Show Notes
Zero-trust appears on every vendor slide, but most explanations stop at the network perimeter. This episode asks what the model means at the data layer, where a Chief Data Officer actually works, and argues that zero-trust is a posture you maintain rather than a product you buy. The position is blunt: classification comes before technology, and access rules written without honest data tiering create friction people route around.
Listeners come away able to separate network zero-trust from data zero-trust, apply the three checks at the moment of access (identity, context, data sensitivity), tier data as public, internal, confidential or regulated, and run a five-dataset access audit. Includes Microsoft Purview figures on unlocated sensitive data and an insurer rollout that failed.
0:00 What zero-trust means before the marketing 1:03 Identity, context and data sensitivity at access 1:51 When authentication friction drives workarounds 2:21 Classifying data into four tiers first 3:05 Why rip and replace is unnecessary 3:52 The Monday morning access audit
More from MBA Training Data
Who pays when a fund's NAV is wrong and the manager never saw the error? Under CSSF Circular 24/856 the investment fund manager corrects and compensates, even when the administrator calculated the price. The episode argues that managers should own one position and pricing record, backed by a written pricing policy, rather than inheriting whatever the administrator used.
How did hackers send a ransom note through the real Asos app? Reporting points to a conned employee and, per researcher Kevin Beaumont, Simon AI, a composable customer data platform owned by Monetate that reads straight from Snowflake with MFA optional and off by default. That route is unconfirmed. The episode argues the real failure is ownership: marketing bought it, data engineering wired it to the warehouse, and nobody owned the login.
Agents dominated dbt Summit, but does smart orchestration or a context layer make data agent-ready on its own? The episode argues no. Fanatics Betting and Gaming saw about 0.2% model reuse from dbt State until it declared source freshness and model-level SLAs, which raised reuse to roughly 15%. The same pattern runs through Fivetran's Context Layer, AI audit trails and token costs.
How did an attacker using ARTEX, an open-source agentic AI penetration-testing tool, take data on more than 67,000 customers from seven South Korean firms, including Shinhan, KB Kookmin and Hana, without touching core banking? The episode argues the failure was data access design. Broker portals and employee apps returned income, loan limits and resident registration numbers to callers who did not need them, despite nearly 124 billion won in security spending.
What happens when a data platform is legally defensible, operationally embedded and publicly distrusted at the same time? More than 44,000 people have filed Article 21 objections under UK GDPR against NHS England's Palantir-powered Federated Data Platform, live in 142 trusts, weeks before a February 2027 contract break clause comes into reach. The position here: objection handling is a throughput problem, not a policy document.