Microsoft hasn't had a good time with privacy recently – so here's a tool that checks your data compliance is up to snuff
(2020/12/04)
- Reference: 1607104925
- News link: https://www.theregister.co.uk/2020/12/04/azure_purview/
- Source link:
Microsoft has teased Azure Purview, a tech built to deal with customers' data compliance and governance requirements by verifiyng the presence of sensitive information without users having to eyeball the stuff first.
The [1]Purview Preview (not to be uttered after a few shots of the [2]Azure AI-infused whisky ) has arisen from in-house technology developed by Microsoft as part of its own internal privacy and compliance efforts.
Designed to manage the company's own epic amounts of data, the platform has been released alongside a new, generally available version of data warehouse wrangler [3]Azure Synapse Analytics .
'We've heard the feedback...' Microsoft 365 axes per-user productivity monitoring after privacy backlash [4]READ MORE
Purview is the latest in a line of tools from Microsoft aimed at helping customers to get on top of the oceans of data sloshing around in their organisations. In this case, that assistance takes the form of an Azure service going sniffing for sensitive information.
The cloud service builds on existing search capabilities and uses connectors to hook up various sources, from Microsoft's own Azure SQL, Cosmos DB or Azure Blobs, to the external, such as SAP, Teradata or Amazon AWS S3.
A scheduled or one-off serverless scan slurps the metadata from these sources, exposing a data map as Apache Atlas open APIs (and thus enabling the programmatic pushing of more data to expand things further.)
During the scan, classifications can be applied based on column names or "the system can still scan the content of the columns to verify the presence of sensitive information," [5]explained Engineering Lead Mike Flasko.
The latter point might raise an eyebrow or two, although Flasko emphasised that the data itself is not actually moved.
As for how that checking works, rules can be configured and the sensitivity labels defined in the Microsoft 365 Compliance Center used. Purview is also integrated with Microsoft Information Protection and, unsurprisingly, lurks in the Microsoft 365 E5 compliance plan.
The timing, hot on the heels of the [6]privacy furore surrounding the company's Productivity Score , is interesting. With Purview, Microsoft is keen to emphasise the increasing focus on data governance within enterprises and leaned on the GDPR (General Data Protection Regulation) to make its point.
"It's a very welcome step," Prof Alan Woodward from Centre for Cyber Security, University of Surrey, told The Register . "In even a modest organisation the data assets can be spread across so many different systems that it can be very difficult to ensure that you even know where it all [is] never mind ensuring that it's protected appropriately. That’s the ambition of initiatives like Purview."
Noting that the distribution of data over many environments and physical locations was complicating things and making tools like Purview and its ilk "almost essential," Woodward added that the discovery part of the process could be tricky, and warned that the simple act of searching for terms relating to personal data might result in some accidental non-compliance.
"That's why tools like this have to be built to take that into account," he said.
"What is good about these tools," he went on, "is that it means you don't have a person doing it - if you effectively automate the discovery process, even if you find sensitive data held somewhere it shouldn't be, the technology can flag it without necessarily having to reveal to full content."
Information privacy and security expert John Wunderlich sounded a note of caution and told El Reg : "Much will depend on context and it's very hard to find and categorize sensitive data as text vs as data. Machines don't parse word documents or emails for sensitive texts all that well."
"One big risk will be false claims," he added. "Doing a comprehensive data inventory of an enterprise is expensive and time consuming. So the temptation will be to do the 'easy' stuff and call it done."
The Purview team plans to continue adding additional data sources, and Flasko observed "understanding your data is one of the most important steps in efficient data governance."
Indeed it is. ®
Get our [7]Tech Resources
[1] https://www.microsoft.com/security/blog/?p=92311
[2] https://www.theregister.com/2019/09/06/whisky_gaiore/
[3] https://azure.microsoft.com/en-us/blog/shape-your-future-with-data-and-analytics/
[4] https://www.theregister.com/2020/12/01/productivity_score/
[5] https://www.youtube.com/watch?v=27bA4KFiEKk
[6] https://www.theregister.com/2020/12/01/productivity_score/
[7] https://whitepapers.theregister.com/
The [1]Purview Preview (not to be uttered after a few shots of the [2]Azure AI-infused whisky ) has arisen from in-house technology developed by Microsoft as part of its own internal privacy and compliance efforts.
Designed to manage the company's own epic amounts of data, the platform has been released alongside a new, generally available version of data warehouse wrangler [3]Azure Synapse Analytics .
