Continue in 2 seconds

What About Security? The Most Common, but Unwarranted, Objection to Hosted Data Warehouses

  • March 01 2002, 1:00am EST
More in

The hands-down, most significant and common objection to implementing a hosted data warehouse from executives and IT managers: It may jeopardize their system's security.

Despite the many benefits of using business intelligence service providers (BISPs) that host data warehouses – which include minimal investment in infrastructure, freed capacity on in-house systems, better quality equipment and software and faster connections – companies are reluctant to "give up" their data, which, regardless of the degree of sensitivity, they consider proprietary.

People are uncomfortable with what they don't know. Therefore, some facts about security for BISPs may improve the comfort level so companies can take advantage of the powerful benefits and financial advantages of using a hosted system.

Facts About BISP Security

Security is an issue outside or within an organization. A data warehouse that resides on-site is not necessarily safe. It is available to people with specific knowledge about the industry who may not be loyal to their own companies. For example, an operational user, such as a disgruntled employee in accounting with a statistical background, may take reports and sell them to competitors.

In a hosted data warehouse, a higher degree of security is possible because it is a shared environment, and the resources available can afford a higher degree of security than an internal system built on a limited budget. With a hosted data warehouse, a company pays only for the security it needs on a per- seat basis, as opposed to an on-site data warehouse with which a company pays fees for licenses that may not be used.

A hosted data warehouse solution provides as much protection as an on-site data warehouse because powerful security methods with multiple security layers are implemented across the data warehousing environment. It is protected by seven layers for each of the four methods of delivering data as follows: from the source (or company's) system to the hosted data warehouse – or the delivery of information from the hosted data warehouse to these clients' systems; e-mail; browser; or application.

As illustrated in Figure 1, the seven layers of security are: firewall security, operating system security, application system security, database system security and data segregation security. Added to these five layers are encryption and secured Internet access.

Figure 1: Network Security Topology

In the BISP model, encrypted packets are used to insure that even data sent to remote locations is protected. The hosted data warehouse is also constructed with a certificate of authentication; users cannot access the data without third-party authentication.

The BISP develops and monitors a behavior histogram of the user – gathering, for example, specific times that the user typically accesses information and what kind of information he/she accesses. Each user has a typical data access profile.

After one to three months' time, the host acquires a normal specific pattern of use. The BISP may also track the types of reports delivered. When there is a departure from the normal pattern (for instance, the time or place of usual access), the user will be interrupted and asked for non- electronic information to confirm identity. Or, he may be sent an electronic message to call an 800 number immediately or be denied access, thereby averting what may be an attempted security breach.

A hosted data warehouse can even proactively provide extra security reports detailing which employees are using the data warehouse information and how often.

The BISP takes massive precautions to ensure there are no points of failure at any stage of the hosted data warehouse transaction. The bubbles in Figures 2 and 3 represent processes for customer-to-BISP transactions and BISP-to- customer transactions as well as the many security clearances assigned for each process. The clearances occur as each of the processes takes place.

Security Flow from Customer to BISP

Figure 2 tracks the flow of security in a BISP model from the customer's system to the hosted data warehouse. There is a preauthorized set of scripts that extract data from the source system. Then, the data is encrypted and transferred across an Internet portal. It hits the BISP firewall, and the ID enables the BISP to know if the originating user has access to the system – if he/she should be allowed in the environment. The firewall tells the BISP whose data it is and where it's coming from. If the file is rejected, it is placed in a queue until it is validated and security can be defined. If accepted, the data warehouse receives and decrypts the information.

Figure 2: Security Flow Between Customer and BISP

Figure 3: Security Flow Between Source and Target

In order for data to be sent across the network, whether that is via an ISP's network or on a dedicated line directly to the BISP's network, file security and ISP access security are in place even before the data gets to the BISP site.

