{"id":11983,"date":"2018-01-31T11:25:38","date_gmt":"2018-01-31T16:25:38","guid":{"rendered":"http:\/\/www.iri.com\/blog\/?p=11983"},"modified":"2024-10-06T12:16:47","modified_gmt":"2024-10-06T16:16:47","slug":"defining-startpoint-data-security","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/","title":{"rendered":"Defining Startpoint Data Security"},"content":{"rendered":"

IRI has discussed startpoint security in further detail with\u00a0the Outlook Series in\u00a0a segment about data masking<\/a>.<\/em><\/p>\n

This article defines what we’d like to call “startpoint security” mostly by virtue of a comparison to endpoint security. Searches for the former didn’t yield anything on point, so at least for me, this is a case of first impression and an attempt to coin a term. My call for beholder (your) feedback on whether it’s bold, bogus or something in between, is via the comment button below.<\/span><\/p>\n

We hear about endpoint security all the time. It refers to protection technologies for sensitive information in points along a network. Endpoint security covers mobile devices, laptops, and desktop PCs, as well as the servers and networking devices they connect through. It may also refer to storage devices like thumb and hard drives, and even more granular points within, including folders, files, and entire databases that can be encrypted, for example.<\/span><\/p>\n

But what about securing data at its starting points; i.e., as data gets created by users and through applications that feed columns in databases (or values in files)? This is the only place where actually sensitive data is created, stored\/queried, processed and moved along endpoints.<\/span><\/p>\n

\"A<\/p>\n

The\u00a0data masking<\/a><\/span>\u00a0industry is built around the concept of atomically protecting the personally identifiable information (PII) directly in the data source. Securing PII directly at these startpoints instead of (or at least in addition to) its endpoints with different techniques<\/a> has several benefits, including:<\/span><\/p>\n

    \n
  1. Efficiency – it\u2019s much quicker (and less resource intensive) to encrypt or apply other de-identification functions to discrete values than to everything else around them<\/span><\/li>\n
  2. Usability – by masking only what\u2019s sensitive, the data around it is still accessible<\/span><\/li>\n
  3. Breach nullification<\/a> – any misappropriated data is already de-identified<\/span><\/li>\n
  4. Accountability – data lineage and audit logs pointing to specific element protections are a better way to verify compliance with privacy laws applicable to specific PII (identifiers).<\/span><\/li>\n
  5. Security – Multiple data masking techniques<\/a> are harder to reverse than a single endpoint protection technique. For example, if the same encryption algorithm that was used to secure a network or hard drive is also used to mask just\u00a0one field<\/span>\u00a0(while other fields are protected with other functions) is compromised, think about the difference in exposure.<\/span><\/li>\n
  6. Testing – masked production data can also be used for prototyping and benchmarking<\/span><\/li>\n
  7. Independence – data secured at its atomic source can move safely between databases, applications, and platforms (be they on-premise or the the cloud).<\/span><\/li>\n<\/ol>\n

    For those in the data governance industry, it may seem as if I\u2019m just creating a new buzzword for data masking called startpoint security. I am not, however, equating them. Under my definition, startpoint security would also take into consideration the following:<\/span><\/p>\n

      \n
    1. Data Discovery – the ability to find<\/a> via pattern, fuzzy logic, and other searches the PII<\/span><\/li>\n
    2. Data Classification – grouping discovered data into logical categories for global masking<\/a><\/span><\/li>\n
    3. Data Lineage – tracking<\/a> PII value and\/or location changes through time for surety, etc.<\/span><\/li>\n
    4. Data Latency – whether masking functions get applied to data at rest or in transit<\/span><\/li>\n
    5. Metadata Lineage – recording and analyzing the changes<\/a> to layouts and job definitions<\/span><\/li>\n
    6. Authorization – managing who<\/a> can mask, and\/or access (restore), the data<\/span><\/li>\n
    7. Risk Scoring – determining the statistical likelihood of re-identification<\/a> (think HIPAA )<\/span><\/li>\n
    8. Audit Logs – being able to query<\/a> who masked what, and who saw what, when, and where.<\/span><\/li>\n<\/ol>\n

      \"order<\/p>\n

      Many of these additional considerations are not exclusive to startpoint security, but I think we can agree that classification, lineage, and latency are more relevant in the data-centric realm than they are to endpoint security.<\/span><\/p>\n

      What\u2019s your opinion? Please leave me a comment below and we\u2019ll start the discussion there.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

      IRI has discussed startpoint security in further detail with\u00a0the Outlook Series in\u00a0a segment about data masking. This article defines what we’d like to call “startpoint security” mostly by virtue of a comparison to endpoint security. Searches for the former didn’t yield anything on point, so at least for me, this is a case of first<\/p>\n

