Keeping Data Safe

–
The Complete Guide
to Data Security
TABLE OF CONTENTS

1. INTRODUCTION TO DATA SECURITY 3

2. DEVELOPING YOUR DATA SECURITY POLICY 5

3. UNDERSTANDING DATA SECURITY

COMPLIANCE LAWS 8

4. CLASSIFYING DATA BY SENSITIVITY 10

5. BUILDING A SECURITY STRATEGY

ON IDENTITY 12

6. WORKING WITH A TRUSTED ETL PARTNER 14

7. ESSENTIAL CLOUD ETL DATA SECURITY FEATURES 16

8. 6 SECURITY QUESTIONS TO ASK YOUR ETL VENDOR 18

9. CONCLUSION 21
1
INTRODUCTION
TO DATA SECURITY

Every day, the world generates approximately

2,500,000 terabytes of data 1.
Not all of this data is of equal value. Most of it
consists of logs and reports, which is useless
to everyone except the data owner, who
might use it for analytics and diagnostics.
Hiding among this mass of data, however,
there is some extremely valuable information.
Classified corporate information that would
give rivals a competitive edge. Personal data The cost of data breaches
that can reveal someone’s identity. Payment
details allow for seamless cash withdrawals. A data breach is any exposure of sensitive
data to an unauthorized party. Such parties
Cybercriminals will do anything to obtain this
can include hackers, rogue employees or any
information. It’s up to data owners to stop them.
person who isn’t authorized to access the data.
Dealing with a data breach is expensive.
Most valuable forms of sensitive data IBM estimates the average recovery cost at
• Login credentials $3.86 million 2. This figure includes immediate
restorative action, as well as loss of business
• PII (Personal Identifiable Information)
and reputational damage that arises from
• Classified corporate data losing customer data. Regulatory fines can
• Payment information and credit card push this figure even higher. In 2017, Equifax
details received a world-record fine of $575 million 3
for a data breach that resulted from a missed
• Financial records
Apache update.
• PHI (Protected Health Information)
Data breaches can also cause real human
• Personal Data as defined by Europe’s suffering. Over 650,000 people experienced
GDPR identity theft in 2019 4, and many of these
• Staff records cases were directly linked to data breaches.
When a customer provides you with their
• Education records
private data, they’re trusting you to keep
• Biometric data them safe.
When is data most at risk?

Data can be in one of three states: in use, at

rest or in transit. Each of these states has its
own level of risk.

What it means State What’s the risk

The data is in the memory of Unauthorized users may be

a production system. This could able to capture this data. If
be an automated system, such hackers can obtain credentials,
as an eCommerce module, or a they could log in and steal
user-facing system like the CMS. information.
In use

The data is stored in a data Unauthorized parties might be

repository, such as a data able to access unencrypted
warehouse. This may be data repositories and backups.
on-premise or in the cloud. Data warehouses need to be
integrated with other systems, or
At rest
crucial data may not be available
when needed.

The data is moving from one Hackers can intercept

location to another. This could unencrypted data as it moves
be synchronization between between locations. If a user
system, or a user accessing a is on public wi-fi, they may be
remote system. Transit can be In transit especially vulnerable to attack.
in-premise or across the internet.

The basics of data security

In this guide, we’ll look at how to develop 4. Categorize your data according
an effective data security strategy. The key to sensitivity.
elements to bear in mind are to: 5. Control access to data.
1. Management buy-in to support a security- 6. Use a trusted ETL partner to protect data
first culture. in transit and during transformation.
2. Create a data security policy. If you’d like to learn more about how Xplenty
3. Understand your compliance can protect data in transit, you can jump
requirements. ahead to chapter six.
2
DEVELOPING YOUR
DATA SECURITY POLICY

Data security is a philosophy. To protect

against breaches, you have to make data
security part of your core values and live
those values every day. And for that, you
require a Data Security Policy (DSP) that
everyone can access.
Data security policies help to balance the
three main elements of security:

C
Confidentiality: Sensitive
information must be safe
from prying eyes.

I
Integrity: Data must
be free from corruption
or loss.

