Skip to main content

14.6 — Identity, Auditing & Security Operations

1. Identity lifecycle​

Enterprise security begins before Datasphere.

The lifecycle is:

JOINER | v ACCESS REQUEST | v ROLE ASSIGNMENT | v PERIODIC REVIEW | v CHANGE | v LEAVER / REVOCATION

A role that is never revoked is a permanent risk.

2. User identifiers​

Data Access Controls rely on user identity values that must align with the identity-provider representation expected by Datasphere.

Never assume email address, username and identity-provider subject are interchangeable.

3. Audit logging​

Security-sensitive environments should define what activity must be auditable.

Examples:

  • access changes;
  • object changes;
  • role changes;
  • space changes;
  • security configuration;
  • relevant data read/change actions where auditing is configured.

Use the current Datasphere audit capabilities and retention settings appropriate to the tenant.

4. Activity versus audit​

Do not treat every operational log as an audit trail.

Operational activity helps answer:

What changed?

Audit controls help answer:

What security-relevant action occurred, by whom, and when?

5. Privileged access review​

Review:

  • System Owner;
  • tenant administrators;
  • space administrators;
  • custom roles with broad privileges;
  • users with unrestricted data access;
  • dormant accounts.

6. Separation of duties​

Avoid combining:

  • role administration;
  • production modeling;
  • security approval;
  • audit review;

in a single uncontrolled identity.

7. Emergency access​

Define a controlled break-glass process:

  1. emergency access requested;
  2. reason recorded;
  3. temporary privilege granted;
  4. activity monitored;
  5. privilege revoked;
  6. incident reviewed.

8. Security monitoring KPIs​

Track:

  • privileged-user count;
  • dormant users;
  • role changes;
  • scoped-role changes;
  • failed authorization incidents;
  • DAC changes;
  • audit coverage;
  • unresolved access exceptions.

Hands-on lab​

Create a quarterly access-review procedure for a five-space Datasphere tenant.

Include:

  • owner;
  • evidence;
  • reviewer;
  • exception process;
  • revocation;
  • audit retention.