to repositories storing sensitive and high-value unstructured based on identity and role.

What is the role of a line-of-business data owner in a data access governance implementation?

A line-of-business data owner is someone designated in a department who knows the relevancy, sensitivity, and value of department files and consequently, works with the network administrator in advising where files should be located, who should have access to files, and which files should be archived or deleted. With some data access governance software, the line-of-business data owner receives security notifications and is even empowered to perform certain data management tasks. For example, enabling and disabling policies that govern user access.

What other benefits are there for deploying data access governance in an organization?

One additional benefit is the ability of data access governance to ensure that users have access to the data that they need to do their jobs. For example, a member of the accounting department over accounts payable who has been mistakenly not given access to network repositories storing invoices, is unable to fulfill her work responsibilities. Data access governance can assure access according to user role.

Why choose OpenText Data Access Governance?

OpenText Data Access Governance is uniquely engineered to leverage identity elements of directory services including IDs, attributes, access permissions, group memberships, and other types of HR data. Consequently, OpenText Data Access Governance not only addresses the requirements of data access governance but also provides additional unique capabilities including:
  • Expansive insight on stored data and associated permissions.
  • Automated responsiveness based on Active Directory events.
  • Security and protection of high-value targets that is strictly enforced.
  • Lifecycle data management for user and group storage.

OpenText is the only solution offering a broad-spectrum DAG solution that:

  • Discovers sensitive data (OpenText Core Data Discovery & Risk Insights).
  • Reports and remediates access (OpenText File Reporter & File Dynamics).
  • Certifies and attests compliance (OpenText Identity Governance).

Learn more: Broad-spectrum data access governance solution overview

Data access governance

Gain insight into your unstructured data and repositories. Then put policies in place to protect it from unauthorized access.

OpenText™ Data Access Governance

Secure unstructured data and prevent unauthorized access

How can we help?

Footnotes