Company Profile
- Company
- Commercial Banking
- Size
- Large Enterprise
- Industry
- Financial Services
Securing PII Data: How One $35B+ Financial Institution Transformed Their Cloud Data Security Strategy with PK Protect
A commercial bank with more than $35 billion in consolidated assets needed to find and mask personal data held in compressed parquet files in Amazon S3. It had to do so without changing the shape of the data its analytics depended on. PK Protect handled discovery, false-positive review and format-preserving masking as one automated flow, and the same policy now applies to every new feed that lands in the bucket.
Background
With total consolidated assets of over $35 billion USD, this commercial banking organization feeds large volumes of data in compressed parquet format via a third-party tool into its AWS S3 buckets.
Parquet is a columnar format, so sensitive values sit inside compressed column chunks rather than in readable rows. A scanner that reads a file as plain text will therefore miss them entirely. Finding personal data in this environment means parsing the format itself, at the volume the bank’s feeds actually arrive in.
Challenges
Their security team came to PKWARE with a need to identify sensitive information in the specific parquet file formats, remediate any false-positives, and mask actual sensitive data in a way that preserved the format of the original data. Also required was a fully automated flow for the workflow that could be applied to any new data feeds coming in from the AWS S3 bucket.
Two constraints shaped the work. First, masked values had to keep the shape of the originals, because downstream jobs check field formats before they process a record. Second, nothing could depend on someone remembering to run it, so any new feed had to inherit the same policy on its own.
Use Cases
The bank deployed PK Protect in their AWS environments with a custom policy set up to define the required sensitive data. PKWARE leveraged EMR Cluster for running MR jobs so that discovery could be performed on large scales, and bulk remediation was provided via an automated utility. The PKWARE team also provided S3 Orchestrator, which gave the capability to segregate the scanning and masking task based on task size for any given S3 bucket folder.
Running discovery on an EMR cluster is what made that scale workable. Jobs were distributed rather than processed file by file, and the S3 Orchestrator split scanning and masking by task size so that one large folder could not stall the queue behind it. False positives were cleared through the same automated utility rather than by hand.
Our Approach
After standing up PK Protect, the commercial banking organization had access to an automated script to read new feeds from DynamoDB Tables and perform automated masking as required.
Results
After standing up PK Protect, the commercial banking organization had access to an automated script to read new feeds from DynamoDB Tables and perform automated masking as required. PK Protect also generated reports after every run, comprised of complete information regarding the number of files submitted for masking and the number of files successfully masked. PK Protect enabled the consumer banking organization to scan and mask sensitive data in their AWS environments promptly.
Reporting is the part the security team sees day to day. Every run records how many files were submitted for masking and how many were masked successfully, which turns an automated process into an auditable one. The bank can now show, run by run, that sensitive data in its AWS environments was found and protected.