Types of Analytic Users

Analytics is becoming more important for todays companies.  As companies look to make data-driven decisions, it is paramount that the data driving those decisions is accessible to all the necessary users.  Each user has a unique set of needs based on their role within the organization, their skill set and knowledge of corporate decision-making processes.

Analytical environments should be built to enable a variety of user types from a single set of data and resources.  Each user should be enabled with an interface that meets their individual job needs, and integrates with any necessary business processes.

Within Analytics, we see three primary types of users:

• Empowered – Empowered users are those that gain real value from the analytic technologies and tools, but do not know about the underlying technology, nor does their primary role focus on the underlying technology.  These users are typically experts in a business process and the inputs & outputs of that process.  These users commonly use a tool that presents the data in pre-packaged format, while allowing them flexibility to modify any reports to meet their specific process needs.
• Aware – Aware users are educated of the underlying technology and understand the power of it, but are not responsible for the daily operations of the analytic environment.  Aware users will commonly consume analytical technologies, have a background in computer science or information technology and focus on creating tools for Empowered users to consume.  Aware users are the connection point between information technology operations and Empowered users that consume the data stored within analytical environments.
• Enabled – Enabled users are the staff that deeply understand the workings of the analytical environment and are responsible for operations.  Enabled users will commonly be deeply technical staff with some understanding of the business processes, but defer deep process and data value questions to Aware users.

When building analytic environments and deploying new technologies, it is key to map those technologies to the user types and ensure all users have the tools they require for the job they perform.

Vectors of Information Security

Within the realm of information security, a lot of focus is paid to the vectors of attack. Essentially how an attacker can go after your networks, systems, people and information. These vectors focus on how the attacks can occur, how to detect and respond to them. But they only hit on part of the challenge in securing todays complex information technology (IT) environments.

Vectors of Information Security start with a definition of what behavior is allowed and then monitor and react to anything outside of that defined criteria. Most information security policies state policies in the form of “Administrators will deny access to those not allowed”. In the form of VIS, we will say that “Active employees are allowed access” and respond to all access outside that form. This is a variation of the security models focused on policies based on denying access and is a change in mindset for many security professionals.

More critical then the vectors of attach, are the overarching Vectors of Information Security (VIS). These correlate to the overall usage of information and allow Architects, Administrators and IT Leadership to plan accordingly for information access and risk management around expected usage patterns. The three Vectors of Information Security are:

• Paths of access – This category focuses on all the tools, technologies and applications that allow access to a corporation’s data. This includes both data in transit and data at rest.
• Paths of change – This avenue is for documenting and understanding how information changes; information can include access logs, configurations, customer information and financial information, just to name a few.
• Paths of risk – This is the category that vectors of attack will become part of. Path of risk is the likelihood that an unknown, unacceptable or unanticipated event will occur and the associated cost to the organization for the incident.

Information security is about risk management and mitigation. The Vectors of Information Security enable organizations to outline clear policies for understanding, managing and responding to the risk that is inherent with todays interconnected systems.

Understanding Security versus Compliance

I have been in a variety of projects over the years that mixed the use of the terms security and compliance. Often using them interchangeable. While some implementation details are common for both, the end goals of security and compliance are very different.

I have worked in a variety of environments that combine security and compliance from a functional and operational standpoint, and while this often makes sense from a resource perspective, it is critical to ensure staff understand the differences between security and compliance. Plainly put:

• Security is about ensuring that only those authorized can obtain access to resources and there are mechanisms in place to alert when events outside the norm occur.
• Compliance is about ensuring that implementation and operation of the environment follows all corporate policies, industry standards, and regulations; and that exceptions are clearly documented.

The short answer is that you can be compliant and non-secure; you can also be secure but non-compliant. This is the catch-22 that must be balanced for the staff tasked with implementing and monitoring corporate policies. When planning your corporate security standards, it is important to ensure that compliance teams have a seat at the table, and vice versa for compliance planning. This cross team support will ensure alignment, no duplication of efforts and understanding of what each team is trying to accomplish.

The best case is that a companies compliance policies mirror the IT policies for security and access controls, this ensures that monitoring of the environment and implementation is as light weight on staff as possible. By ensuring a level of consistency in the security implementation, compliance regulation can be proven more quickly, with fewer resources and with less rework of the environment as requirements and policies evolve.

Data Curation

Big Data is a term that we are hearing more and more to describe the growing challenges in managing the volume, variety and velocity of today’s data sets. Data today is being gathered from more diverse sources, analyzed more often and decisions made more quickly then ever before. But, ultimately, Big Data is not a technology, but rather changes to the methodologies that an organization uses to turn data into information. Big Data challenges can be resolved with a variety of new technologies on the market, but at a fundamental level, Big Data is process.

One growing area of focus within the Big Data space is Data Curation (DC). DC is the organization and tracking of this data, turned information, to ensure that it is accessible in an understandable and reliable fashion over a given period of time. There are three primary components too DC:

Finding the Data – Ensuring that the data is uniformly organized against a documented standard.

Ensuring Data Availability – Data, like any physical asset has a lifecycle. Data access must be planned over the lifecycle of the data to ensure it is available today and in the future against a pre-defined set of criteria for retention and accessibility.

Data Quality – Ensuring that data within an environment meets a minimum level of quality standards to ensure reporting and analysis activities are not tainted by non-compliant data.

If you think of incoming data as a giant set of piles with no labels or patterns, Data Curation is the process to turn that pile into information that is neatly organized in file folders consistent against a set of standards to enable users can quickly locate the information required.

As data volumes grow the lifecycle of the associated information becomes more and more difficult to manage, both the process and the underlying technology. All technologies that store date must ultimately be replaced at the end of their useful life, DC is the process to ensure that data is properly migrated to new platforms, the integrity of that data protected and the accessibility of the data not impacted in a negative way. DC must span the entire life of the data including creation, management, migration and ultimately disposal, per appropriate policies.

Data Curation is about organization of data to create information, while ensuring access to that information. DC is technology agnostic and requires a mindset beyond just acquisition of the data, but also inclusive of how long the data must be made available and retained. Firms that work with Big Data must consider the implications of their growing data sets as they work to understand the data and make better business decisions based on the derived information.