Access to confidential data is a complicated issue. The methods that a company employs to safeguard its sensitive data may be varied, and they may change as business practices evolve. For the most control over sensitive data, businesses must utilize a centralized method which allows administrators to define and implement policies based on what data is being used and for what purpose. Then, the policies need to be implemented across all consumption options and platforms (such as internal and external data).
Mandatory access control is one way to accomplish this. By defining what data each team needs to carry out their work, and providing access based upon that, DAC eliminates many security threats by ensuring employees only have the privileges required for their job. However, it can be difficult to maintain DAC because the process involves manually granting permissions and keeping track of what has been granted to whom.
Another method that is popular is to limit access to data through the concept of access control that is based on role. This makes it easy for administrators to set up policies controlled access to confidential data that grant access to users based on their organizational roles, not individual user accounts. This model is less susceptible to errors and allows for a more detailed “least privilege” model, in which only the most minimal level of access is given to users, with an emphasis on the need to be aware.
Continuously reviewing and updating the policies and technology that control access to data is the best method to ensure that private information is protected. This requires a collaboration between legal teams and the team responsible for data platform that handles and applies those policies as well as the business teams who write them.