Safeguarding Sensitive Data: Understanding Data Exchange Risks and the Importance of Data Passports | Eureka Security

The focus on protecting sensitive data is often centered around preventing data loss and exposure. However, an overlooked aspect is the potential risk associated with data exchange. In this blog post, we will explore the concept of “data exchange,” and then delve into the importance of “data passports” and how security leaders can implement them to bolster data protection strategies.

‍

What is a Data Exchange and why is it important?

Let’s use an analogy to better grasp the concept of “data exchange.” Think about a country with its people representing different values and inherent risks to its judicial authority. Each person has varying levels of privileges, ranging from tourists who promote trading all the way to refugees in need of aid. The government acts here as the judicial authority, controlling who can enter its borders freely and who must undergo questioning or limitations.

Back to our business scenario, data-sets with sensitive classifications also have their origins and lifecycles. The judicial authority can be a production environment of a university that is regulated under PCI and GDPR, but not under HIPAA. And they can dictate the access and usage of data. When new integrations occur, like data exchange between a university and a hospital for research purposes, the potential risks and benefits must be carefully evaluated before allowing data flow. Just as travelers must undergo a border control review, declare the purpose of their visit, citizenship and cargo, data-sets must undergo a similar review by business owners to determine how they can be utilized.

Let’s take a look at a scenario where a small hospital integrates with a research project, seeking patient details. In an ideal world, this integration would undergo a thorough review by the business owner to assess how the data-set can be used. For instance, the review might determine that the data can only be stored after obtaining HIPAA certification, but budget constraints make it infeasible this year. As a result, any sensitive data must be obfuscated before ingestion to ensure compliance and data protection.

‍

Introducing Data Passports – a 5-Step Approach

Now with that in mind, we can talk about Data Passports. Data Passports play a vital role in facilitating secure data exchange and maintaining an organization’s data security posture. In other words, as a security leader, you share responsibilities as a business owner, representative or data custodian and are expected to implement a robust Data Passport model. 

Here’s a 5-step approach to achieve this:

1. Define the boundaries, as well as the risks and business value of each environment you have
2. Classify the sensitive data in each environment using external categories such as PII, PCI, PHI, and using in-house risk categories such as Confidential, Proprietary and Public
3. Assign business owners or “data champions” and provide training of relevant regulations, environment architecture and data flows
4. Define a structured model to represent data-sets including their importance and risk
5. Create a review and approval process for any new integration, or data exchange gates for both inbound and outbound interactions

‍

Utilizing the Data Passports Template

To streamline the implementation of the Data Passport model, we’ve prepared a helpful template, along with questions to ask:

Request Details:

• Data-set Owner – Who is accountable for this data-set? It is recommended to have both individuals and teams as business owners
• Request affirmation – What business needs require the handling of this data-set?
• Target environments – Which environments are to be integrated with this data?
• Onboarding timeline – What are the target onboarding dates for the data for each environment?

Data-Set Identifiers:

• Source type (internal/external)
• Classifications and risk level
• Estimated size
• Integration type (one-time, continuous)

Data Lifecycle:

• Allowed retention period – How long are we legally allowed to keep the data?
• Expected retention period – What is the expected data retention period to support business use-cases?
• Data removal and lifecycle management – What is the data purging process once it reaches its allowed retention time? What automated or manual processes do we have in place to support proper lifecycle management?”
• Privacy requests – Does the data qualify for privacy requests to track and remove data of specific entities, such as DPIA privacy requests?

Data Handling:

• Data processing – Will the data be handled only in-transit, stored as transient data, or stored for a longer period?
• Data access – Who should have access to this data, including entities and business units, and what is the expected access level for each of them?
• Standing access – Should data consumers, custodians, administrators or any other entity have standing access to the data?

Potential Risks:

• What is the source reputation?
• Who actually will have access to the data in the current architecture, opposed to the minimal access model (as detailed above)?
• Does our attack surface change due to this addition? Do we already have this data-set (or similar) in the target environment?
• What are the additional requirements we will have to implement to support this new classification type? What is the cost?
• Are there any data processing/storage location and compliance (i.e. GDPR Schrems II requires EU related-data to be stored only within EU boundaries) requirements? 
• Can the data be truncated / masked / hashed / tokenized and still provide the same business value?

‍

Key Insight: By creating clarity on data exchange points and unlocking insights about managed data sets, you can transform your organizational data’s “border control.” With this information, examinations become more efficient and tailored to your data protection needs, drawing clear organizational compliance boundaries, and mapping the risk landscape.

‍

Download your own copy now: We have created a Data Passport Template that is read for you to use. Just use this Google Sheet (Open and then copy to be able to edit it). Enjoy!

Conclusion

Data exchange risks are a critical consideration in today’s world of data security. By adopting the Data Passport model, security leaders can empower their companies to ensure the secure and compliant transfer of sensitive data. Through careful evaluation and implementation, Data Passports play a critical role in safeguarding valuable information, fostering trust among stakeholders, and protecting an organization’s reputation. As security leaders, embracing this approach is not just a necessity but an opportunity to set new standards in data protection and foster innovation in the cybersecurity space.

‍