A
Availability: Data must always
be available for legitimate
business purposes.

These elements, known as the CIA triad, are

sometimes in competition with each other,
but a strong DSP will help you find balance.
How to Write a Data Security Policy • Physical security policy: Standards for
keeping physical devices safe, which
Data security policy (or DSP) documents are often includes entry to the office building
written in dense legal language, usually in the as well as transportation of electronic
hope that they might help limit the organization’s devices.
liability in the event of a breach. However,
• Access Control Policy: Rules about
ignorance or a lack of understanding of your
who may access data and how.
company’s data security policy doesn’t constitute
a legal defense in the event of a breach. • Cloud adoption policy: Guidelines on
implementing cloud-based systems,
Instead, it’s usually better to write a DSP
including data warehouses and ETL.
in plain language that most people can
understand. Doing so means that the • Remote access policy: Outline the
DSP document acts as a useful guide for requirements for external access to
employees, customers and partners, helping local systems.
them understand how to keep data safe. • Change management policy: The
Your DSP document will generally include process for deploying new systems
the following sections: or procedures, such as minimum
documentation requirements.
• Purpose: Your main goals, which helps
readers understand the spirit of the law. • Business continuity and disaster
Examples of such goals are: protect response plans: A plan for what
customer confidentiality; safeguard happens in the event of a disaster or
business reputation; comply with relevant catastrophic failure.
laws; proactively work to minimize the risk • Technical guidelines: The DSP may
of breaches. outline specific technical standards for the
• Scope: What does the DSP cover? The organization. This can include things such as:
section will explicitly scope in sensitive • Operating systems.
data such as PII and classified information. • Database management systems.
It’s also useful to scope out certain things,
• Encryption standards.
such as publicly available information and
non-sensitive data. • User authentication protocols.
• Data classification: An overview of how • Remote access tools.
you classify data, ranging from Public to • Analytics and event logging.
Highly Sensitive. We’ll look at this in more
• Reporting and oversight: The DSP
depth in chapter 4.
will outline an internal audit process to
• Policies: A list of fundamental policies that ensure that all systems meet the agreed
relate to all data activity on the network. requirements. Any issues will go back to
This will include things like: a specified authority, such as the data
• Acceptable Usage Policy (AUP): governance team.
Terms and conditions for people using • Update procedure: A Data Security Policy
your network, such as employees or is a living document that grows with the
customers, who may need to sign a organization. You’ll need an established
copy of an AUP agreement. process to review and update the DSP to
• Data in transit rules: Standards for keep up with new technology and stay
data transportation, including minimum abreast of new threats.
levels of data encryption.
Data Security Policy checklist

A data security policy can’t cover every

eventuality. Instead, the goal is to create
a framework that offers guidance when
someone needs to make a decision about
your organization’s data. Here is a checklist of
questions to help establish if your document
meets standards.

Have you clarified the DSP with Have you clarified rules about
all major stakeholders, including permissions and access roles?
your executive team, I.T., H.R. (see chapter 5)
and compliance?

Is the document written Is there a framework for

in clear language? working with trusted partners?
(see chapter 6)

Have you outlined your Is there a clear Acceptable

primary data security goals? Usage Policy for general users?

Do your policies accord with Have you established a way to

all compliance requirements? ensure that everyone follows
(see chapter 3) DSP guidelines?

Have you categorized data Is it easy to update the

according to sensitivity? document as required?
(see chapter 4)

Once you have answered these questions,

you’re ready to publish your security policy.
It’s good practice to try to engage people in
conversation about the policy, using channels
such as eLearning tools or discussion
seminars.
3
UNDERSTANDING DATA
SECURITY COMPLIANCE
LAWS

Main data security compliance laws

Data security practices are closely related to Here are a few of the primary laws you need
the legal concept of data protection. Under to be aware of:
data protection rules, organizations have an 1. General Data Protection Regulation (GDPR)
obligation to protect individual confidentiality.
This means that you have to keep data safe, 2. Bundesdatenschutzgesetz (BDSG)
prevent unauthorized access and only use 3. Health Insurance Portability
data for legitimate purposes. and Accountability Act (HIPAA)
Data protection laws vary across countries 4. California Consumer Privacy Act (CCPA)
and even between states. However, many
5. Australian Privacy Act of 1988
laws have an extra-territorial effect, which
means that authorities will punish foreign 6. Lei Geral de Proteção de Dados (LGPD)
companies for breaches.

