trademark

8.0 Granular Access Control (cont.)
8.5 Track admin data
8.5.1 Why?
To re-key the system when necessary. User roles and authorities change frequently and
should not be assumed to be static. Changing this information is also tantamount to rekeying
the system, so a proper data-basing strategy is necessary.
8.5.2 How?
Use a database with access control and auditing capabilities to keep track of admin
data. Be sure to secure the connection between the admin data and big data
architecture when using it as a policy information point.
8.6 Use standard single sign-on (SSO) mechanisms
8.6.1 Why?
To reduce the administrative burden of supporting a large user base. A big benefit of
granular access control mechanisms is to broaden data sharing without incurring a
large administrative cost. Single sign-on (SSO) solutions offload management of user
authentication to enterprise-wide or even publicly available systems.
8.6.2 How?
Defer authentication to advanced SSO systems such as Lightweight Directory Access
Protocol (LDAP), Active Directory, OAuth, or OpenId.
8.7 Employ proper federation of authorization space
8.7.1 Why?
To allow data providers to maintain control of access to their data when data analysis spans
over multiple providers. The concept of big data is made more powerful by including analysis
across many diverse data sets. However, data protection policies are complicated through the
inheritance of policies from multiple data providers. Federating the authorization space supports
a more modular approach to policy management through more precise tracking of data labels.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
45