Instructor: Data Ownership.
In this lesson, we are going to talk about data ownership
and some of the things that are important inside of it.
Now, when we talk about data ownership,
this is the process of identifying the person responsible
for the confidentiality, integrity, availability,
and privacy of the information assets.
Now, you might think that the data owner
is the person who created that file,
but that's not what we're talking about.
In an enterprise environment, there are different roles
that fall under this idea of data ownership.
These include things like the data owner themselves,
the data steward, the data custodian,
and the privacy officer.
Let's take a look at each of these.
First, we have our data owner.
This is going to be a senior executive role,
and they have the ultimate responsibility
for maintaining the confidentiality, integrity,
and availability of the information asset.
So what is their real role here as the data owner?
It's not the person who created the file.
It's the senior executive,
and this data owner is going to be responsible
for labeling the asset and ensuring that it's protected
with the appropriate controls.
So the data owner is going to say this type of information,
when we're dealing with, let's say,
the balance sheets for the corporation,
they should be protected as financial information.
So anybody who creates it will now follow my rules
and label it as financial information.
And we're going to protect financial information
by doing X, Y, and Z, whatever those controls are.
Now, the data steward is a role that's focused
on the quality of the data and the associated metadata.
This data steward is going to be somebody
who is working for the data owner.
They're going to be involved with making sure
that the data is appropriately labeled and classified.
So we said that all financial data
should be labeled financial data,
and it should be taken care of this way.
That's going to be the role of the data steward,
to make sure that's actually done.
Now, as we go down even further,
we get to our data custodian.
This is a role that's responsible
for handling the management of the system
on which the data assets are stored.
So who might be a data custodian?
Well, a system administrator.
These are the people responsible
for enforcing the access control, the encryption,
and the backup and recovery measures that protect this data
based on the requirements set forth by that data owner.
And so you can see how this all goes upward as you go.
Then we have our privacy officer.
Now, this is a role that's responsible
for the oversight of any kind of privacy-related data,
things like PII, SPI, or PHI,
any of those things that are managed by the company
fall under the realm of the privacy officer.
This is the person who's going to really be on the hook
if you have a data breach,
because normally when you have a data breach,
what people are concerned about is the private user data
that has been expelled.
And so that is going to be what they're focused on.
They have to make sure that we are complying
with the legal and regulatory frameworks
and make sure that we have the right purpose,
limitations and consent,
we're doing data minimization, data sovereignty,
data retention, all the stuff we've been talking about
in this section falls under that privacy officer.
Now, the real question is, who should own the data?
Now, in a lot of organizations,
they try to make the CIO or the IT department be in charge
of all the information and be the data owners,
but that is the wrong answer because as the IT personnel,
we don't know about the data.
We know about the systems.
We should be the data custodians.
Instead, the data owner should be somebody
from the business side,
the people who are creating this information,
and each data owner can actually be specified
inside their own department.
So for instance, you might have the accounting department
have their leader be the data owner,
and they would have a data owner over their information
because if I, as the IT person,
am looking at some accounting data,
I don't know it well enough to be able to classify it
at the right level.
And so this is one of those things
that I think is really important,
that the IT people should not be the data owners
and the data owners should really be the people
who know more about the data
based on the content of the company.
If your company is a software development company,
then the software design department
should probably be the data owner.
If you're an accounting firm,
it should be the financial department or the CFO.
Somebody who knows about the data
who can make the right decisions
as far as labeling and classification,
that is who should be your data owner.