AWS Financial Services Symposium | Chris Brown

Clips
News
More from AWS Financial Services Symposium

Chris Brown

Public Sector, Chief Technology Officer

Immuta

Advancing data governance in financial services: Insights from Immuta’s Chris Brown

In the financial sector, where compliance and regulation are of the utmost importance, innovative approaches to data governance in financial services are essential.This evolution is driven by the need to scale securely and efficiently, leveraging advanced technologies such as generative AI and deep learning models to maintain strong security protocols while enhancing accessibility and operational efficiency, Chris Brown (pictured), public sector chief technology officer of Immuta Inc., explained.Immuta’s Chris Brown talks to theCUBE about data governance in financial services.“What’s unique that we’ve done at Immuta is that we’ve actually integrated into those data platforms

play_circle_outline Enabling Secure Data Access and Democratizing Analytics through Scalable Integration of Policies

play_circle_outline Strategies for Harmonizing Compliance and Regulations in the Financial Services Industry: A Responsible Approach to AI

play_circle_outline Unlocking Data Security: Scaling, Auditing, and Simplified Policy Creation with Immuta's Attribute-Based Access Control

play_circle_outline Enforcing policies across multiple platforms and data sources.

Info

Chris Brown | Immuta

Chris Brown

Public Sector, Chief Technology Officer Immuta

>> The AWS Financial Services Symposium, presented by The Cube.

>> Good afternoon AWS fans and welcome back to New York City. We are here at the AWS Financial Services Symposium. My name's Savannah Peterson, you're watching The Cube. But more importantly, I'm very excited to be joined by Chris Brown this morning. Chris, what's up? How are you doing? You're going to share some secrets.

>> Doing great.

>> Good. So I was really excited about our talk. You're going to be telling us about securing data for major banks, which I can imagine is both regulated, complicated, and we're talking about a volume of data. But before we even get into that, you've been doing this for a long time, data security is your jam.

>> Yeah, data security has been something I've been doing for a really long time, actually. I mean, really kind of got big into it during our Hadoop era, which I know is dead and gone now, everyone's moved over to AWS and Databricks, Snowflake or whatever. But really cut my teeth in this area really in, and I know it's a financial symposium, but in the Department of Defense and Intelligence agencies. So keeping all that data contained that can't leak out and things like that is still very relevant to what we're doing here.

>> Yeah, I mean, I guess if you've been handling matters of national security and then you're dealing with banks. But it's a similar level of compliance, it's a similar level of intensity. So how do you approach, I mean, we have so much data now. We've never had more data. We're only going to be making more data. How do you approach data security at scale like you're doing for banks?

>> Yeah, I mean, it is really interesting in how you do this. I mean, typically what we've done in the past is we've basically created these proxy patterns back into our data systems. And the problems with those is that as people go through there, you have to scale those systems out. Then you have the problem of actually scaling out your data platform all at the same time.

>> Right.

>> And doing that is a massive chore and something that no one wants to do. And so what's unique that we've done at Immuta is that we've actually integrated into those data platforms. So now what we do is we become the policy authoring and the policy decision points, and we push those decisions down into those compute platforms where they become the policy enforcement point, which is great because everyone wants to do these self-service analytics.

>> Right.

>> So now we're actually giving people the true power to be able to bring in whatever business intelligence tool they want, run whatever model they want. They can all access that compute platform because those policies are going to be enacted there before data even leaves the system. And they're going to be done consistently throughout the system.

>> That's pretty amazing. I never had thought about policy in the stack as a part of the compute. Is this a new part of where we're at with data governance? Is this is how it's always been> That's kind of fascinating.

>> I mean, that is where we're starting to see things go. I mean, you look at what Databricks is doing today with Unity Catalog, right? They're starting to build in these row and column filters. And Snowflake has that. We're starting to see a lot of this coming to fruition with AWS and Redshift. They're starting to build those things in. So it's going to get even more relevant with lake formation and things like that. And it really is about, if you're kind of having those policies external to the compute platform, you're always going to be stuck with this impedance to able to give people the power to utilize the compute platforms, how they're supposed to because they're built to scale. Databricks, Snowflake, Redshift, they are scalable platforms. You don't even have to think about it. And that's what we need and allow those people to come into the systems with their own tools. Again, it gets back to that self-service, analytical use cases, the democratization of data. If people have to continually learn new tools, new ways to do things, your infrastructure team has to be able to consistently create the policies, get them deployed at scale. That just slows everything down. And this is all about speeding up the access to data.

>> What does having access faster mean for customers or for consumer?

>> It means something different to everyone because a lot of times it might be being able to give better customer service. So we're getting information in about, you look at fraud, that's a big thing. And there's the Chase commercial to where one of the things that the person sees, there's an alert coming through, did you actually make this payment? Yes, no, they can stop their card. And that's all about doing real time analytics and things like that. So that's giving better customer service. It might be focused on being able to get into a market better, be able to find a niche space because you're able to do better analytics to be able to improve profitability, whatever it might be. So it really depends upon the actual use case and what you're trying to accomplish that is going to utilizing that data. It's going to give you the edge somehow, whether it's something like customer service or just being able to improve business efficiencies.