1 2
4 3

6
5
General Data Protection Regulation California Consumer Privacy Act
(GDPR) (CCPA)
Primary jurisdiction: European Union Primary jurisdiction: California
Data covered: Any data that could potentially Data covered: Personal Identifiable
identify an E.U. citizen Information (PII) of Californian consumers
Website: https://gdpr-info.eu/ Website: https://oag.ca.gov/privacy/ccpa
Notes: GDPR is one of the most stringent Notes: CCPA grants consumers more power
data protection regimes in the world. over their PII, including the right to know
Companies must allow users to opt out what’s on file, the right to request deletion
of data collection, and they can only and the right to opt out of the sale of PII. In
capture PII for essential business purposes. the event of a compliance breach, consumers
Organizations face severe restrictions on can directly sue the company. This law is
transporting PII out of Europe, even when currently unique in the U.S., but it is the
using a third party service. The E.U. has template for forthcoming legislation in other
successfully fined a number of American firms states 6.
for GDPR breaches, including Google 5.

Bundesdatenschutzgesetz (BDSG) Australian Privacy Act of 1988

Primary jurisdiction: Germany Primary jurisdiction: Australia
Data covered: Any data that could potentially Data covered: PII of Australian citizens
identify a German citizen Website: https://www.ag.gov.au/rights-and-
Website: https://www.gesetze-im-internet.de/ protections/privacy
englisch_bdsg/index.html Notes: Australia amended its 1988 Privacy
Notes: E.U. member states can introduce Act in 2017 to cover digital communications.
their own laws to supplement GDPR. The act takes a principles-based approach
Germany is the only state to have done so to to compliance, so companies have some
date, with the BDSG law that imposes stricter freedom as long as they follow the spirit of
controls and steeper fines. German citizens the principles. Since 2018, companies have
can claim for non-monetary damages such as been obliged under the Privacy Act to notify
stress and suffering under BDSG. Australian authorities of data breaches that
may cause harm to an individual.
Health Insurance Portability and
Accountability Act (HIPAA) Lei Geral de Proteção de Dados (LGPD)
Primary jurisdiction: United States Primary jurisdiction: Brazil
Data covered: Protected Health Information Data covered: Any data that could potentially
of Americans identify a Brazilian citizen
Website: https://www.hhs.gov/hipaa/ Website: http://www.planalto.gov.br/
Notes: HIPAA refers specifically to health ccivil_03/_ato2015-2018/2018/lei/L13709.htm
information about an individual, which Notes: Brazil’s LGPD is one of the first
includes medical records and biometric international law to model itself on the E.U.’s
information. Under HIPAA, data handlers GDPR. As with European law, the LGPD
must ensure confidentiality, integrity and covers a wide range of personal information
availability of all relevant information. They and has an extra-territorial effect on foreign
must also take steps to prevent breaches and companies. However, LGPD is generally less
unauthorized access. punitive in terms of fines and enforcement.
4
CLASSIFYING DATA
BY SENSITIVITY

Data classification hinges on one question: Companies can use this system to create a
What would be the consequences if this data classification taxonomy for data. Some of the
leaked? more common systems use Public, Internal,
Confidential, and Restricted. You can create
If you consider this question in terms of
further compartments within these general
your company’s data, you see three main
accepted categories as well.
categories:

• High Impact
This category includes personal
information that could breach data
protection laws or expose people to
the risk of identity fraud. It also includes
sensitive corporate documents such
as confidential reports and strategy
documents.

• Moderate Impact
This includes information that you’d
rather keep private, but which poses no
immediate risk. For example, B2B invoices
and supplier agreements may fall into this
category, as well as personal information
that doesn’t identify an individual.

