Raito for Databricks: Self-Service Data Access Without Manual Workflows

0:05hey folks today I have a co-founder of a company called RTO today I have Bart hi Bart hey youf Kam how are you doing all good all good so tell me more about you yeah hey first of all thanks for having me Yousef so like you said uh I'm one of

0:27the co-founders at Rao we started right almost three years ago uh spin-off from calibra because we saw that uh today the data platform teams they they have or spend a lot of time on the data access management data security workflows access requests management reporting

0:50auditing integrating with devops so there's a lot of manual workflows that are very time consuming and very costly and uh with righto we want offer you know a single platform to streamline all those workflows uh across your data stack so that as a data engineer you have to spend less time on stupid stuff

1:13like access management you can push some stuff to the data owners in the business improve that collaboration create insights for the data governance guys um your data analysts data consumers they get much faster access to the data they need and you know everything reporting is just much faster done so

1:36all in all we make you so more much more productive help you unlock uh value of data easier while also improving uh the security and that's in a nutshell what we do that makes sense I guess you were able to find the uh a problem that Rao can solve and and yes I've seen in your

1:59in your profile that used to work for cbra as a product manager for for data privacy and I've seen also did so many like other job like a risk and valuation consultant ring analyst I think your background uh is very rich and you can like benefit from all those experience to build on shape uh a product like RTO

2:24yeah indeed I mean when I was young and uh stupid I decided to become a Banker or Financial Risk Banker uh but always interested in in the risk aspect and that's what when you look at my my resume or my LinkedIn profile I've always been drawn uh to risk management uh first it was Financial Risk then it

2:46was privacy risk now it's data security and what I find uh interesting is how do you balance that with productivity and that's really the goal for righto is how can we make you more secure without sacrificing productivity and if you look at how their teams manage security and access management today

3:08it's always at the cost of productivity uh and that's what we want to do because I mean uh you you've seen the latest data breaches um you've seen the security issues with DBT uh there are more hackers uh private hackers but also Sovereign hackers you know sponsored by Russia by China that

3:30China that want to destabilize economy so more hackers we have stricter security regulations coming up so we have to improve security but we also have to stay productive right we have to promote self-service analytics you have gen there is more data demand for AI so how do you balance that that is really what motivates me personally for for RTO

3:54I was about to ask you how you can do how you can describe righto in two sentences and I think you already answered the question let's suppose I am a data Brak customer how can I benefit from the platform right how can I connect those two platform together and then what the advantages this platform going to bring since in data breakes we they already

4:18have Unity catalog as a governance layer yeah yeah so uh with unity catlock what you have is great functionality to manage ACLS right so you you have group groups you link those groups to the permissions using the ACLS and this is really the foundation for access management right and that's also why they introduced Unity catalog to uh give

4:41you these capabilities what we allow with R to is to have a single platform for all your uh data security workflows because today um when there's an access request a ticket is logged or emails are sent right it ends up with the engineer he has to find the right permissions add the user or the group to those

5:04permissions but then there's also the reporting where you have to generate you know risk reporting and management reporting which can be costly um there's integration with devop so that when a new data product is created all the right permissions are set and columns are masked so what we do is we don't add an additional layer over that right we

5:26just integrate with that and help you streamline all those workflows and help you leverage you know the native capabilities in data breaks Unity catlock is a great product but it's still a bit technical right you cannot ask if you work with a data owner in the business which you have to do under data mesh and and similar uh Frameworks if

5:48you ask them hey do this in unity catalog or do this in terraform where you bind users and groups to permissions it's too technical so with our platform what you can can do is centralize all those workflows workflows streamline them and then push some of that ownership to the business so that you as a data engineer you can focus on more important stuff like your pipelines data

6:11quality and so forth and how many connectors do you have right now like you connect to like which platform you can connect right to of course data breaks uh but then Unity G of course uh but we also have snowflake we have bigquery we have awss 3 we have aure ADLs that's on the data site um of course we also integrate with

6:35your identity providers so active directory OCTA One login will integrate with them as well so we correlate user information with your accounts so you manage access at the user level or the group level and not at the account level um also integration with your biggest cataloges like so the cbra catalog uh we're going to announce it this week we have our integration with cbra so this

6:58is a scoop you're the first one to know H the French catalog Zena your your Co compatriots also integrate with them um and what we're working on now is uh integration with uh ticketing systems like service now and jira where a lot of the access requests and all of the

7:20requests come in love it I'm I'm really curious can you show us uh how like the UI of the platform and how does it work yeah awesome great happily so hey I have to start with a cardinal sin and start with some uh with some slides um

7:43share voila so uh what I want to show is uh you know a typical workflow in access management and this is the workflow that you have when you create a new data product in DBT right so we create a data product in DBT at a certain moment you

8:05have to set the right permissions as an engineer maybe mask some columns and then later process access requests from the data consumer what we've done here is actually that as an engineer you don't have to do any of that stuff anymore what you do is you create a data product you add a role that grants

