Method and apparatus for data security analysis of data flows

1. A method comprising:

assigning a policy to a data element, wherein the data element is part of a data flow having one or more flow steps reflecting usage of the data element, wherein each flow step specifies method of transport of the data element as part of the policy, the policy being associated with a classification level for the data element;

determining a data flow configuration according to the classification level involving how the data element is processed by a plurality of processing nodes;

determining, based on the data flow configuration, an expected sequence of the processing nodes that will interact with the data element;

monitoring the data element and the data flow to determine an observed sequence; and

identifying a potential security issue when there is a deviation of the observed sequence from the expected sequence.

2. The method of claim 1 , further comprising:

assigning a plurality of classification levels to the data element, wherein one of the classification levels is established based on a regulation or standard; and

initiating the determining of the data flow configuration based on the plurality of classification levels.

3. The method of claim 2 , further comprising:

selecting the data flow configuration from among a set of potential data flow configurations based on information relating to resource of the data element or information relating to one or more of the processing nodes.

4. The method of claim 1 , further comprising:

selecting the data flow configuration from among a set of potential data flow configurations based on the policy.

5. The method of claim 1 , further comprising:

verifying the expected sequence based on attestation by a user associated with one of the plurality of processing nodes; and

selectively modifying the expected sequence based on the attestation.

6. The method of claim 5 , further comprising:

assigning the attestation to the user; and

generating a notification to the user regarding status of the attestation.

7. The method of claim 1 , further comprising:

designating one of the plurality of processing nodes to a first department of an organization; and

designating another one of the plurality of processing nodes to a second department of the organization;

monitoring method of transport of data from the one processing node of the first department to the other processing node of the second department,

wherein the monitoring method of transport is used, in part, for the identification of the potential security issue.

8. The method of claim 7 , further comprising:

presenting the observed sequence among a plurality of observed sequences as part of an enterprise that includes the first department and the second department.

9. The method of claim 1 , further comprising:

verifying the observed sequence based on attestation by a user associated with one of the plurality of processing nodes; and

selectively modifying the observed sequence based on the attestation.

10. The method of claim 1 , further comprising:

retrieving a plurality of data flow configurations including the data flow configuration;

determining that another data element is not associated with the plurality of data flow configurations;

selecting one of the plurality data flow configurations based on classification level of the other data element; and

generating a new data flow configuration using the selected data flow configuration.

11. The method of claim 10 , further comprising:

determining that the new data flow configuration is associated with a particular classification level; and

determining, based on the particular classification level, that data flows associated with the new data flow configuration are not monitored.

12. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,

assign a policy to a data element, wherein the data element is part of a data flow having one or more flow steps reflecting usage of the data element, wherein each flow step specifies method of transport of the data element as part of the policy, the policy being associated with a classification level for the data element;

determine a data flow configuration according to the classification level involving how the data element is processed by a plurality of processing nodes;

determine, based on the data flow configuration, an expected sequence of the processing nodes that will interact with the data element;

monitor the data element and the data flow to determine an observed sequence; and

identify a potential security issue when there is a deviation of the observed sequence from the expected sequence.

13. The apparatus of claim 12 , wherein the apparatus is further caused to:

assign a plurality of classification levels to the data element, wherein one of the classification levels is established based on a regulation or standard; and

initiate the determining of the data flow configuration based on the plurality of classification levels.

14. The apparatus of claim 13 , wherein the apparatus is further caused to:

select the data flow configuration from among a set of potential data flow configurations based information relating to resource of the data element or information relating to one or more of the processing nodes.

15. The apparatus of claim 12 , wherein the apparatus is further caused to:

select the data flow configuration from among a set of potential data flow configurations based on the policy.

16. The apparatus of claim 12 , wherein the apparatus is further caused to:

verify the expected sequence based on attestation by a user associated with one of the plurality of processing nodes; and

selectively modify the expected sequence based on the attestation.

17. The apparatus of claim 16 , wherein the apparatus is further caused to:

assign the attestation to the user; and

generate a notification to the user regarding status of the attestation.

18. The apparatus of claim 12 , wherein the apparatus is further caused to:

designate one of the plurality of processing nodes to a first department of an organization; and

designate another one of the plurality of processing nodes to a second department of the organization;

monitor method of transport of data from the one processing node of the first department to the other processing node of the second department,

wherein the monitoring method of transport is used, in part, for the identification of the potential security issue.

19. The apparatus of claim 18 , wherein the apparatus is further caused to:

present the observed sequence among a plurality of observed sequences as part of an enterprise that includes the first department and the second department.

20. The apparatus of claim 12 , wherein the apparatus is further caused to:

verify the observed sequence based on attestation by a user associated with one of the plurality of processing nodes; and

selectively modify the observed sequence based on the attestation.

21. The apparatus of claim 12 , wherein the apparatus is further caused to:

retrieve a plurality of data flow configurations including the data flow configuration;

determining that another data element is not associated with the plurality of data flow configurations;

select one of the plurality data flow configurations based on classification level of the other data element; and

generate a new data flow configuration using the selected data flow configuration.

22. The apparatus of claim 21 , wherein the apparatus is further caused to:

determine that the new data flow configuration is associated with a particular classification level; and

determine, based on the particular classification level, that data flows associated with the new data flow configuration are not monitored.