'We've heard the feedback...' Microsoft 365 axes per-user productivity monitoring after privacy backlash [4]READ MORE
Purview is the latest in a line of tools from Microsoft aimed at helping customers to get on top of the oceans of data sloshing around in their organisations. In this case, that assistance takes the form of an Azure service going sniffing for sensitive information.
The cloud service builds on existing search capabilities and uses connectors to hook up various sources, from Microsoft's own Azure SQL, Cosmos DB or Azure Blobs, to the external, such as SAP, Teradata or Amazon AWS S3.
A scheduled or one-off serverless scan slurps the metadata from these sources, exposing a data map as Apache Atlas open APIs (and thus enabling the programmatic pushing of more data to expand things further.)
During the scan, classifications can be applied based on column names or "the system can still scan the content of the columns to verify the presence of sensitive information," [5]explained Engineering Lead Mike Flasko.
The latter point might raise an eyebrow or two, although Flasko emphasised that the data itself is not actually moved.
As for how that checking works, rules can be configured and the sensitivity labels defined in the Microsoft 365 Compliance Center used. Purview is also integrated with Microsoft Information Protection and, unsurprisingly, lurks in the Microsoft 365 E5 compliance plan.
The timing, hot on the heels of the [6]privacy furore surrounding the company's Productivity Score , is interesting. With Purview, Microsoft is keen to emphasise the increasing focus on data governance within enterprises and leaned on the GDPR (General Data Protection Regulation) to make its point.
"It's a very welcome step," Prof Alan Woodward from Centre for Cyber Security, University of Surrey, told The Register . "In even a modest organisation the data assets can be spread across so many different systems that it can be very difficult to ensure that you even know where it all [is] never mind ensuring that it's protected appropriately. That’s the ambition of initiatives like Purview."
Noting that the distribution of data over many environments and physical locations was complicating things and making tools like Purview and its ilk "almost essential," Woodward added that the discovery part of the process could be tricky, and warned that the simple act of searching for terms relating to personal data might result in some accidental non-compliance.
"That's why tools like this have to be built to take that into account," he said.
"What is good about these tools," he went on, "is that it means you don't have a person doing it - if you effectively automate the discovery process, even if you find sensitive data held somewhere it shouldn't be, the technology can flag it without necessarily having to reveal to full content."
Information privacy and security expert John Wunderlich sounded a note of caution and told El Reg : "Much will depend on context and it's very hard to find and categorize sensitive data as text vs as data. Machines don't parse word documents or emails for sensitive texts all that well."
"One big risk will be false claims," he added. "Doing a comprehensive data inventory of an enterprise is expensive and time consuming. So the temptation will be to do the 'easy' stuff and call it done."
The Purview team plans to continue adding additional data sources, and Flasko observed "understanding your data is one of the most important steps in efficient data governance."
Indeed it is. ®
Get our [7]Tech Resources
[1] https://www.microsoft.com/security/blog/?p=92311
[2] https://www.theregister.com/2019/09/06/whisky_gaiore/
[3] https://azure.microsoft.com/en-us/blog/shape-your-future-with-data-and-analytics/
[4] https://www.theregister.com/2020/12/01/productivity_score/
[5] https://www.youtube.com/watch?v=27bA4KFiEKk
[6] https://www.theregister.com/2020/12/01/productivity_score/
[7] https://whitepapers.theregister.com/
FlamingDeath
If someone can kindly give me a kick in the nuts when Microturd finally manages to unify their 2FA shitshow across all their domains / platforms / global presense etc, thanks
Why does everything they do result in such a dogs dinner? I have 2FA enabled on so many services and “IT JUST WORKS”. Microturd on the other hand, fucken nightmare
FlamingDeath
IT is certainly the industry to be in if you’re a hipster
Oooohh shiney
Oooooh fancy marketing buzz words
Ooooh Ai ( Errr.... Nope, not yet, not for a while)
Oooooh TheCloud™️ (Yes, they change shape and form, usually randomly)
Ooooh another fucking patch to fix the shiny you’re so fond of
Tried and tested? Meh... BORING!!
FlamingDeath
If anybody fancies becoming a novelist, I recommend taking up Powershell.
I feel like I am writing War and Peace when scripting with this crap
This company knows no bounds in their shame, they’ve not seen a mirror in decades.
Microsoft, the company which hosts phishing forms on their Microsoft Forms platform and then when reported, do nothing because of and I quote “data protection”
Know this, what ever it is they create, it will be bloated, it wont work, the UI will be changed weekly, it will be full of nasty exploitable holes, it’ll have some god-awful name that some wanker in marketing brainfarted out of one of their many orifices AND... AND... it’ll be abandoned a few months later to make way for a new shiny brainfart cloudy thingy