How do you manage access controls for outsourced data?

Data classification is crucial before outsourcing any data. It allows you to assess the sensitivity, value, and regulatory requirements of the data. This classification helps determine the level of access control needed for each data type and aids in selecting a suitable provider. By categorising data into public, internal, confidential, and restricted categories, different access policies and encryption methods can be applied to ensure the security and privacy of the data.

Data classification as presented here is a conflating the very idea of what information is with properties of that information. Sensitivity identification, for example, is but a property of what information is and informs handling guidelines. Does it need to be done, sure - but don't call it data classification. It's important to remember that the purpose of this action is to also document/define entitlements that you will use in downstream information control systems. Blanket 'classification' schemes that focus on handling don't allow the requisite level of detail required to configure entitlements in these downstream systems. This approach is actually a sales tactic that vendors developers years ago to sell RMS and DLP platforms.

Data residency tends to be an overriding requirement - if you've got issues here then there are specific challenges to consider. It can be achieved, ex: set-up a VDI segment for the users, apply the right information control systems and monitoring, and then deal with physical access and monitoring considerations. In other cases, my preference is to ensure all applications/system access is controlled through a Software Defined Perimeter where user and device can have their connect and identity independently assessed and then access granted when required through secure tunnels/routes fully in my control. It also allows me to introduce specific information control solutions to enforce protections dynamically and federate trust and controls.

I like making sure all applications integrate into an LDAP service and then use group membership as a claim that governs access for a user to an application. Revoking the group membership = no app. When it comes to outsourced partners, I typically create a group for each app + outsource class user and then make membership a claim to grant access. I also add rules that have to be met if membership to an outsourced app-group is present. For example: - they can not have another network connection on their endpoint active and if they do drop it - they can only connect through the known gateway or city or country, - ringfense their endpoint to ensure only tcp/udp traffic is to the SDP (internet available through my gw only) + Many more

Key here is not just monitoring but making sure data owners and application owners receive three kinds of reports: 1. Who has been accessing the data or systems over a given period of time (normally 2 weeks - 1 month) along with exactly what was accessed. 2. Entitlement reports for who has access in context of the applications and the information control systems in place 3. List of who tried but failed to access information in context of the systems / controls. I also like standard deviation alerts to application/data owners based on normal/expected usage of the user. Having the right controls (like an SDP) and super simplify if set-up correctly, and can even use data governance tools that can simplify and federate to data owners.