The Terra platform has a number of features to ensure the security of sensitive data accessed through the platform. Some of these features are in place automatically, while others, like authorization domains, are tools designed to give greater control over your own data. You can learn about the security features that are implemented by default by reading the steps we have taken to earn FedRAMP moderate compliance in this article. While these steps ensure a high level of security, NHLBI BioData CatalystⓇ (BDC) users should be aware that there are situations in which securing aspects of their data is their responsibility.
==================================================
When you should use authorization domains
-
Phenotype data - When importing data from Gen3 into Terra, the genotype data remains securely encrypted and access controlled. However, the phenotype data is NOT. Phenotype data, which appears in the form of metadata in a table in the Data tab, cannot be automatically secured, and is visible to anyone with access to the workspace. It is your responsibility to ensure that sensitive aspects of phenotype data can only be viewed by those you approve.
-
Derived data - The default security features cannot ensure that every manner of analysis derived within the Terra environment be encrypted, as the analyses can be highly complex, and any non-encrypted results can potentially be mined for sensitive information. If your workspace contains analyses with sensitive information derived down-stream, we urge you to secure this workspace with an authorization domain.
-
Data from multiple sources - It’s important to remember that when gathering data from disparate sources, it can be difficult to keep track of what permissions are necessary for each part. This can lead to situations where your coworkers are unable to access things you wish to share with them, unless they are also included in the appropriate authorization domain.
How to use authorization domains to ensure data privacy
The authorization domain feature works just like a security badge for accessing a laboratory. When you share access to a workspace with a coworker, it is your responsibility to make sure that this coworker is indeed supposed to have this level of access. In the case of a physical laboratory, security badges shift this responsibility to the person in charge of maintaining the list of secured collaborators. The authorization domain works in the same way - rather than having to verify each individual, you can secure the workspace behind an authorization domain, and only allow people belonging to groups within that domain access to the workspace in question.
If you share a workspace with an individual who is not part of the workspace authorization domain, they will receive a notification that the workspace has been shared with them, but they will not actually be able to access it until they are added to the authorization domain.
How to set up an authorization domain in Terra
For a more detailed description of how authorization domains are implemented and step-by-step instructions on how to set them up for yourself, please read Managing access to controlled data with Authorization Domains.