What do you do if your data analysis practices lack privacy and security measures?

Antes de comenzar a trabajar con los datos, es importante que se conozca mas no se domine el proceso de análisis de datos que se utiliza en la compa?ía. A partir ello, será posible tener una ruta clara hacia dónde debe guiarse el análisis; sin embargo, siempre será importante prestar especial atención a las etapas de procesamiento de los datos y la presentación de la información, pues en la primera se idea la forma en qué se trabajarán los datos; en la cual, siempre debe privilegiarse la calidad, y, en la segunda, a quiénes irá dirigido el análisis; buscando atender las solicitudes únicamente a los interesados. De no tener un proceso claro, es factible utilizar el estándar: preguntar, preparar, procesar, analizar, compartir y actuar.

Title: Conducting a Comprehensive Risk Assessment for Data Analysis Practices Embarking on a journey of data analysis requires not only a keen focus on insights but also a robust commitment to safeguarding the integrity, privacy, and security of the data involved. Conducting a thorough risk assessment serves as the foundational step towards ensuring the protection of sensitive information and mitigating potential vulnerabilities. The first phase of the risk assessment involves mapping out the entire lifecycle of data within the analysis process. This includes identifying the sources of data, whether they are internal databases, external data providers, or user-generated inputs. Understanding the origin of the data is crucial as it sets the

Conducting a comprehensive inventory of all data assets is one crucial aspect of assessing risk in data analysis practices lacking privacy and security measures. This involves identifying the types of data collected, stored, and processed within the organization and understanding the potential impact of a security breach or unauthorized access to each data category. Utilizing risk assessment frameworks such as the NIST Cybersecurity Framework or ISO 27001 standards is helpful. These frameworks provide structured guidelines and methodologies for evaluating risks associated with data handling practices and help prioritize mitigation efforts based on the organization's level of risk.

From my experience with data. The risk lies in the most fragile processes or even when there are different collections of the same information. It is important to carry out a survey of how this data arrives at the company, and of course, guarantee its veracity.

It is not considered easy to evaluate the obtained data from the risk side just because of the security issue. Because the acquisition of data, its analysis and conclusion in accordance with the business, as well as the compliance with the vision that the business owners want to see. In general, if a data analyst is hired but is hesitant to share data with him/her, then how logical does this hiring sound? A professional data analyst who knows his/her job should be someone who does not give secrets.

I have experienced corporate environments where security for data access was minimal. Much of this data was sensitive. But not all companies are like this. Over the years, with an increasing volume of data, controls have increased, data centralization has become a reality and so has the unification of collection, ensuring the best origin and without redundancy.

é essencial aderir às regulamenta??es ao conduzir uma análise de dados. Escolher plataformas que ofere?am a capacidade de limitar o acesso às informa??es se torna indispensável nesse contexto. A vers?o Cloud do Power BI, por exemplo, destaca-se por sua funcionalidade de restringir o acesso de usuários aos dashboards.

When we define data access governance, it is necessary to establish access profiles to the point of recording which information will be accessed by whom. It is necessary to create a culture of awareness by telling staff that they will be responsible for misuse or violation of rules when sharing information.

In general, I think that the issue of technology development and data security is something that should definitely be communicated in the onboarding process. Training should be held. For example, emergency training or first aid training. Otherwise, the lack of data literacy will be very expensive for the company.

Access security is necessary. Create traceability, access authorization hierarchy. This is part of the culture. I lived in an environment like this, we only got sensitive access from a client to analyze a case, a report from a client about a reported problem. Another thing I observed was the limitation on the use of pendrives and external e-mails, all to control data leakage.

Only a small part of enterprise data security can be met by using antiviruses or building firewall systems. For this, a policy of comprehensive measures should be followed. A company's data strategy should be formulated. Official signed agreements on this should be made with the employees at the legal level.

Constant monitoring. At first people find it strange, but if they understand the importance of it, they end up acting naturally. Fully understanding the rules.

The most advanced tool of today's technology is artificial intelligence systems. Artificial intelligence is the tool that can figuratively create the role of the data security police. More dynamic and without any bias.

In addition to reviews and audits a process should be established for the regular review by policy owners and or users of the policy itself to determine if the policy remains relevant and addresses current and future threats.

As I mentioned in the previous part, if a data security police system is established and an incident occurs in the future, the system will automatically inform, take appropriate measures and systemize it. I consider the use of artificial intelligence very convenient in this case.