Cookies
Close Cookie Preference Manager
Cookie Settings
By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage and assist in our marketing efforts. More info
Strictly Necessary (Always Active)
Cookies required to enable basic website functionality.
Made by Flinch 77
Oops! Something went wrong while submitting the form.

What the new Gartner Hype Cycles mean for Data Security

How should Data Security adapt to an ever evolving data landscape? Let's look at the latest Hype Cycles to better understand.

Gartner just dropped a ton of new Hype Cycles that we’re very excited about not just because Raito has been included in the Hype Cycles, but also because they confirm some of our strongest beliefs. If you’re a data security nerd like myself, it is worth checking out. However, if you’re short on time, I provided my top three reasons why I’m excited about the new Hype Cycles.

Automated Computational Governance

Several years back, as a Product Manager at Collibra, I was always pushing hard to invest in Policy Enforcement to the point where my friends are still making fun of me. I was and still am convinced that manual data governance processes create massive bottlenecks. So you can expect my delight to see that Gartner introduced Computational Governance (Policy Enforcement) in the Hype Cycle for Data and Analytics Governance, 2024 claiming that by automating data governance tasks such as data security, the data governance teams will be freed up and time to access to data will be reduced. My favourite quote on this topic is:

“Business Impact (...) Reduction of time to data, including fewer delays between the initial data access request and authorization by using preapproved and automatically applied policies.”

As you can see by the dark blue circle, Gartner expects it to plateau in 5-10 years. Personally, I expect it to plateau in 5 years rather than 10 for two reasons. First, it’s true that it requires high quality meta-data which is often missing in most organizations. but this will very likely change with the advent of data products and dataops. In these frameworks meta-data is created during the data development process, which is a more streamlined and federated process than the antiquated centralized process of manually cataloging data or performing data discovery scans. Second, the sheer volume and variance of cloud data combined with the wave of new privacy and security regulations and standards, and the increasing number of cyber attacks on cloud data providers requires that data teams implement scalable frameworks for data security management built on automation. 

At Raito we’ve always believed strongly in the power of computational governance to scale data security and give your data consumers faster access to data and insights. Data Product Managers and Data Stewards can use Raito to:

  • Pre-approve access requests to data products.
  • Dynamically grant access to data products, using Attribute-Based Access Controls.
  • Dynamically mask sensitive data.

Self Service Data Management

Another lesson from my days at Collibra is that centralizing all data governance processes is a sure recipe for failure of your Self-Service Analytics initiative. You can have a super nice Data Catalog (or Data Product Marketplace) with all your data products, but if your end users’ data access requests take weeks to process, adoption will drop quickly. Therefore, I’m a strong proponent of Self Service Data Management as included in the Hype Cycle for Data Management, 2024, where you give non-technical users on the business side the tools to take on some of the data management responsibilities, such as approving access requests. Evidently, this requires stellar UX/UI, as you will be competing for your end user’s attention with social media which has been engineered to completely absorb users. We realised this very early on at Raito. That’s why our first hire was a UX engineer.

Gartner rightly points out the security risks of decentralising data management. If you give the reins to the business completely, soon everyone will have access to your data, however sensitive. With Raito, the data governance team keeps sufficient control over the sensitive data, by:

  • Dynamically masking and filtering out sensitive data.
  • Monitoring compliance of data access and usage with policies.
  • Keeping ownership of sensitive data.

Data Products

Also included in the Hype Cycle for Data Management, 2024 is the concept of Data Products. According to Gartner:

“A data product is an integrated and self-contained combination of data, metadata, semantics and templates. It includes access and logic-certified implementation for tackling specific data and analytics (D&A) scenarios and reuse. A data product must be consumption-ready (trusted by consumers), up to date (by engineering teams) and approved for use (governed).”

Introduced by the Data Mesh framework, data products help address several challenges for adoption, ranging from data quality issues, to discoverability, and privacy and security issues. By managing it as a stand alone product, data consumers can use and reuse data products at scale and with confidence. Its undisputable benefits have led to industry-wide adoption. Personally, I’ve seen many definitions of a Data Product, but what is clear is that it should be very easy for a Data Product Manager to manage access to a Data Product.

Raito integrates data access and security management throughout the lifecycle of a Data Product.

  • When creating a new Data Product, the Data Engineer creates the right permissions for the Data Product as code in dbt, Terraform or the Data Contract.
  • The Data Product Owner grants the right users and groups access to the Data Product. Permissions depend on their role in the organization.
  • The Data Steward dynamically masks or filters sensitive data using Raito’s dynamic policies mentioned above.
  • The Data Governance Lead monitors compliance of access and usage, detects and remediates risk, and audits changes in access.
  • The Data Consumer requests access to Data Products from with their Data Catalog, Ticketing System or preferred communication channel. Upon receiving the request in Raito, the Data Product Owner can approve access, and Raito will update access in the database accordingly. 

Data Security in the Data Product Lifecycle

Technology is not a panacea - the end of Data Mesh

In a much discussed move Gartner marked Data Mesh as obsolete, nevertheless highlighting that its underlying components remain valid. This echoes what I’ve learned in many discussions with data professionals who have been implementing Data Mesh. Which is that the organizational change is just too much. Their organizations are not mature enough, lines of businesses didn’t understand its merit, and the organizational change was too disruptive for its merits. The technical component is great but taking along your business on journey is extremely difficult. Particularly for Data Governance, which is a core component of Data Mesh, and includes Data Security. That’s why Raito offers consulting services, and partners with your preferred consulting partner to help you with change management, user training, and implementation.


Talk to the team