Challenges: Gaining Data Visibility to Prevent Data Loss
Data is the lifeblood of the financial services industry. Sensitive personal information, including non-public information (NPI), and account-specific data are among the most valuable assets held by banks, insurance companies, mortgage lenders and other institutions and businesses.
To ensure its data was secured and to enhance its Data Loss Prevention (DLP) program, a leading financial services company needed to gain more visibility into its key data assets. Specifically, the company needed to know answers to these key questions:
- Where confidential data is stored?
- Where and how confidential data is shared across and outside the organization?
- What are current vulnerabilities for data loss?
- What is the business case for expanded DLP capabilities?
Previously, the company used several standalone products to protect its data from loss, including packages for encryption, malware protection, content and URL filtering.
Further, it had inconsistent processes for managing NPI. Seeking a holistic and best practices-based approach to DLP, the company engaged Infinitive Insight to assess its current methods and to design and implement program improvements.
Solution: Focused & Prioritized Action Plan for Automation & Standardization
The Infinitive Insight team worked with the Chief Information Security Officer and a cross-functional team including the CIO, CPO and representatives from IT, HR, Legal and Audit. Infinitive Insight experts began by assessing current DLP capabilities, including specific capabilities for:
- Locating exposed confidential data and automatically enforcing policies to protect sensitive files.
- Reviewing policies for NPI, sensitive and confidential data in motion and DLP across multiple network protocols including email, Web mail, Web postings and file transfers.
- Detecting and monitoring DLP across all content – including structured and unstructured data – and individuals and user groups enabling a focus on potentially high-priority incidents.
With clear insight into current exposures, the cross-functional project team identified several immediate action steps, including:
- Strengthening DLP controls (especially outbound email controls)
- Synchronizing and standardizing usage of DLP tools
- Defining a more detailed and stringent change management process
For example, full automation of policy enforcement bolstered processes for remediation, notification and prevention.
Other key action steps included secure messaging integration, enhanced encryption visibility and control, and safeguards for employee privacy during incident investigation and response. Because the assessment clarified that many of the data loss incidents were unintentional, the recommended action plan also incorporated significant end-user training.
Results: Elimination of Leakage, Stronger Controls & Increased Staff Awareness
As a result of the immediate action steps, the company is now meeting its objective of gaining clear visibility into key data assets — including data at rest and data in motion. It can now see where data is, how and where it moves and who accesses it.
Details of specifics values the company has gained from Infinitive Insight’s DLP expertise include:
- Existing gaps were secured and controls strengthened, thereby reducing overall exposure to data leakage incidents.
- Automated alerts to the information security department now protect sensitive data shared via email by customers.
- The comprehensive solution addresses multiple types of data and storage media, such as USB flash drives and CDs.
- The company now has complete documentation of how DLP works, which components are operational and what policies are being enforced.
- An in-depth training program for IT and business staff has strengthened information security across the enterprise.
Infinitive assumed responsibility for the day-to-day DLP operations as a managed service, achieved contracted service levels and delivered a reliable production operation. The company has achieved clarity into and control of the DLP function throughout the enterprise.