Many parties, whether an accountancy firm or a healthcare institution, work with sensitive data. Accountants, for example, have all manner of sensitive matters in their books through personnel absence/healthcare cost entries. Healthcare institutions likewise, even when it concerns financial data. How do you handle this as an organisation, especially when considering setting up a central data warehouse? By Harmen, CTO & senior data scientist at Datalab
There are all sorts of technical solutions you can deploy to keep data secure. The most important ones at a glance:
Techniques for protecting sensitive data
Anonymisation
With anonymisation, you remove all references that could be used to directly or indirectly trace back to a person. This is much harder than it seems: think of combinations of data that are individually not traceable but in combination are. Education + year of birth + place of birth is quickly a unique combination, even though the data points themselves are not particularly sensitive. There are tools that measure whether your data is truly well anonymised. These tools measure how unique combinations of non-sensitive personal data are: unique = dangerous because potentially traceable.
Pseudonymisation
Pseudonymisation is a very widely used technique in the healthcare sector. You remove all personal data and replace it with a unique code. This way, you can follow individuals in the dataset without knowing who they are. You can opt for reversible pseudonymisation, where you keep a list somewhere with the sensitive data and the unique code, or you choose irreversible pseudonymisation. Then you can never retrieve the person's data again, but you can still follow them across different datasets (past, present, future; external data, etc.). If you choose reversible pseudonymisation, you can arrange this in different ways: you manage the list of codes and personal data yourself but ensure with strict access controls that (virtually) no one can access it. Alternatively, you can work with so-called trusted third parties (TTPs). These parties manage the lists of data. This is common in sectors where companies that may not view each other's data nonetheless want to share information. An independent party manages the lists of sensitive data and personal codes and does not make these available to the data suppliers. This is common in medical research and within the insurance industry.
Safe setup of the data environment
Pseudonymisation and anonymisation are important techniques, but even more essential is a secure setup of the location where data is stored and analysed. It is relevant to distinguish between three matters:
- Data input
- Data storage
- Data analysis
Data input
The data input side can be configured so that only new data can be added and existing data cannot leak through such tools. The most important requirement is that it is delivered via secured channels. At Datalab, we work with Stepping Stone servers that form the link between the secured business environment where the source data resides and the secured data storage environment (the data warehouse).
Data storage
For the data storage layer, there are all sorts of techniques available to keep data secure: encryption of stored data, including backups, is one. Even more important are the connections between the data warehouse and the analysis environment. Here, you choose the 'least privilege' principle: you create a different connection per analysis, where only the data necessary for that analysis is made available - naturally via secured connections.
Data analysis
Finally, there is the analysis environment, where access control is crucial. Moreover, 'semi-finished products' are often stored here: datasets the analyst is working with. Here too, encryption of that data offers important protection, but is not a silver bullet. At Datalab, we set up an analysis environment as standard that does not reside on the analyst's laptop but runs close to the data warehouse. Via secured connections, analyses are executed such that data is never transmitted via the internet and never ends up on the analyst's laptop. If the laptop is lost on the train or stolen, data never leaks. At the same time, it is essential that the analyst can perform their work well and is not hindered by tooling that (due to security) cannot quite do what the analyst needs. You also want to deliver standard tools so your analyst can work in a familiar environment.