• Low Impact
This information won’t hurt your business
if leaked, and much of it may already be
available to the public. Press releases,
white papers, and non-proprietary
corporate information all fall into this
category.
How to classify personal data Expanding your data classifications
Most privacy laws define PII as information The system above describes an outcome-
that could potentially reveal someone’s based data classification system. Some
identity. Clearly, this includes unique organizations may choose to add extra
identifiers such as: layers of detail to create a more expressive
taxonomy that describes multiple types of risk.
• Name
Some of the extra factors to consider are:
• Address
• Frequency of movement
• Date of birth
Data is at risk when it keeps moving
• Login credentials between locations. Conversely, the
risk decreases when the data remains
• Social security
encrypted in a secure repository and
• IP address rarely moves.

• Biometric information • Encryption and password protection

Additional measures can help lower risk,
such as password protecting files or
It doesn’t mean that all records associated
encrypting them in transit. It’s not always
with an individual automatically count as PII.
possible to encrypt in-use data, so this
For example, a register of login times for a
increases the potential risk.
user account is personal information, but it is
not necessarily identifiable. • Access level
That said, data owners must bear in mind that The more people with access, the greater
minor pieces of data can reveal someone’s the risk. If data rests in a highly restrictive
identity when combined. A study by Sophos environment, it’s low risk. Data on a live
found that a combination of gender, date system with multiple users is at a much
of birth and ZIP code is enough to uniquely higher risk.
identify 87 percent of U.S. residents 7. • Compliance impact
When in doubt, it’s best to assume that all Some organizations choose to classify
personal records count as PII until you’re sure data according to legislation. Health data
otherwise. poses a high risk of HIPAA breaches, while
E.U. data could lead to a GDPR issue.

Classifying data helps to support data

security while also improving performance.
If you arrive at a set of definitions that meets
your business needs, you can make sure
that highly sensitive data always has the
best possible protection. Then you can
focus on improving processing efficiency for
low-risk data.
5
BUILDING A SECURITY
STRATEGY ON IDENTITY

Users tend to be the weakest point of any Key elements of an identity-based

network. Cybercriminals often focus on strategy
stealing login credentials through phishing
An identity strategy must respect all three
or social engineering attacks. When they
elements of the CIA triad:
succeed, they can virtually walk through the
front door unchallenged. Rogue or poorly • Confidentiality
trained employees may also pose an internal User data is never exposed to an
threat to data security. unauthorized party. Equally, users cannot
This threat is greater in an age of remote access another person’s data unless they
working and BYOD policies. To meet this have a good reason.
challenge, we have to change the way of • Integrity
thinking about user security. Instead of being Users must have access to quality data
a weakness, user identity can be the primary and be able to amend as required.
perimeter for data security. Users should not be able to make any
unauthorized changes or deletions.
The Identity Perimeter
• Availability
• Users have a single login with strong Users should have access to the data they
authentication, including multiple factors require with as few barriers as possible.
• Analytics-powered systems monitor each
identity for unusual activity Identity strategy is about finding a balance
• All data activity is tied to a specific user between these elements. If your measures
identify are too complex and restrictive, users won’t
• Role Based Access Control (RBAC) be able to work with your system, which may
force them to adopt risky workarounds. If
• Compromised identities are easy to your measures are too lax, you risk exposing
deactivate or delete sensitive data.
In practice, it’s often a matter of implementing
a system and then fine-tuning it according
to your business needs. Follow the best
practices below to find a balance that works.
Identity strategy best practices