>> Yeah. Wow. Okay. So it really does mean a lot of different things. And I am a Chase customer who gets those notifications. And especially as a traveler, it's really nice when it knows that I'm just on the road versus thinking somebody stole my card. And financial services industry, one of the most regulated, heavy compliance zones on the planet really. And in the whole world. How do you navigate balancing those laws, all of this data at scale? I mean, beyond being inside the stack and at the compute level, there's got to be new stuff happening, especially with AI. How do you stay up to date and make sure that that's reflected in the product?

>> That is so hard to do these days.

>> It's got to be, right?

>> It's funny because again, regulations like GDPR in Europe there's-

>> CCPA in California....

>> CPA. I live in Virginia, so Virginia has their own now. So we're going to see 50 states. Who knows when the federal government's going to do it here. There are different laws and regulations in Asia and stuff like that. So it is a continual battle to be able to try to figure out how do you actually comply to all these regulations and stuff like that. And what is good with our platform is that we take the very simple building blocks. Being able to just do basic things like column masking, making sure people can't access anything in this column. Row filtering, that's probably one of our number one use cases within financial industry is that I'm only able to see information in North America versus information in Europe.

>> Right.

>> Or maybe it's just Germany or this region over here. So we're able to filter all that data out for you. One of the other things that's really unique that we do is this concept of a purpose-based control, and it really gives context to how people are supposed to use the data. I actually dumb it down basically into, it's like a data use agreement. What can you do with the data? What can't you do with the data? Which starts to become even more important within these machine learning use cases because we're talking about, they had a session earlier today around responsible AI. So you want to be able to automate and make sure that your data scientists are operating underneath these purpose statements saying, I'm going to do responsible AI. So they're talking about the traditional problem of demographic bias within mortgage lending.

>> .

>> So what we can do is we can do feature blinding, make sure those demographic things are normally not available to the data scientist. But if they're working underneath this ethical AI purpose data use agreement, maybe those things get opened up to them because now they can run and they have to share things like their Google model card with metrics about did this model... Is it really more accurate with the demographics versus without? Can you show that this is actually a fair model using metrics there and things like that. And then it gets even more complicated with LLMs these days and trying to get into that space, which is where we're starting to actually start make some plays into. We're out at the Snowflake conference also there where Snowflake announced basically their generative AI capabilities. Databricks will be announcing theirs next week.

>> Yeah, I'll be there.

>> I'll be there too. I'm excited.

>> Oh, great.

>> So we've started integrating into those platforms, being able to do RAG use cases. So making sure that as users go in and they start trying to ask questions of the generative AI system, that they only get back relevant kind of snippets, chunks, summaries of the data that they're able to see. So making sure that things are confidential maybe versus public. So if I'm able to see confidential data, I might get a lot more information that someone can only see public data. So we're starting to build into those models, very early days, with a lot of those things.

>> That's complex though.

>> Yeah, but it is really exciting because there's a lot of really interesting things with generative AI and the LLMs today. And let's be honest, most people are not going to be building their new foundational models. I mean, that's going to be left to the Metas, the Googles, AWS, the people who have the money to actually be able to do that. So where people are going to be focusing in on right now, are those RAD use cases because we've got to stop the hallucination. We've got to make sure that things are relevant to the people. And then there's fine tuning. Right? And with fine tuning, I've done some fine tuning back probably three or four years ago when I was working in consulting. It was in a healthcare use case looking at medical notes, but I was using Google's BERT. I mean, that's like early days of this kind of thing, but that was still very expensive and very hard to do. And so using RAG, it seems to be kind of the lightweight way, cheap way, relatively easy way for people to be able to use these models, but be able to stop a lot of the problems that occur with them.

>> Yeah. So were you expecting, I feel like you're in a really unique position, plus you've been a consultant for a long time. Were you expecting this crazy boom that we've seen in the last year and a half?

>> No. I mean, it was interesting because about five years ago, I started seeing when we're talking about really more of the deep learning models and some of the changes that were going there, but you started seeing more real world use cases come up. And they were actually working. Because I joked with people is that I did computer science in, I say last century, I graduated in 96.

>> Oh, God, when you put it like that.

>> I know.

>> It really makes me feel archaic.

>> Exactly. I have to embrace that I've gotten older.

>> Last century.

>> Literally last century.

>> I'm going to be chewing on that for the rest of the day thinking about that Chris. Really appreciate that.

>> I try. But I mean, my professors, they were already in doing these AI things and it was still this very scientific thing. And then I was doing some work within Telecom doing fraud within Telecom, and I actually played with, and it's laughable today, a single layer back propagation network as a neural network. And now you look at what you have today.

>> Yeah.

>> And it was like, oh, that was interesting, but it couldn't really do much.

>> Right.

