To provide visibility and transparency into your data and usage, Cloudera Enterprise has Navigator, the only native end-to-end governance solution for Apache Hadoop. In this webinar we discuss why Navigator is a key part of comprehensive security and discuss its key features including: auditing, access control, data discovery and exploration, lineage, and lifecycle management. Live demo also included.

1. 1
Comprehensive Security for the Enterprise:
Visibility Through a Single End-to-End
Governance Solution
Matt Aslett | Research Director, 451 Research
Mark Donsky | Director, Products - Cloudera

2. 2
451 Research - Company Overview
©2014 Cloudera, Inc. All rights reserved.
 One company with 3 operating divisions
 Syndicated research, advisory, professional
services, datacenter certification, and
events
 Global focus
 270+ staff
 1,500+ client organizations: enterprises,
vendors, service providers, and investment
firms
 Organic and growth through acquisition

3. 3 ©2014 Cloudera, Inc. All rights reserved.
Unique combination of research, analysis & data
Emerging tech market segment focus
Daily qualitative & quantitative insight
Analyst advisory & Go-to-market support
Global events

4. 4
Hadoop’s Maturing Approach to Data
Governance
©2014 Cloudera, Inc. All rights reserved.
Just a few years ago a webinar focused on data
governance and Hadoop would have been very short

5. 5
Hadoop’s Maturing Approach to Data
Governance
©2014 Cloudera, Inc. All rights reserved.

6. 6
Hadoop’s Maturing Approach to Data
Governance
©2014 Cloudera, Inc. All rights reserved.
• Hadoop did not come with security and governance controls
• No data privacy controls
• Access control measures were easily circumvented
• Security/governance was used by incumbent providers to criticize Hadoop
• “Security is always an afterthought” – and Hadoop is no exception
• But this was also partly by design
• Initially focused on public data
• Small set of skilled users – trusted machines, trusted users, trusted environment
• Therefore no real need to authenticate users or services
• As Hadoop has evolved and matured so have integral security capabilities
• Authentication, access control, encryption

7. 7
Hadoop’s Maturing Approach to Data
Governance
©2014 Cloudera, Inc. All rights reserved.

8. 8
Hadoop’s Maturing Approach to Data
Governance
©2014 Cloudera, Inc. All rights reserved.
• Hadoop use-cases have evolved
• Private and public data
• Multiple users within an organization, multiple applications
• Additionally, Hadoop projects increasingly deal with consumer data
• e.g. marketing, advertising
• Any organization handling consumer data may be subject to numerous federal laws,
including (but by no means limited to):
• Children's Online Privacy Protection Act (COPPA)
• Fair Credit Reporting Act (FCRA)
• Health Insurance Portability and Accountability Act (HIPAA)
• Data scientists discovering new patterns in combinations of data

9. 9
Caution: Data Scientist at Work
©2014 Cloudera, Inc. All rights reserved.
CRM data
Web logs
- Hadoop-
SQL

10. 10
Beware the Chemistry of Data
©2014 Cloudera, Inc. All rights reserved.
• When data is mixed together in certain combinations, it can become
‘dangerous,’ just as certain chemicals can be.
• What matters is not whether the individual data elements are sensitive, but
whether they can be put together in ways that become sensitive
• Data chemistry occurs through multiple actions:
• Collecting data, whether through bureaucratic means or automation
• Making data available to/failing to keep data from a wider or uncontrolled
audience
• Combining data to derive information
• Focusing attention on data relating to individuals
• Adding context to data

11. 11
Beware the Chemistry of Data
©2014 Cloudera, Inc. All rights reserved.
• Until we develop a better defined ‘data etiquette,’ we can't completely
formulate what’s an appropriate use of data, what’s inappropriate, what should
be regulated, and what’s illegal
• In the meantime, enterprises need to formulate more policies around the use of
their data, not just the storage, transmission and processing
• An architectural design that includes data models should also include the
purposes for which those data types will be used
• The principle of ‘least use’ should be invoked
• Use only the types and amount that you absolutely need, and get rid of it after
you are done using it
• Combined with the principles of least privilege and separation of duties, to
form the foundation of security programs

12. 12
Hadoop Security: Work in Progress
©2014 Cloudera, Inc. All rights reserved.