• Offer single sign-on • Implement role-based access control

Multiple logins can pose a risk. Users tend Each individual identity should be linked to
to forget multiple passwords, so they end a role, such as sales, analytics, customer
up reusing logins or, even worse, keeping service, etc. You can then implement a
a list of passwords on their desk. Single data access policy that reflects each role’s
sign-on means that one username, one needs, giving everyone the data they
password, and one user identity linked to require. In the event of an organizational
all data activity. change, you can then change the
• Set strong password standards configuration for a role rather than
updating individual users.
Password best practice techniques
include: • Take a “least privilege” or “need to know”
• At least 12 characters approach
• Variety of ASCII characters, including Each role should have access to the data
letters, numbers, and symbols they need, but nothing else. This approach
limits the chances of unauthorized data
• Forbid the use of names, dictionary access by a rogue user, or via stolen login
words or dates credentials.
• Check against a password dictionary to
• Communicate with your users
see if a password is commonly used
In the perfect identity-based strategy,
• Use randomly generated passwords users will have a seamless data
where possible experience, while unauthorized parties
• Use two-factor authentication (2FA) will find it impossible. It’s only possible to
reach this level by working with your users
2FA is essential in a single sign-on
and ensuring that they have the right
environment. By requiring two forms of
level of data availability and an easy login
authentication from two different sources,
process.
it adds an extra step that most hackers
can’t replicate, even if they obtain a
username and password. Typically you will Education plays a vital role in this strategy.
use two of the following “factors” for your Ensure that everyone receives adequate
authentication: training and support to understand how
• Something you know (e.g. a password) identity management plays a role in
organizational security. Let them know what
• Something your have (e.g. phone, they need to do to keep data safe.
keys, etc)
• Something you are (e.g. biometrics,
fingerprints, etc)
6
WORKING WITH
A TRUSTED
ETL PARTNER

Extract, Transform, Load (ETL) is a core

process that allows you to store data in a
secure repository. The process goes like this: Production
• Extract: Obtain data from live production System
systems, such as CMS, ERP, eCommerce,
marketing automation and so on. In use

• Transform: Integrate and transform

the raw data so it’s suitable for storage
in a data repository.
• Load: Send the transformed data to a
secure storage location, such as a data
warehouse. ETL Data
During this process, the data passes Pipeline
through each of the three data states,
as shown here → In transit

Data in transit can be vulnerable, especially

when it is moving outside of the on-premise
data environment, so must be encrypted.
As most organizations are now reliant on
cloud-based warehouses, this kind of data Data
movement is an inevitable fact of life. Warehouse

The main approaches to ETL are to build At rest

your own solution, install an off-the-shelf ETL
locally or use a cloud ETL service.
 What is it? Pros Cons
In-house development Internal dev team creates a Full control and transparency of You need an in-house team
bespoke ETL for your specific all aspects of ETL to build the solution and
needs provide ongoing support

Local ETL Install Purchase an ETL solution and Control over configuration Difficult to upscale and may
install it on your on-premise without needing to develop the not integrate securely with
infrastructure software from scratch cloud-based warehouses

Cloud ETL A third-party service manages Simple, no-code integration Works best with other cloud
your ETL needs across the with cloud and on-premise services, such as AWS,
cloud services, with a trusted partner Salesforce, and cloud-based
guaranteeing security analytics tools

