Protecting Sensitive Customer Data With A Single Policy – Yes, It’s Possible
summary
Claims a single ABAC single policy can protect customer data across a lakehouse by combining data tags, user attributes and context. Shows the concrete policy: Mask columns tagged customer using hashing for everyone except when a user is a member from the group claims. Requires three pillars: automated discovery/classification, row‑ and cell‑level masking/redaction and continuous monitoring; removes slow access requests and scales to thousands of sources and tens of thousands of users. Demonstrates the combinatorial pain with 264 employees and 714 email distros and notes ABAC doesn’t stop a malicious privileged insider.
AI-written summary · about
chapters (12)
- 0:00Introduction to data protection
- 1:03Data as oxygen analogy
- 2:28Why privacy matters
- 3:31Regulatory and trust implications
- 4:35Access control scalability challenge
- 6:46Limitations of role-based access
- 7:51Attribute-based access control explained
- 9:58Constructing ABAC policies
- 11:25Single policy for customer data
- 12:30Three pillars for implementation
- 14:35Benefits of ABAC scaling
- 15:37Q&A session
related talks
30mProtecting Data While Maintaining Analyzability & Its Business Value: Is It FACT or FICTION
12mStriking the Balance: Safeguarding Customer Privacy While Empowering Employees
13mSimplifying data security in a complex data lake environment
26mAnalytics & Data Science with Privacy at its Core
35mAppSec Security: The SDLC in the age of agentic
54mEstablishing a data perimeter on AWS
24mThe Power of AWS Tags
26mThe Power of AWS Tags (Advanced IAM Session)