Access Control and Metadata

Data Access Control

Access control ensures that only authorized individuals and systems can access data appropriate to their roles and responsibilities. Effective access control balances security with usability, enabling legitimate data use while preventing unauthorized access.

Access Control Models

Role-Based Access Control (RBAC)

Access rights granted based on user roles within the organization.

• Roles: Define job functions (e.g., Analyst, Manager, Administrator)
• Permissions: Assign permissions to roles, not individuals
• Users: Assign users to appropriate roles
• Benefits: Simplifies administration, reduces errors, easier auditing
• Best For: Structured organizations with clear job roles

Attribute-Based Access Control (ABAC)

Access decisions based on attributes of users, resources, and environment.

• User Attributes: Department, clearance level, location
• Resource Attributes: Classification, owner, sensitivity
• Environmental Attributes: Time of day, IP address, device type
• Benefits: Fine-grained control, dynamic decisions, flexible policies
• Best For: Complex environments requiring context-aware access

Discretionary Access Control (DAC)

Data owners decide who can access their data.

• Owner Control: Data owners grant/revoke access
• Flexibility: Quick access changes without IT involvement
• Risks: Inconsistent controls, access creep, security gaps
• Best For: Collaborative environments with trusted users

Mandatory Access Control (MAC)

System enforces access based on security classifications and clearances.

• Classification: Data labeled with security levels
• Clearance: Users assigned clearance levels
• System Enforced: Users cannot override security policies
• Best For: Government, military, highly regulated industries

Access Control Best Practices

Principle of Least Privilege

Users should have minimum access necessary to perform their job functions.

• Start with no access, add as needed
• Time-limited access for temporary needs
• Separate administrative from user accounts
• Regular access reviews and cleanup

Separation of Duties

No single person should control entire critical process.

• Different people for approval and execution
• Separate development, testing, production access
• Divide sensitive operations across multiple roles
• Prevents fraud and errors

Need to Know

Access limited to data required for specific purpose.

• Access granted for specific business purpose
• Document justification for access
• Remove access when purpose fulfilled
• Applies even within same role or clearance level

Access Request and Approval

Request Workflow

1. Request Submission: User submits access request with justification
2. Business Approval: Data owner or manager approves business need
3. Security Review: Security team reviews for compliance and risk
4. Provisioning: IT implements access grant
5. Notification: User and approvers notified of access grant
6. Documentation: Request recorded for audit trail

Approval Criteria

• Clear business justification
• Appropriate for user's role
• Compliant with policies and regulations
• Acceptable risk level
• Time-limited if temporary need

Access Reviews and Recertification

Regular Access Reviews

Periodic review of who has access to what data.

• Frequency: Quarterly for sensitive data, annually for others
• Reviewers: Data owners, managers, security team
• Process: Review access lists, confirm continued need, remove unnecessary access
• Documentation: Record review decisions and actions

Event-Driven Reviews

• Role Changes: Review access when job role changes
• Terminations: Immediately revoke all access
• Transfers: Adjust access for new responsibilities
• Extended Absence: Suspend or review access

Metadata Management

Metadata is "data about data"—information that describes, explains, locates, or otherwise makes it easier to retrieve, use, or manage data assets.

Types of Metadata

Business Metadata

Information meaningful to business users:

• Business definitions and descriptions
• Business rules and logic
• Data ownership and stewardship
• Data quality scores and issues
• Usage guidelines and restrictions

Technical Metadata

Technical details about data structures:

• Data types, formats, and constraints
• Database schemas and table structures
• Column names and relationships
• Indexes and performance optimization
• System and application details

Operational Metadata

Information about data processing and operations:

• Data lineage and transformation logic
• ETL/ELT job definitions and schedules
• Processing logs and performance metrics
• Data refresh frequencies and timestamps
• Error logs and issue tracking

Business Glossary

Centralized repository of business terms and definitions ensuring common understanding.

Glossary Components

• Term Name: Standardized business term
• Definition: Clear, concise explanation
• Synonyms: Alternative names for same concept
• Related Terms: Connected or similar terms
• Business Rules: Constraints or calculations
• Examples: Sample data or use cases
• Owner: Who is responsible for the term
• Status: Draft, approved, deprecated

Glossary Benefits

• Common business language across organization
• Reduced confusion and miscommunication
• Faster onboarding of new employees
• Improved data quality through understanding
• Better collaboration between business and IT

Data Catalog

Organized inventory of data assets with searchable metadata enabling data discovery.

Catalog Capabilities

• Search and Discovery: Find relevant data assets quickly
• Asset Details: Comprehensive metadata for each asset
• Data Preview: Sample data and statistics
• Lineage Visualization: Understand data flows
• Usage Analytics: Who uses what data and how
• Collaboration: Comments, ratings, recommendations
• Access Request: Request access directly from catalog

Catalog Implementation

1. Inventory Data Assets: Identify all data sources
2. Metadata Collection: Gather technical and business metadata
3. Classification: Tag and categorize assets
4. Enrichment: Add business context and documentation
5. Publication: Make catalog available to users
6. Maintenance: Keep metadata current and accurate

Data Lineage

Visual representation of data's journey from source through transformations to consumption.

Lineage Levels

• Dataset Level: High-level flow between systems
• Column Level: Detailed field-to-field mappings
• Transformation Level: Logic and rules applied to data

Lineage Use Cases

• Impact Analysis: Understand downstream effects of changes
• Root Cause Analysis: Trace data quality issues to source
• Compliance: Document data flows for regulations
• Data Discovery: Understand where data comes from
• Migration Planning: Plan system migrations and upgrades

Metadata Governance

Metadata Standards

• Standardized metadata attributes and formats
• Controlled vocabularies and taxonomies
• Naming conventions for metadata elements
• Required vs. optional metadata fields
• Quality standards for metadata completeness

Metadata Stewardship

Ongoing management and maintenance of metadata:

• Assign metadata stewards for each domain
• Define metadata creation and update procedures
• Review and approve metadata changes
• Monitor metadata quality and completeness
• Retire outdated or obsolete metadata

Integration of Access Control and Metadata

Access control and metadata management work together to enable secure, informed data use:

• Discovery: Users find data through catalog
• Understanding: Metadata explains what data means and how to use it
• Access Request: Request access based on understanding
• Approval: Owners approve based on metadata (classification, sensitivity)
• Usage: Metadata guides appropriate data use
• Compliance: Lineage and access logs demonstrate compliance

In the final chapter, we'll bring everything together with practical guidance on implementing a comprehensive data governance program in your organization.