How do Cloud ETL providers

guarantee data security?
Cloud-based ETL provides your data with servers are safe. Xplenty uses an AWS
a single point of egress from the network. infrastructure, which sits on Amazon’s
Rather than having multiple pipelines SOC-compliant data centers.
connecting each production database to a
repository, each production system has a • Working with reputable vendors
secure connection to the ETL service. The ETL is an interactive product by nature,
ETL then has a separate connection to the with automatic integration to other
data repository. services. ETL vendors must carefully vet
and monitor all of their partners to ensure
Data makes a pitstop on the ETL servers,
that their customers are not exposed to
where it passes through the transformation
risk. The ETL vendor also stays on top
layer. With in-house or local solutions, this
of changing API requirements to ensure
stage can be vulnerable.
that integrations always meet current
However, a good cloud ETL provider such requirements.
as Xplenty takes significant steps towards
• Plans for disaster recovery
protecting data security. This includes things
like: ETL vendors provide a critical connection
between live systems and repositories.
• Security-first development process Real-time analytics services are
Any reputable ETL vendor will start with dependent on an uninterrupted flow of
security protocols before they even begin data between these points. The ETL
developing the service. As a user, you can vendor should have a robust plan for
identify trustworthy products by examining maintaining service in any circumstances.
their security details and seeing if the
• SOC 2 compliance
provider has baked security into their
Routine testing is a requirement of this
product.
security standard. Xplenty, for example,
• Physical security undergoes third-party penetration testing
The physical location of your data in each year. When choosing an ETL vendor,
transition is a major factor in security. ask to see their SOC 2 report & PenTest
Reputable vendors will guarantee that all results before signing up.
7
ESSENTIAL CLOUD
ETL DATA SECURITY
FEATURES
There are many cloud-based ETL providers on • SSH/Reverse SSH tunnel
the market, each offering a range of attractive The best ETL vendors will allow you
features. For example, Xplenty offers benefits like: to connect without compromising your
• High-speed transformations on a staging security. This usually involves an SSH
server tunnel or reverse SSH if you can’t provide
port access. Xplenty supports both SSH
• Automated integration with most major
and reverse SSH.
production systems and data repositories
• Non-persistent data
• No-code data pipeline automation
ETL should transport your data from A to B
• 24-hour support and error recovery
with no records in-between. This means no
But security is the most crucial aspect of any copies, no archives, no logs – nothing that
ETL solution. If a vendor can’t offer a full suite might inadvertently cause a risk of a data
of security options, then it’s worth shopping breach. Look for a service like Xplenty that
around for someone you trust. guarantees the non-persistence of all data
passing through the pipeline.
Key data security features
• Data encrypted in transit, and at rest
As discussed in the previous section, there Within the ETL process itself, data is
are certain things that you should verify sometimes at rest or moving between
about each vendor, such as SOC compliance, locations. The vendor should be able to
physical security and reputation. guarantee robust encryption for in transit
It’s also a good idea to look at the data and at rest throughout the ETL process.
security features they offer to users. The most
• Regular penetration testing
important ones are:
As per SOC 2 requirements, penetration
• Secure login testing occurs regularly. You might request
Your team will access the Cloud ETL service the PenTest reports when signing up, but
through a web interface. This interface should remember to keep checking them each
offer a secure connection with outstanding year while you’re signed up for the service.
authentication features, including 2FA and
suspicious activity detection. Do they offer Any cloud ETL service should offer these
Single Sign On (SSO)? as a minimum.
Security through data transformation
ETL can also improve your overall level
of data security by offering transformation
functions that protect sensitive data.
• Field-level encryption: Field level • Masking: Masking is commonly used in
encryption means that data is always testing and analytics scenarios, where
encrypted when it leaves your network. your team might need large volumes of
Decryption is impossible without the representative data, but they don’t need
key, which you hold on your side. Should genuine personal information. An ETL
anyone intercept or access data while masking layer will produce an arbitrary
it’s outside of your network, they won’t value that meets requirements but doesn’t
be able to decrypt it. Xplenty offers field- expose personal information. For example,
level encryption using Amazon’s Key the ETL platform could replace Social
Management Service (KMS), and you can Security numbers with a random 9-digit
use this to encrypt data at any stage in the number.
ETL process. • Obfuscation: Obfuscation is a way of
• Hashing: Hashing is a one-way hiding data values that is often reversible.
cryptographic function that replaces For instance, the ETL may replace certain
sensitive data with a meaningless value. values with codes from a lookup table.
For instance, you can configure your ETL That lookup table later makes it possible
to replace social security numbers with a to restore the original values.
set of random characters.

ETL can help to minimize risk to data in transit

by hiding or removing sensitive information.
This is the ultimate data security strategy –
if someone does intercept or access the data,
they won’t find anything of value.
8
6 SECURITY
1. How can your platform help protect
QUESTIONS TO ASK our PII, PHI, and other sensitive data?