      Read More<\/a><\/div>\n","protected":false},"author":3,"featured_media":11984,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[8,217,34],"tags":[1297,1295,1081,280,1293,470,14,13,15,1199,1294,148,149,1296,1292],"class_list":["post-11983","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection","category-iri","category-business","tag-audit-logs","tag-data-authorization","tag-data-classification","tag-data-discovery","tag-data-latency","tag-data-lineage","tag-data-masking","tag-data-protection-2","tag-data-security","tag-data-centric-audit-and-protection","tag-metadata-lineage","tag-personally-identifiable-information","tag-pii","tag-risk-scoring","tag-startpoint-protection"],"acf":[],"yoast_head":"\nStartpoint Security: Protecting Data at Its Source<\/title>\n<meta name=\"description\" content=\"Startpoint security is the term IRI coined for protecting information data-centrically, vs. endpoint security with a single point of failure.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Defining Startpoint Data Security\" \/>\n<meta property=\"og:description\" content=\"Startpoint security is the term IRI coined for protecting information data-centrically, vs. endpoint security with a single point of failure.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/\" \/>\n<meta property=\"og:site_name\" content=\"IRI\" \/>\n<meta property=\"article:published_time\" content=\"2018-01-31T16:25:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-10-06T16:16:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"David Friedland\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"David Friedland\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/\"},\"author\":{\"name\":\"David Friedland\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/cdb89f0c0a9c88810b8516d4b140734a\"},\"headline\":\"Defining Startpoint Data Security\",\"datePublished\":\"2018-01-31T16:25:38+00:00\",\"dateModified\":\"2024-10-06T16:16:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/\"},\"wordCount\":632,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png\",\"keywords\":[\"audit logs\",\"data authorization\",\"data classification\",\"data discovery\",\"data latency\",\"data lineage\",\"data masking\",\"data protection\",\"data security\",\"data-centric audit and protection\",\"metadata lineage\",\"personally identifiable information\",\"PII\",\"risk scoring\",\"startpoint protection\"],\"articleSection\":[\"Data Masking\/Protection\",\"IRI\",\"IRI Business\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/\",\"url\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/\",\"name\":\"Startpoint Security: Protecting Data at Its Source\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png\",\"datePublished\":\"2018-01-31T16:25:38+00:00\",\"dateModified\":\"2024-10-06T16:16:47+00:00\",\"description\":\"Startpoint security is the term IRI coined for protecting information data-centrically, vs. endpoint security with a single point of failure.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#primaryimage\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png\",\"width\":1600,\"height\":900,\"caption\":\"A criminal bouncing off a computer\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.iri.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Defining Startpoint Data Security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.iri.com\/blog\/#website\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"name\":\"IRI\",\"description\":\"Total Data Management Blog\",\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.iri.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\",\"name\":\"IRI\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"width\":750,\"height\":206,\"caption\":\"IRI\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/cdb89f0c0a9c88810b8516d4b140734a\",\"name\":\"David Friedland\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/995ea08bc7d036da625671cb48a636eb?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/995ea08bc7d036da625671cb48a636eb?s=96&d=blank&r=g\",\"caption\":\"David Friedland\"},\"url\":\"https:\/\/www.iri.com\/blog\/author\/davidf\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Startpoint Security: Protecting Data at Its Source","description":"Startpoint security is the term IRI coined for protecting information data-centrically, vs. endpoint security with a single point of failure.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/","og_locale":"en_US","og_type":"article","og_title":"Defining Startpoint Data Security","og_description":"Startpoint security is the term IRI coined for protecting information data-centrically, vs. endpoint security with a single point of failure.","og_url":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/","og_site_name":"IRI","article_published_time":"2018-01-31T16:25:38+00:00","article_modified_time":"2024-10-06T16:16:47+00:00","og_image":[{"width":1600,"height":900,"url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png","type":"image\/png"}],"author":"David Friedland","twitter_card":"summary_large_image","twitter_misc":{"Written by":"David Friedland","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#article","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/"},"author":{"name":"David Friedland","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/cdb89f0c0a9c88810b8516d4b140734a"},"headline":"Defining Startpoint Data Security","datePublished":"2018-01-31T16:25:38+00:00","dateModified":"2024-10-06T16:16:47+00:00","mainEntityOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/"},"wordCount":632,"commentCount":1,"publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png","keywords":["audit logs","data authorization","data classification","data discovery","data latency","data lineage","data masking","data protection","data security","data-centric audit and protection","metadata lineage","personally identifiable information","PII","risk scoring","startpoint protection"],"articleSection":["Data Masking\/Protection","IRI","IRI Business"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/","url":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/","name":"Startpoint Security: Protecting Data at Its Source","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#primaryimage"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png","datePublished":"2018-01-31T16:25:38+00:00","dateModified":"2024-10-06T16:16:47+00:00","description":"Startpoint security is the term IRI coined for protecting information data-centrically, vs. endpoint security with a single point of failure.","breadcrumb":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#primaryimage","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png","width":1600,"height":900,"caption":"A criminal bouncing off a computer"},{"@type":"BreadcrumbList","@id":"https:\/\/www.iri.com\/blog\/data-protection\/defining-startpoint-data-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.iri.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Defining Startpoint Data Security"}]},{"@type":"WebSite","@id":"https:\/\/www.iri.com\/blog\/#website","url":"https:\/\/www.iri.com\/blog\/","name":"IRI","description":"Total Data Management Blog","publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.iri.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.iri.com\/blog\/#organization","name":"IRI","url":"https:\/\/www.iri.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","width":750,"height":206,"caption":"IRI"},"image":{"@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/cdb89f0c0a9c88810b8516d4b140734a","name":"David Friedland","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/995ea08bc7d036da625671cb48a636eb?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/995ea08bc7d036da625671cb48a636eb?s=96&d=blank&r=g","caption":"David Friedland"},"url":"https:\/\/www.iri.com\/blog\/author\/davidf\/"}]}},"jetpack_featured_media_url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2018\/01\/data-startpoint-image-1.png","_links":{"self":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/11983"}],"collection":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/comments?post=11983"}],"version-history":[{"count":12,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/11983\/revisions"}],"predecessor-version":[{"id":18048,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/11983\/revisions\/18048"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media\/11984"}],"wp:attachment":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media?parent=11983"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/categories?post=11983"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/tags?post=11983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}