Instructor: Data ownership. 2 2
In this lesson, we are going to talk about data ownership 3 3
and some of the things that are important inside of it. 4 4
Now, when we talk about data ownership 5 5
this is the process of identifying the person responsible 6 6
for the confidentiality, integrity, availability 7 7
and privacy of the information assets. 8 8
Now, you might think that the data owner 9 9
is the person who created that file, 10 10
but that's not what we're talking about. 11 11
In an enterprise environment there are different roles 12 12
that fall under this idea of data ownership. 13 13
These include things like the data owner themself, 14 14
the data steward, the data custodian, 15 15
and the privacy officer. 16 16
Let's take a look at each of these. 17 17
First we have our data owner. 18 18
This is going to be a senior executive role 19 19
and they have the ultimate responsibility 20 20
for maintaining the confidentiality, integrity, 21 21
and availability of the information asset. 22 22
So, what is their real role here as the data owner? 23 23
It's not the person who created the file, 24 24
it's this senior executive. 25 25
And this data owner is going to be responsible 26 26
for labeling the asset and ensuring 27 27
that it's protected with the appropriate controls. 28 28
So the data owner is going to say, this type of information 29 29
when we're dealing with, let's say 30 30
the balance sheets for the corporation 31 31
they should be protected as financial information. 32 32
So anybody who creates it will now follow my rules 33 33
and label it as financial information. 34 34
And we are going to protect financial information 35 35
by doing X, Y, and Z, whatever those controls are. 36 36
Now, the data steward is a role that's focused 37 37
on the quality of the data and the associated metadata. 38 38
This data steward is going to be somebody 39 39
who is working for the data owner. 40 40
They're going to be involved with making sure 41 41
that the data is appropriately labeled and classified. 42 42
So, we said that all financial data 43 43
should be labeled financial data 44 44
and it should be taken care of this way. 45 45
That's going to be the role of the data steward 46 46
to make sure that's actually done. 47 47
Now, as we go down even further 48 48
we get to our data custodian. 49 49
This is a role that's responsible for handling 50 50
the management of the system 51 51
on which the data assets are stored. 52 52
So, who might be a data custodian? 53 53
Well, a system administrator. 54 54
These are the people responsible for enforcing 55 55
the access control, the encryption, and the backup 56 56
and recovery measures that protect this data 57 57
based on the requirements set forth by that data owner. 58 58
And so you can see how this all goes upward as you go. 59 59
Then we have our privacy officer. 60 60
Now, this is a role that's responsible for the oversight 61 61
of any kind of privacy related data. 62 62
Things like PII, SPI, or PHI, any of those things 63 63
that are managed by the company fall under the realm 64 64
of the privacy officer. 65 65
This is the person who's going to really be on the hook 66 66
if you have a data breach, 67 67
because normally when you have a data breach, 68 68
what people are concerned about 69 69
is the private user data that has been expelled. 70 70
And so that is going to be what they're focused on. 71 71
They have to make sure that we are complying 72 72
with the legal and regulatory frameworks 73 73
and make sure that we have the right purpose, 74 74
limitations, and consent, 75 75
we're doing data minimization, data sovereignty, 76 76
data retention, all the stuff we've been talking about 77 77
in this section falls under that privacy officer. 78 78
Now, the real question is who should own the data? 79 79
Now, in a lot of organizations 80 80
they try to make the CIO or the IT department 81 81
be in charge of all the information and be the data owners. 82 82
But that is the wrong answer because as the IT personnel 83 83
we don't know about the data, we know about the systems. 84 84
We should be the data custodians. 85 85
Instead, the data owners should be somebody 86 86
from the business side, the people who are 87 87
creating this information. 88 88
And each data owner can actually be specified 89 89
inside their own departments. 90 90
So for instance, you might have the accounting department 91 91
have their leader be the data owner 92 92
and they would have a data owner over their information. 93 93
Because if I, as the IT person, 94 94
am looking at some accounting data, 95 95
I don't know it well enough to be able 96 96
to classify it at the right level. 97 97
And so this is one of those things 98 98
that I think is really important 99 99
that the IT people should not be the data owners. 100 100
And the data owners should really be the people 101 101
who know more about the data 102 102
based on the content of the company. 103 103
If your company is a software development company 104 104
then the software design department 105 105
should probably be the data owner. 106 106
If you're an accounting firm 107 107
it should be the financial department or the CFO, 108 108
somebody who knows about the data 109 109
who can make the right decisions 110 110
as far as labeling and classification, 111 111
that is who should be your data owner.