8:27access to the data product and then it's up to the rest hey you take care of this business right I want to focus on important stuff and that's the second half of the slide so you created data product in DBT I'm going to show you that um this data product and the permissions are created in RTO we assign a owner and it's up to the owner then to give access to the right users or

8:52groups um as a second step we will write to also dynamically mask sensitive data in Databricks using the rules managed by your data governance Steward in the data governance team so that's a second step and if time allows we can log in as a data consumer do an access request on

9:14the data product and then see how we can update permissions after approval right so step one DBT look I'm a I'm not a DBT uh expert oh uh but one of our Engineers he did a first run with DBT and uh I'm just looking at the Manifest files here right so what we

9:37have is in our models we can see that we created uh dbd project that generates uh how many Six Tables right I guess if I'm not wrong I don't know six no no my bad that's why I'm not the engineer um so we see that for uh the tables you can add

10:00permissions so a gr statement giving access to the role that we create sales analytics data product so we work with a concept of universal role-based access controls right as an overlay over your ACLS uh this is one thing so this will create in righto this role and will that

10:22role will grant access to the data product that's created by DBT that's one thing what uh our engineer also did was uh in in uh in DBT he was in the table person credit card that he creates in his model he tagged the column card number with the tag PCI so we have a

10:46table person credit card in that table there's a column card number and that's tagged as PCI payment card information so this is super sensitive data and this needs to be masked soon as it goes to production right and that's what we will do with our Dynamic masking rules in in Ron right so step one in DBT our

11:08analytics engineer created a new model added the grounds to the roles and tagged a column as PCI and this stuff is then read with our CLI component so our open source component reads this out and creates all the right roles and data masking rules in in RTO and then notifies the data

11:30owner so that is step two right so now I'm going to go to RTO and you're going to see there's notification for the data product owner hey a new data product has been created and you're assigned owner right so I am logged I'm going to zoom out a little it's bit Yeah so logged in into AO is this legible Yousef can you

11:55yeah not too small cool not too small uh um so you see that there's a notification for me as a data product owner and it says that I was assigned owner to the sales analytics data product by our CLI right so Reuben is our engineer thanks Ruben for setting this up by the way so uh I'm going to

12:17the sales analytics data product and what we can see is that all those tables from our model are here so yeah Six Tables right these are the ones that we saw in in DBT with the masking yeah and the one with the masking as well I'll show you in a minute how we did that and basically what this is in RTO this is

12:41the role-based access control for the sales antic data product because it gives you as configured in DBT read permissions to those tables so this is really for your analysts right if you want to give an analyst access read access to this data product you point them to this role I was assigned owner and you can see

13:03that this nobody has access yet this is up to the owner to do and this is really that um segregation of Duties that you want to get as an engineer you don't want to be the one that has to say who has access it's not your responsibility right here is the responsibility for the owner so what I can do is need to move some windows around yeah here we go so

13:27now I can say I got my permissions I'm going to add uh everybody in the sales group because it's sales data I'm going to add here add beneficiary and I'm going to say uh everybody in the sales group from active directory um has access

13:49right so this is something that a lot of teams actually do in terraform as code right you manage it there but then you got State drift you don't know which users to or group to add uh um and it ends up the data Engineers have to do this because it's too technical for the business here a business user can easy do this so you're you're literally adding a wrapper on the top of this and

14:13it's like you you're doing the translation you make in and then it's automatically let's say terraformed on your behalf exactly exactly and because it's out of terraform now we can push it with the data owner because it's much easier to use um we granted sales access right what we also want to do is give our data

14:36Engineers on request access and this is really break glass access right so if I say on request they have access for one day or 24 hours uh what will happen is that everybody in the data Engineering Group will not have access to that data today but when they request access the

14:59access request will be automatically approved but only for one day and this is great for you know break class access request or you need temporary elevated permissions because you have to deploy to production you can do it just this way right okay update Grant so what happens now is we sent a a a request to our CLI

15:24the CLI is our open source component you know it can be in kubernetes is or on a server whatever right that sits in your security parameter and it's a CLI that then will update the permissions in Rao giving uh sales everybody in sales access and then the data Engineers they

15:46will have on request access right cool and um what about the pricing is it for per user or per line or per how how does it work yeah so uh I mean it's uncertain time uncertain times right now so uh people are tied on

16:09budgets they don't want any surprises so we went for a fixed pricing model where uh we have three tiers basic business and Enterprise and it's a combination of functionality and the number of connectors uh that you have right so pricing is very predictable no no unpleasant surprises at the end of the

16:31the year that sounds good um cool that was no the data product owner giving access to the data product in the UI to users and uh groups now let's look at the dynamic masking because youf you you said like hey I see the mask here

16:53right so what is this mask I click on it and uh it brings me to the masking rule that applies to the uh table person credit card right so immediately went to the masking rule on that table and if I look at it you'll see why it was

17:15automatically um applied this is a rule that was set up by our data governance Steward basically this person is super concerned with data breaches privacy breaches and so forth and what what he wants is uh that all columns that are

