Wednesday in the Woods · episode 006
Reframing C-I-A - Data as an Asset
7:15youtube · Licensio, LLC
description
Why am I in a trash can talking about the CIA on this week’s Wednesday in the Woods? Well, it’s certainly not because it was a warm morning to enjoy the sunrise; in fact, it was so cold I couldn’t even get the tinfoil hat to shape without tearing. I’ll have to get some aircraft-grade aluminum for next time.
Anyway, in reality, I’m not talking about the government agency - I’m talking about #datastrategy using the acronym that much of #information security is based on: Confidentiality, Integrity, and Availability. You’ve probably heard this acronym or its constituent words used in some pretty "bummer" contexts, like unauthorized disclosures, data breaches, or business continuity and disaster recovery plans. You know, stuff about minimizing risk and liability.
What if I told you that we could reframe C-I-A to help us think of #data as an #asset? It’s kind of a silly trick, but like many simple ways of reframing traditional concepts, I think it really works.
You see, the I and A in C-I-A are typically about controls and quality of service. We don’t want our data being changed by a malicious actor or our customers experiencing an interruption to a contracted product or service.
But I and A can be viewed in a broader sense that speaks more to data as an *asset*, not just a liability. Integrity, for example, is another way of thinking about data quality and data correctness. If your data strategy leads you to care about certain information, then you want to capture that information - including any metadata or provenance about the information - and make sure that the information is not altered in some way that affects subsequent processing. For example, if you collect information through one system that stores important metadata, but the information is subsequently processed and that metadata is lost, then the integrity of the information has been compromised - not in the traditional sense, but from the context of internal data strategy use.
Similarly, you can reframe Availability as something more than just system uptime, response time, and automatic failover. Instead, you can think about Availability as making data available - in the right system, in the right shape, at the right time, to the right person. If your data strategy leads you to analyze corporate press releases in real-time, then you need to make sure that that information is *actually* available to the people using it.
In many ways, the emergence of “data engineer” roles or #MLOps speaks to Integrity and Availability of data within the context of an organization’s data strategy. I’m not sure that the Treadway Commission really contemplated the world we would live in today, and the Trusted Service Criteria certainly do not read to me as an attempt to treat control systems as an opportunity for value creation, but hey! Let’s make some lemonade out of those lemons.
Garbage, over and out.
#ml #ai #strategy #mlops #dataengineer #datagovernance #dataquality
transcript
~808 words · showhide
from the human-edited captions published with the video. timestamps jump to that point in the video.
- 0:44
Good morning and welcome to this very chilly Wednesday in the Woods. Today, we're going to be talking about your data and the CIA and I don't mean the government agency this week, so don't worry. You see, C-I-A is actually the three letter acronym that much of information security is based on. It stands for confidentiality, integrity, and availability. And I think C-I-A is a great way of thinking about data as not just a liability, but as an asset.
- 1:18
And it teaches us about what we can change from a cultural perspective in our organizations, about not just data governance, but also the way we think about information. So, when you think of C-I-A or information security more broadly, I think everybody thinks of the C, right? We think primarily about all this stuff we have to do to keep the data safe, to keep it protected from unauthorized disclosure, whether it be internal or external.
- 1:46
And the C is really about liability management, right? So, unauthorized access or disclosures is typically lead to regulatory fines, to litigation, to reputational harm, and they're not good. Right? So C is about liability reduction in risk management in the traditional sense. And then the I and the A sometimes get attention. We learn about business continuity plans and disaster recovery in the I and the A. But to me the I and the A are really about data as assets.
- 2:21
So we've talked a lot about data strategy, machine learning and the I and the A are critical in these contexts. Not in the way as traditionally envisioned or people in, for example, the SOC2/TSC or COBIT and COSO worlds think, but if we take a modern look, integrity and availability, I think we can actually learn a lot and help our organizations think of data as an asset. So integrity - integrity is about the data that we're collecting being the right data, being accurate data, being complete data, if we think about it in a broader sense.
- 2:57
So, are we collecting the appropriate information from individuals? Are we ensuring that that information throughout its life cycle is protected? Protected could mean something like "is it being changed in ways that are not controlled or understood?" It could mean "is it being kept in a system that tracks version control for our analysis" or it could mean any of the more traditional senses of integrity. And then availability, important not just because we want our systems to be up with some certain level of SLA, but because in a broader sense, availability is about access to data.
- 3:39
Not just from a "is this system up?" sense, which is how it's traditionally viewed but in a broader sense, is the data actually accessible, not just available in a technical sense, but actually accessible. And so the I and A again help us think of data as an asset because if we talk about a machine learning example we can have information that we've collected, we could do that in a way that's appropriate from a privacy perspective. We could store it in a system that has an adequate degree of encryption or protection for the type of information.
- 4:17
But if that information doesn't have the right attributes, if it doesn't have the right historical representations, if the data has been transformed by an ETL process or some other system to system translation in a way that prevents us from looking at the true facts with integrity as in accuracy and completeness, then the data is not valuable for a data strategy exercise like a predictive model or some kind of analytics.
- 4:51
The A, similarly, I think can be seen in something like a data lake or a data warehouse. So, yes, a system storing data can be up, and it can be up at a certain level, and it can have geographic distribution of hosting to ensure that there's there's business continuity and disaster recovery standards met and that's all great. But if a data scientist or a user can't access the information or can't access it in the right format, then it's not really available.
- 5:24
So, CIA helps us remember that, yes, the C is important; yes, traditional information security programs do serve a role from a risk management and a liability reduction sense, but think of the I and the A in a broader way. Please think of the I and the A as part of how we don't just keep the data and keep it safe, but use the data to our benefit, to our customers benefit, maybe even a broader world's benefit. And, if you ever forget why this is important in a machine learning context, I just want you to remember one thing that people say, okay?
- 6:05
And that's garbage in, garbage out.