YOUR ETL VENDOR There’s no one-size-fits-all approach to data

security, so your vendor shouldn’t offer a one-
size-fits-all answer to this question. Instead,
The right ETL vendor can have a massive they’ll talk to you about your particular needs
impact on your overall level of data security. and explore issues like:
As with any professional partnership, it’s • What kind of sensitive data do you collect?
essential to get off on the right foot. You can
• How do you store and process this data?
do this by looking at the product features
and asking whether they truly align with your • What territories do you operate in?
needs. • Who is using the data?
More importantly, try to have a conversation • What kind of production systems and
with your vendor. Talk to them and see if storage solutions are you using?
they understand your needs. Here are a few • What are your analytics objectives?
questions to ask when you approach a vendor.
This will help them understand your needs
and also to identify potential risks in your data
strategy. The vendor should then be able to
suggest ways that their ETL solution will be
able to help.

2. What examples can you share of

how you have helped other clients
with their data security?
Many ETL vendors have worked on big
projects for major organizations. They’ll have
experience with complex data infrastructures,
and they’ll know how their solution can
address real-world problems.
Ask your vendor for case studies and
testimonials to show that they have this kind
of background. This will allow you to gauge
their reputation and see if you’re working
with someone you can trust. Case studies
will also let you know if they have dealt with
organizations like yours in the past.
3. What features does your platform
have to maintain compliance with
regulations such as GDPR, CCPA,
HIPAA?
Any reputable vendor will already be
compliant with all major regulations.
For example, Xplenty ETL meets the
requirements of GDPR, transforming data
in the EU, and offers an updated Data
Processing Addendum (DPA) to support
customers’ GDPR compliance needs.
Your vendor should understand how
regulations might impact you and offer advice
on how to stay compliant. Remember – you
are the responsible party if your third-party
ETL service causes a compliance breach.
Protect yourself by choosing a partner that
understands the law.

4. How can your data security team

assist with our data security strategy
and implementation?
If your ETL vendor has a security-first
mindset, they’ll be able to offer advice
and suggestions about keeping your data
safe. They may offer some resources on
building an effective data strategy, as well
as guidelines on meeting standards such as
SOC 2.
The simplest way that ETL vendors can
help is by offering a secure one-to-one data
pipeline between systems. This is much more
secure than the many-to-one architecture of
some infrastructures.
5. How do you remove/encrypt
sensitive data in Europe for GDPR
before moving data to the U.S. or
elsewhere for centralized analysis?
Moving data across national borders is
increasingly tricky in terms of compliance.
Unfortunately, most organizations need to
move data internationally. Even if you don’t
have an office abroad, you might use an
accounting, analytics, or storage service
based in another country. Sending data to
them could put you in breach.
ETL makes things much easier by offering
tools such as data obfuscation and field-
level encryption. These transformations
(performed in an EU data center) can make
data compliant before transit. You can then
allow your data pipeline to run as normal
without worrying about breaches.

6. Does your platform support field-

level encryption for sensitive data
fields?
Field-level encryption is the most secure way
to protect personal information. Encryption
happens before data leaves your network,
and there’s no way to decrypt it without the
relevant key. It’s a failsafe system – if hackers
manage to access your data, they won’t be
able to interpret it.
It’s important to ask whether your vendor
offers field-level encryption. Also, ask them:
• Which encryption service do you use?
• How does your ETL handle encryption?
• How do I encrypt and decrypt data in the
pipeline?
With Xplenty, you can encrypt and decrypt
from the expression editor, using the
Encrypt() and Decrypt() commands.
_
CONCLUSION

In a global, digital world, the most important Data security isn’t easy. Cyberthreats are
currency for any business is trust. constantly evolving, and employees struggle
to keep up with ever-changing protocols. The
Trust is something you earn over many years
new normal of remote work has added another
by diligently safeguarding your customer’s
layer of risk to an already challenging world.
personal data. They trust you with a lot of
essential information – their address, their This is why it’s more important than ever to
payment details, their preferences, even their get data security right. It starts with strategy,
biometric data. with people and with education. But the most
important part is getting the infrastructure
But trust is something you can lose in an
right. A good ETL vendor can help you build
instant. All it takes is one lapse in data
a secure data pipeline that keeps sensitive
security, and nobody will ever trust you
information out of the wrong hands. Your
again. They’ll switch to a rival that takes data
customers will rest easy knowing their
security seriously, someone that always
personal data is safe.
protects customer confidentiality.
Get Started