13. 13
Hadoop’s Maturing Approach to Data
Governance
©2014 Cloudera, Inc. All rights reserved.
• As Hadoop has evolved and matured so have integral security capabilities
• Authentication, access control, encryption
• Multiple use-cases, production deployments, and the chemistry of data, demand a
more advanced governance strategy
• Not just access control and permissions, but full stack:
• Endpoint/perimeter security
• Data protection/encryption and key management
• Fine-grained access control
• Data lineage and auditing
• Hadoop providers developing, partnering and acquiring…

14. 14
©2014 Cloudera, Inc. All rights reserved.
Cloudera’s Vision for Hadoop Security
Compliance-Ready
Comprehensive
Transparent
• Standards-based Authentication
• Centralized, Granular Authorization
• Native Data Protection
• End-to-End Data Audit and Lineage
• Meet compliance requirements
• HIPAA, PCI-DSS, FERPA, etc…
• Encryption and key management
• Security at the core
• Minimal performance impact
• Compatible with new components
• Insight with compliance

15. 15 ©2014 Cloudera, Inc. All rights reserved.
Key Requirements for Security in Hadoop
Perimeter
Guarding access to the
cluster itself
Technical Concepts:
Authentication
Network isolation
Data
Protecting data in the
cluster from
unauthorized visibility
Technical Concepts:
Encryption, Tokenization,
Data masking
Access
Defining what users
and applications can do
with data
Technical Concepts:
Permissions
Authorization
Visibility
Reporting on where
data came from and
how it’s being used
Technical Concepts:
Auditing
Lineage

16. 16 ©2014 Cloudera, Inc. All rights reserved.
Gain Visibility
Perimeter
Guarding access
to the cluster
itself
Technical Concepts:
Authentication
Network isolation
Data
Protecting data in
the cluster from
unauthorized
visibility
Technical Concepts:
Encryption, Tokenization,
Data masking
Kerberos | AD/LDAP
Access
Defining what
users and
applications can
do with data
Technical Concepts:
Permissions
Authorization
Sentry
Data
Protecting data in
the cluster from
unauthorized
visibility
Technical Concepts:
Encryption, Tokenization,
Data masking
Encrypt | Key Trustee
Cloudera Navigator: Only native end-to-end governance
solution for Apache Hadoop
Audit Maintain comprehensive audit history,
regardless of access point
Discovery &
Exploration
Search all metadata through one system to use
it effectively
Lineage Trace data back to original source to verify
result validity
Visibility
Reporting on where
data came from and
how it’s being used
Technical Concepts:
Auditing
Lineage
Cloudera Navigator

17. 17
Problem Statement
• More and more data is landing in Hadoop
• Many different sources – structured & unstructured
• Varying levels of sensitivity
1
• Many users are working with the data in multiple ways
• Users: Compliance Officers, Analysts, Data Scientists, Business Users
• Tools: BI tools, ETL tools, Hue, and more
2
• Need to govern without constraining business agility
• Monitor all activity
• Discover, explore and consume all data
3

18. 18
Data Management Challenges in Hadoop
•Identify access to a data asset around the time of security breach
•Generate alert when a restricted data asset is accessed
•Challenge: Many different audit logs across Hadoop
Auditing
•Given a data set, trace back to the original source
•Understand the downstream impact of purging/modifying a data set
•Challenge: Tracking lineage manually is error-prone and time-consuming
Lineage
•Search through metadata to find data sets of interest
•Given a data set, view schema, metadata and policies
•Challenge: Hadoop has many technical metadata stores, no business metadata
Metadata Tagging and
Discovery
•Automate periodic ingestion/replication/purge of data
•Compress/encrypt a data set at rest
•Challenge: Oozie is complex and its scheduling is restricted to time-based
Lifecycle Management

19. 19
Demo

20. 20
Q2-2014 Q3-2014 Q4-2014 1H-2015
Data ingest, egress and curation
Role-based access control
Converged auditing and lineage
Impala, Spark
Automatic Lineage
Business and technical metadata
Navigator Encrypt and Key Trustee
Hive, Sqoop, Pig, Oozie, MR, YARN
Fine-grained access control
Unified multi-cluster discovery
Sqoop 2, Flume
ReleaseThemesFeatures
Governance, Compliance &
Risk Management
Data Lifecycle
Management
Data Discovery

21. 21 ©2014 Cloudera, Inc. All rights reserved.
Key Requirements for Security in Hadoop
Perimeter
Guarding access to the
cluster itself
Technical Concepts:
Authentication
Network isolation
Data
Protecting data in the
cluster from
unauthorized visibility
Technical Concepts:
Encryption, Tokenization,
Data masking
Access
Defining what users
and applications can do
with data
Technical Concepts:
Permissions
Authorization
Visibility
Reporting on where
data came from and
how it’s being used
Technical Concepts:
Auditing
Lineage
Available
On-Demand
Available
On-Demand
Available
On-Demand
Available Soon

22. 22
Matt Aslett
matthew.aslett@451research.com
Mark Donsky
mdonsky@cloudera.com

23. 23
Navigator 2.0 Requirements
• Cloudera Manager 5.1
• CDH 4.7 or later
• Auditing
• HDFS, HBase, Hive, Impala, Sentry
• Lineage/Metadata
• Sqoop, Hive, Pig, MR/YARN, Oozie