Data Governance A MUST HAVE before adopting GenAI
-
Jay McKenzie - Recon Blogs
Many businesses are looking to adopt ChatGPT, Co-Pilot, Gemini and more to speed up delivery, yet, as has been seen recently, when you turn these tools inwards into the business, you also expose data that should be kept away. To adopt GenAI with security in mind, you must have a robust way to manage your data. One of the easiest ways to do this is via Data Governance.
Data governance allows organisations to create boundaries (via classification) around the use of its internal data when utilising GenAI. It is the process an organisation uses to characterise its data assets using persistent labels to manage access and use. I hear many people talk about the need for data governance, yet when we start talking about exactly how this should be applied, it’s astounding how many people fall silent on this matter. The underlying reason is that there is ‘no standard’ for data management.
There are some common outcomes to it that everyone knows:
- Provides an added security control layer over the data within the business
- Ensures ongoing compliance related to PCI, PII, and critical infrastructure considerations
- Allows the business and security teams to identify and prevent cases of data exfiltration
- Defines the use limits for Gen AI platforms.
Sounds simple… YES? It’s actually quite intricate as each department/area in your business uses data in different ways. This is where recon can help…. our tried and tested methods of understanding your data enables significantly faster Gen AI adoption in your business, whilst ensuring your security and compliance on data is maintained.
Recon has two core approaches to achieving effective data classification (and, by extension, data governance). Each approach has its own benefits and related challenges. These are Monitor to Classify and Define Business Applicability.
Debating the best approach
The common question recon gets from businesses is, ‘Which one to start with?’ The key to success is ensuring that the people delivering it are skilled and capable of delivering on both approaches. recon has seen numerous times when customers have embarked on the wrong path by themselves, only to eventually ask us for assistance in getting it back on track.
Turning Your Data into Intelligence.
This comes down to how business context is applied and the mechanisms to capture the data. With any approach, there are relevant challenges, budgets, and considerations for each.
Monitor to Classify
This approach focuses on capturing how data is used at the relevant sources (applications, systems, databases, etc.). This provides raw context to application and data use and thereby prioritises business applicability through reporting. A relatively open capture mechanism needs to be in place.
Challenges:
- Capturing the data from all relevant sources requires changes to existing systems
- Formats from vendors and systems can be disparate
- The collection of data means that a suitably large analytics platform is required for storing and analysing data
- Exceptions to discovered insights about business applicability are more challenging to discern
Benefits:
- Data is raw and from the source, allowing real data intelligence to be applied without pre-existing business blind spots
- Provides centralised reporting, not just of data, but also of system, security, and operational availability
- Business context can be applied, and exceptions can be clearly defined (over time)
- Data classification is often more profound and can be defined in granular format (if required)
- The system is persistent and continues to provide business information even after the consultants have left the building.
Many will state that there are significant cost implications related to this activity, as historically, the monitoring cost was far greater than the cost of determining the business applicability. In response to this issue, recon has developed its QUAD platform, now inversing this cost relationship, providing quick value to businesses.
Define Business Applicability
This approach focuses on capturing how data is used at the relevant sources (applications, systems, databases, etc.). This provides raw context to application and data use and thereby prioritises business applicability through reporting. A relatively open capture mechanism needs to be in place.
Challenges:
- Business applicability is often subjective, only providing a limited business application
- Data elements can be missed, leading to a ‘tag on’ aspect that impacts scope over time
- Data classifications are often pre-determined and don’t adapt to ongoing changes
- Outliers in data are often missed, and exception criteria are applied by user identification, not data use
- Monitoring timelines are often longer to determine applicability due to data limitations
- Data Intelligence is only realised when monitoring and anomaly detections start
Benefits:
- Initial costs allow for items to be deemed as a project and can have a fixed scope
- Data reporting on defined use cases often are quickly apparent
- Compliance against standards can often be achieved quickly
Turning Insights into Action and Remediation
Comprehensive data governance, coupled with data classification, provides a business with impartial and real data intelligence, enabling it to make more informed decisions and minimise data loss.
- Identify the data that customers are interested in
- Know what your staff gravitate towards
- Understand what users need data for in daily activities
Large/enterprise businesses realised this numerous years ago and started investing in data/business intelligence tools to identify these areas. Historically, this has been out of reach for mid-sized businesses, yet now it’s possible. That’s why we invented QUAD.
Unlock the Potential of Your Data with QUAD
With QUAD, you can achieve real-time data classification, enhanced security, and actionable intelligence without the traditional cost barriers. Visit recon’s QUAD services page to see how QUAD can help your business take control of data governance and turn data into a strategic advantage.
Latest News and Insights
PKI and Certificate Management the risk most miss.
An expired certificate can take down critical business services faster than many cyber attacks. With certificate lifecycles shrinking, PKI...
Read More
Data and Observability Pipelines
Observability pipelines have become a fashionable abstraction although by going down this route organisations are quietly re‑introducing the very...
Read More
Recon Partners with CrowdStrike to Elevate Cybersecurity for Australian Businesses
Recon has partnered with CrowdStrike to bring AI-powered cybersecurity to Australian businesses, delivering advanced threat detection and response through...
Read More
Google and M365 Security
Google and Microsoft offer great solutions for collaboration, yet the intricacies of these platforms need to be understood to...
Read MoreLooking to transform your cloud and cyber practices?
Recon transforms cloud and cyber from cost and risk into drivers of growth. Our focus is enabling scale, protecting value, and supporting confident business expansion.