Immuta Detect Provides Continuous Cloud Data Security Posture Management

Key Data Security Challenges

Data use has become ubiquitous across every industry and with it, so have threats to data security. In response, organizations are undertaking a number of enterprise security initiatives, including those aimed at continuously detecting and managing internal data security risks, data security posture management, and identifying data residency and privacy risks.

A key requirement of these initiatives is the ability to inventory and continuously monitor user access behavior and risk across modern cloud data platforms like Snowflake and Databricks. Yet, most existing solutions fall short of giving a complete view of what’s happening with regards to data access in those systems at any given time. To fill the gap, security and data platform teams looking to protect data, manage, and remediate data access risk should seek solutions that make it easy to identify and track sensitive data, monitor and measure data access risk, and provide full proof data residency and privacy detection risks across cloud data platforms.

Immuta Detect provides these capabilities, in addition to Immuta’s established discovery and security capabilities, as part of a comprehensive Data Security Platform. In this blog, we’ll explain how Immuta Detect can help you achieve full-spectrum data security, so you can rest assured data is protected and risks are kept at bay.

What is Immuta Detect?

Immuta Detect is a new product offering that provides timely insights into risky user data access behavior, enabling data security posture management and risk remediation above policy thresholds. It is a central pillar of Immuta’s industry-leading Data Security Platform, and integrates both with existing SIEM systems (e.g. Splunk or Snowflake) and an organization’s Managed Detection and Response (MDR) strategy.

With Immuta Detect, data security and data platform teams will be able to:

1. Easily identify and understand what the data is, classify each identified data’s level of sensitivity, and track sensitive data
2. Effectively monitor and measure data security risk based on access activity and data classification
3. Detect data residency and privacy risks

Immuta Detect’s ability to capture business context like sensitivity level, user attributes, activated policies, and tags, is a key benefit over solutions that look at logs without this context.

How Immuta Detect Works At-a-Glance

Immuta Detect provides security and platform teams with granular insights into data activity. With detailed user and data activity views that summarize data source activity by time frame, data access event categorization, most active data sources, and sensitive data indicators, teams receive actionable insights and are able to drill down to specific data sources.

Detect also shows detailed data access behavior analytics like person activity, queries over time, and sensitive data indicators.

Additionally, Immuta Detect’s risk scoring allows teams to easily understand data access severity risk and the mitigation techniques that were applied to contain it, such as dynamic data masking. Each column is assigned a sensitivity level based on its classification under the organization’s respective data security framework, as well as the mitigations applied to a user querying that column.

Incident alerts can be set up so that security and data teams are always aware of risks and anomalies, and can be proactive in countermeasures.

Ultimately, Immuta Detect enables data security and platform teams to easily and quickly answer questions like:

1. What data access activity took place in the last 24 hours?
2. Who accessed sensitive data, and what sensitive data was accessed?
3. What are the most trafficked data sources containing sensitive data?
4. What users were most active in accessing sensitive data?
5. How do I quantify, assess, and show my organization’s data security posture?
6. How can I stay aware of data security posture changes?
7. How do I remediate risks above policy thresholds?

Filling a Gap in the Cybersecurity Landscape

With the constantly evolving and expanding threat landscape, which encompasses both internal and external threats, companies are constantly strengthening their arsenal of processes and tools to help get a clear, holistic view of potential threats to their IT and application landscape. Data-driven security decisions remain a focal point for organizations seeking to stay ahead of constantly evolving threats, and security teams are constantly pushing for actionable insights rather than just collecting audit logs and trying to make sense of them.

The cybersecurity landscape is lined with a number of great tools that address areas like network, application, system, and infrastructure security. But when it comes to data security, many tools and solutions, specifically those that address data access risk across cloud platforms, fall short.

What is data security and what are some key concerns for enterprise CISOs around data security? NIST defines data security as “the process of maintaining the confidentiality, integrity, and availability of an organization’s data in a manner consistent with the organization’s risk strategy”. However, as the number of data sources and users increases, especially with the rapid adoption of cloud data platforms, it has become exceedingly difficult to monitor sensitive data and who is accessing it within these platforms, and to promptly and efficiently put remediation plans into play.

Teams that try to implement homegrown solutions to tackle these challenges run into obstacles such as having to pull, synchronize, and analyze contextless logs from various systems, which becomes more complex as the number of data sources and number of users grows. Additional challenges arise in the form of authentication, key management, maintaining synchronization, harmonization of log data models, and aggregation. To address these kinds of challenges, Immuta released its Unified Audit Model, which is a key component of Immuta Detect and provides a consistent audit log structure and metadata across audit events.

On the other hand, point solutions that collate and correlate logs from databases also have major shortcomings like a lack of enrichment of data with business context. This makes the logs less actionable for security teams because it limits their ability to effectively manage sensitive data access, purpose intent, policy information, impersonations, data activity risk insights, and data access posture management.

Next Steps

Are you facing some of the compliance and monitoring challenges mentioned above? If so, we are currently onboarding a number of preview customers and would love to talk to you. Get in touch with our sales team to find out more and get a personalized demo.