>> So you kept seeing, it's like, okay, there's something there, but you still had to keep advancing. I think with what AWS brought, really when I started getting into it, like 2010s of cloud computing. So making it kind of scalable. Compute, kind of easy to scale all these things out. That started helping build the bridge to where we could actually build out these larger models, get to real use cases with AIML. And then obviously as the advancements came, we've seen the explosion with Chat GPT 4. And what's funny is people think GPT 4, if they don't know, they think that's the first thing.

>> Yeah.

>> There's been other versions of it that if you've been following you know how long those advancements and how tough it's been for them to get to where they were with 4, which really kind of set off the explosion that we're seeing.

>> I know, it's just been wild. It's a wild time to be in our world right now.

>> Yeah, it is.

>> And it's really fun. There's some impressive stats in my notes here. So you've been able to scale secure data and roll it out to 6,000 analysts in just six months, automating 95% of data access requests and achieving 100% auditable compliance. That's impressive.

>> Yeah, that's the beauty. So what's great about Immuta, and really the reason why, like I said, I was in the consulting world before, because I keep flip flopping between products and consulting. So I was in the consulting world looking at these problems, trying to do these problems, especially with open source tools. And when I saw Immuta and knew some people who went over there, what really impressed me was the way that they were able to utilize true attribute based access control. And that is really kind of two different things that you have to have. One, you have to have attributes about users. And you have to have attributes about the data. A lot of times you'll see people doing, hey, we do attribute based access control, but they're missing the attributes about users. They have the attributes about the data, they have the tags and things like that, but they're missing the very specific things about the users. They have users enrolled still rather than, hey, I'm part of this department. Hey, I'm able to see these country codes. And be able to do that enforcement using true attribute based access control at run time is what's key. And the other thing that's really unique about Immuta is that it really changes who creates the policies. Because when you look at organizations today, you have data stewards who, let's be honest, typically are not technical. They know the policy, they know what should happen, but they can't go into a system and write the SQL to be able to create views or write these column filters that you can do in Databricks or Snowflake or something like that. And so they need a very simple interface to be able to enforce those things and force them consistently because typically that they get a DBA. So Immuta gives them an interface that is plain English. When I do demos, I'm like, hey, anyone here on this phone? Whether you're technical or not, you can read this and you can tell me exactly what's going to happen. And so they are now-

>> That's important....

>> Yes, it's key, right?

>> Yeah.

>> And it makes it understandable because anyone, hey, we need to audit this. Where's this policy?

>> Right, exactly.

>> Someone can read, the lawyer can read, this is what the policy is. And what's great is we continually monitor your data environment. We bring those data sources in, so as new data sets are made, we're able to bring that in and automatically apply those policies. And so you don't have to, every time you want to create a new table, get the DBA done and enforce policies, do the testing, do this, which delays access to data. And even more importantly, is the fact that we do that across multiple platforms. We can do it again across Redshift. We can actually get into S3 from from AWS, got to make sure I mentioned those guys, Databricks, snowflake, and others. So I can write one policy that can go across all three of those different four, all the platforms that we support and do it automatically. So I don't have to get someone for Databricks. I don't have to get someone to create IM policies for S3. I don't have to get someone for Redshift to be able to do all this stuff. And it makes it very easy to manage that, and that's how you're able to actually do all that enforcement of policy across all those users, around the world, different departments, sometimes internal and external users. And across the thousands of data sources that people have because just constantly being created and updated every day.

>> This has been fantastic. Thank you so much for taking the time this morning.

>> Awesome. We've been happy to be here. It's been great.

>> Yeah. And thank all of you for tuning into our fantastic coverage here in New York City at AWS Financial Services Symposium. My name's Savannah Peterson. You're watching The Cube, the leading source for enterprise tech news.

Chris Brown | Immuta

>> The AWS Financial Services Symposium, presented by The Cube.

>> Doing great.

>> Right.

>> What does having access faster mean for customers or for consumer?

>> That is so hard to do these days.

>> It's got to be, right?

>> It's funny because again, regulations like GDPR in Europe there's-

>> CCPA in California....

>> Right.

>> .

>> Yeah, I'll be there.

>> I'll be there too. I'm excited.

>> Oh, great.

>> That's complex though.

>> Oh, God, when you put it like that.

>> I know.

>> It really makes me feel archaic.

>> Exactly. I have to embrace that I've gotten older.

>> Last century.

>> Literally last century.

>> I'm going to be chewing on that for the rest of the day thinking about that Chris. Really appreciate that.

>> Yeah.

>> And it was like, oh, that was interesting, but it couldn't really do much.

>> Right.

>> Yeah.

>> I know, it's just been wild. It's a wild time to be in our world right now.

>> Yeah, it is.

>> That's important....

>> Yes, it's key, right?

>> Yeah.

>> And it makes it understandable because anyone, hey, we need to audit this. Where's this policy?

>> Right, exactly.

>> This has been fantastic. Thank you so much for taking the time this morning.

>> Awesome. We've been happy to be here. It's been great.