17:38have payment card information are immediately mased he doesn't want to do this manually you know come in have when everything is already in production he wants a rule that says when I see a column masked as PCI automat a tag PCI automatically mask it and you can see it here right so in the rule it says in data

18:00bricks all columns that have the tag PCI apply the default mask from Databricks right um but uh allow everybody in finance to see the raw unmasked data so the data Steward made this rule once and each

18:24time a column in a table in production is tagged as PCI this rule automatically applies right so the column is automatically masked and your data Steward is happy because this saves hours hours of work and most importantly a ton of stress because I mean if you work with sensitive data it's very stressful we had discussions where uh

18:48the customer asked how many seconds will my data be in production without the mask being applied right so we WR this is instantly they governance team can you know sleep at night on both ears and be be relaxed and I think I can relate because I know the datab braas has been also working on a feature called ABAC the attribute based Access Control where

19:11we can encrypt some data based on the um tag that's going to be assigned to a specific table whether for example to Hash it or depending on the group The ashtag so this is this is also well like or highly asked requested feature I can imagine I mean with all

19:33the stuff happening um and that's why we also add is dynamic masking all right uh and I'm very curious if you can go back to yeah what do you have in if I click on the audit because I see on the UI General issues and audit yeah yeah so audit are all the changes that have happened to your access controls your masking rules your

19:56row filters and so forth right so any change you did in RTO or in Databricks itself are loged here right because RTO has two states one state is we just monitor what's happening in datab brecks and we report on that so who has access to what when were the permissions

20:20updated how is the data being used you can just use us to report on that um or you can also use right to manage access like I've just shown uh but in both States we will just report on all the or uh you have an AIT trail of all the changes that have happened to your AIS masking rules and roll filters thank

20:44you and now I think gonna talk about the last one last Persona yeah indeed data consumer the data consumer the the holy person right it's h the person you do all the work for it's the uh data consumer uh you know access request with RTO can come from everywhere so we are

21:06integration with cbra and Zena and with service now and jira we can get access requests from uh other sources what I'll do for today's demo is do it in in RTO and I'll uh log wait I need to check who doesn't have access yet so sales who is that okay I'll log out and log log back

21:31in as Carla who is one of our analysts right here we go and what Carla will do is uh request access to the sales analytics data product so uh let me look for this data product here we go voila so Carla found the sales

21:57analytics data product and everywhere there's a button to request access in RTO whether you are on a table or a schema or whether you are on this data product here everywhere you can just request access so that's what I'll do I say I want access to our data product um it's for me you can uh

22:20optionally limit access in in time right but I want permanent access um so I need access ACC to sales data to build dashboard and for the notifications you can get them on slack teams or just exclusively on the platform for the notifications we have integration with slack not yet with

22:43teams but with slack you can also use it to for uh access requests and as data owner when there's a request on your name you get notified you can also approve from within slack um so ideally we are invisible for most people in your organization voila let me quickly send that request for approval log back out again and now log

23:08back in as uh as Nick voila so log out as Carla the data consumer and log back in as Nick who is the owner for the sales domain check it's with last pass voila so we also have SSO right uh we

23:30highly recommend using SSO and not username and password like I'm doing in the demo uh today so please use SSO monory don't use username and password um so here we see the notification for Nick and that should be the access

23:53request and sometimes today yeah here we have our access request from uh Carla and why is that sent to Nick well yeah he's the data product owner right so all requests are sent to Nick and he sees Carla requesting access to sales data to build a dashboard and he can just say fine Implement he can add uh an

24:17end date again right so that would limit access in time um and then BR access and so yeah uh here you can see that Nick approved the access request it has been implemented and what this basically means is that as of now Carla

24:39will have access to all those tables that are part of the sales Antics data product uh because Nick approved that access request again how does that flow look like we send a notification to our CLI that sits within your security parameter and the CLI that then will use the AP I to Grant Carla access using the

25:01grant statements that's clear I think the platform is very easy to use the you you won't get lost that's for sure and I really understand the value of using Rao to non-technical

25:23FS awesome I mean you know when you really want to scale self-service analytics you kind of need self-service data management right uh and that's what we allow for data access management data security because uh you really need to unburden your data Engineers they're wasting a lot of time on this and data consumers are waiting hours and hours

25:46for data and nobody knows who has access to what what usage is and so forth so that's what we do with righto yeah that that makes sense and they have a question for you like if one of the like the viewers is interested by testing righto do you have any trial version or we do yeah we do so uh if you want

26:10to check out what we do go to ww. or send an email at bato.io uh we can always hook you up with a free trial instance uh you can also request a free trial instance from uh our website that that's perfect I will make sure to add the link to the website on the

26:34description of the record the video as well as the documentation and uh LinkedIn B LinkedIn and I believe I would thank you Bart for showing us the your great product and I really wish you good good luck I see that you have something great and I'm really looking forward to see

26:56what you're going to achieve in be achieving with this amazing platform you do have hey thank you for the kind words you and thank you so much for having me today uh really enjoyed our conversation likewise bye bye-bye