The next process in the flow of data transmission from customer site to BISP is the receipt of data content. At this stage, data is scrubbed or cleansed to ensure there aren't any transmission errors. If there are, the data is sent back. Data scrubbing includes processes such as taking different names for data (e.g., NEBR and NE for Nebraska) and standardizing them across multiple operational systems. It is also at this stage of the process that data is integrated.

All the security steps at this point, the receipt of data content, are to protect the data from an outside hacker, not internal sources. These security clearances include firewall access security, user authentication, file transmission security, decryption security and data content security measures.

The next process protected by security is the initiation of an RDBMS daemon. At this juncture, the security is continually checking the BISP access looking for a single ID. The application makes a request to process, and there is only one ID that has access to processing data. That ID is only available through the application layer. This prevents staff within the BISP without security clearance – such as personnel that are not technicians – from accessing the database. This is the RDBMS security clearance.

Customer segmentation security ensures that customers of the BISP are not able to access each other's information. Additionally, in a hosted data warehouse, data is in the same database server but not within the same structures. Customer data is never mixed or processed with any other company's data.

From there, data is transferred to a database where it is segregated logically based on the type of data and customer. For data segmentation security, databases use customer IDs to clear requests for information; IDs indicate ranges and limitation of information for reports.

Security Flow from BISP to Customer Site

In a dynamic query, the customer is accessing information, specifically reports, from the BISP. The first security step within the warehouse request process is end-user security clearance, which is concerned with limiting user access within the customer's own environment. Then, BISP customer security information addresses the BISP's own "wrapper," or everything the customer needs to gain access to the BISP such as user ID and password. The request for data is then encrypted and sent via the Internet to the BISP.

At this point, there is security protection for Internet access and also for ISP access security. Again, the request hits the BISP firewall and the ID lets the BISP know if the originating user has access to the system – if he/she should be allowed in the environment.

The user is authenticated and report requests are checked to clear the user's access. The request is decrypted and passes through data content security clearances. The format of data coming into the BISP must match a format that has been established.

As in the customer-to-BISP transaction, the application makes a request to process. There is only one ID that has access to process data. That ID is only available through the application layer. Again, there is also a security step that prevents customers from accessing each other's data.

When automatic or "canned" reports are pushed or e-mailed over the Internet, the BISP still uses all seven layers of security.

Other Security Factors to Consider

There are three methods of data transmission, all safe from a security standpoint. However, the virtual private network is preferable for the transmission of highly sensitive information. The three methods of data transmission are as follows:

  1. Internet transmission using encryption and decryption.
  2. Point-to- point non-Internet setups tailored to bandwidth needs such as T1s of OC3 connections. Traffic is not commingled.
  3. A virtual private network (VPN) line dedicated to the hosted data warehouse environment, a secure link where traffic is exclusive between a business and a hosted data warehouse. Traffic not commingled.

Service-level agreements (SLAs) can guarantee data transmittance. The BISP handles the setup and also guarantees that only authorized users access data in the hosted data warehouse.
Customer data at the BISP's network operations center (NOC) is closely monitored from a personnel standpoint. No one has access to any information except key individuals from a maintenance standpoint. Access control is closely monitored; all personnel with BISP access sign in and out. If the database structure needs to be changed – for example if a company expands globally and needs to add a country table in addition to its city, state and ZIP information – change control monitors and tracks all changes. In addition, all access and changes can be reported or physically audited by the customer.

Security is always an issue within or outside of an organization. Hosted data warehouses make better security affordable; BISPs provide seven layers of security for the hosted data warehouse. A BISP may also develop a histogram to track unusual usage patterns for companies to further increase security protection. BISPs take many steps to ensure that security cannot be breached at any point, whether from customer to BISP or BISP to the customer. VPNs are the most secure transmission method for a BISP.

Security concerns for a hosted data warehouse should not restrain companies that could benefit from affordable business intelligence information.

Register or login for access to this item and much more

All Information Management content is archived after seven days.

Community members receive:
  • All recent and archived articles
  • Conference offers and updates
  • A full menu of enewsletter options
  • Web seminars, white papers, ebooks

Don't have an account? Register for Free Unlimited Access