Hortonworks acquires startup XA Secure and will bring its Hadoop access, authorization, and audit policy layer into open-source.
10 Hadoop Hardware Leaders
(Click image for larger view and slideshow.)
Hortonworks announced Thursday that it has acquired XA Secure, a 15-month-old security startup that has been developing centralized security capabilities for the Apache Hadoop stack. The deal fits Hortonworks' stated mission to turn Hadoop into an enterprise-ready, mission-critical platform.
"The introduction of YARN last October has allowed Hadoop to move from batch processing to batch, interactive, SQL, and real-time workloads, but the challenge is now centralized security administration," said Tim Hall, Hortonworks' VP of product management, in a phone interview with InformationWeek. "XA Secure simplifies and coordinates enforcement of security policies across all the engines that are available within the Hadoop ecosystem."
The terms of the deal were not disclosed, but Hall said XA Secure's 10 employees have joined Hortonworks.
There are multiple provisions and projects already in existence to ensure Hadoop security, including Kerberose authentication for access control to files in HDFS and DBA interfaces in Hive, to grant and revoke access to queries. Hortonworks has also integrated Hadoop Kerberose support with LDAP and Active Directory, but XA Secure has developed a centralized security layer that ensures a more comprehensive and holistic approach, according to Hall.
"XA Secure gives the security administrator a user interface in which to define security policies for authorization. They have also harmonized an approach for how the various components of Hadoop can plug into this policy layer for coordinated enforcement."
XA Secure policies address authentication, authorization, and auditing, and Hortonworks said it will coordinate with third-party tools to meet more specific security needs such as data encryption. The company also plans to extend XA Secure audit capabilities by integrating with Hortonwork's existing system auditing functionality.
XA Secure's security platform is a commercial product, but Hortonworks says it will donate the intellectual property to the Apache Foundation in hopes of getting it to incubator project status by the second half of 2014. In the interim, Hall says, Hortonworks will add XA Secure's software into its distribution as early as June, making it available to Hortonworks Data Platform Enterprise Plus subscribers.
Hortonworks rival Cloudera has promoted the Apache Sentry project (already in incubator status) for enhanced Hadoop security, but Hall characterized that system as "an interesting idea aimed at the wrong kind of persona.
"Today, to configure Sentry you have to fiddle with XML files, and that's not exactly something that security administrators want to figure out how to do. Today, Sentry is also primarily protecting Hive. They're trying to extend that, but they expect you to buy proprietary technology to do security."
Once XA Secure is available in open-source it will be accessible to all, but Hortonworks will support it only at the higher of its two subscription support levels, Enterprise and Enterprise Plus. Enterprise Plus covers the entire HDP distribution plus Accumulo, Storm, and soon, XA Secure.
NIST's cyber security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work? Read the Protecting Critical Infrastructure issue of InformationWeek Government today.
Doug Henschen is Executive Editor of InformationWeek, where he covers the intersection of enterprise applications with information management, business intelligence, big data and analytics. He previously served as editor in chief of Intelligent Enterprise, editor in chief of ... View Full Bio
6 Tools to Protect Big DataMost IT teams have their conventional databases covered in terms of security and business continuity. But as we enter the era of big data, Hadoop, and NoSQL, protection schemes need to evolve. In fact, big data could drive the next big security strategy shift.
Big Data Brings Big Security ProblemsWhy should big data be more difficult to secure? In a word, variety. But the business won’t wait to use it to predict customer behavior, find correlations across disparate data sources, predict fraud or financial risk, and more.
InformationWeek Must Reads Oct. 21, 2014InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.