Security and privacy conscious analytics with Looker + SecuPi

[LookerExperts]

This content, written by Bruce Sandell & Atalia Horenshtien, was initially posted in Looker Blog on Feb 28, 2020. The content is subject to limited support.

One of the things that customers love about Looker is our security model. Looker provides your data analysts and the flexibility to secure your Looker instance in many different ways. This includes the flexibility to manage who has the ability to log into Looker, what functionality they have available to them within Looker, as well as what content they are able to see. User access to content can be limited at the report level, dashboard-level, row-level, and even the individual column-level. Additionally, restricting access to data can be built right into the LookML model, meaning that anyone accessing data from Looker — whether through the Looker UI, embedded content, or via custom applications using Looker’s API — will all still adhere to the same security configured within Looker.

However, depending on your data access patterns, there may be times when you need tighter data security and access restrictions. Perhaps third-party tools aren’t allowed direct access to data, or maybe you need to enforce policies related to an individual’s right to be forgotten that are above and beyond what Looker provides based on Attribute-Based Access Control (ABAC).

That’s why Looker has teamed with to provide admins and users alike with granular user-activity visibility and controls in order to adapt to the ever-changing technical privacy regulation landscape quickly and efficiently.

Besides limiting access to data based on the individual user attribute or role, SecuPi provides many advanced options for securing data, including:

• data masking
• format-preserving encryption
• auditing
• monitoring for User Behavior Analytics (UBA).

SecuPi features include those like user statistics and real-time monitoring to answer questions like: Who is trying to access sensitive data? Is someone trying to steal the data? These features have been built to help provide complete solutions for compliance across CCPA, GDPR, HIPAA, and other regulations.

With SecuPi, security administrators can set up rules governing access to data from within their data warehouses, regardless of the access mechanism. This gives administrators one centralized place to configure all of their data access rules, regardless of where or how the data is accessed. The result? Security admins save time they otherwise would’ve spent dealing with the complexity of configuring data security into each individual application and providing a single “set it and forget it” interface.

How does it work?

SecuPi lies between the Looker and the data warehouse to which Looker is connected. There are a number of ways to do this. Using a proxy system, you can point a Snowflake driver or Web UI directly to SecuPi. There are also special versions of the JDBC and ODBC drivers offered as wrappers that can provide the connection to your central enforcement point. The SecuPi system follows a Policy Enforcement Point (PEP) and Policy Decision Point (PDP) style architecture, sits as close to the PEP as possible, and calls to the PDP to make choices the PEP cannot be minimized. This allows for the best performance, which we’ll cover more below.

In order to configure this with Looker, you’ll first need to define the connection that will point into the SecuPi gateway, and the authentication will be based on an OAuth connection.

After this is done, that’s all you need to make sure Looker users have appropriate data access across the enterprise! From there, admins have a lot of flexibility when it comes to what kinds of data access rules they’d like to apply, like masking and hashing by roles, departments, and risk levels.

Learn more about with your Looker deployment or reach out to our Looker team to find out more about the Looker + SecuPi partnership.