Enterprising Developments

2 Measures that Should be Part of Every Data Security Effort

Joe McKendrick
Insurance Experts' Forum, July 30, 2010

Companies are spending millions to make sure their data is iron-clad safe—from multiple layers of security to network security to SQL protection to encryption to password protection. PCs get locked down, and remote kill switches are built into mobile devices and laptops.

These measures are fine, but there are two steps every insurance company should consider as part of any data protection plan. They should maintain one central, secure master copy of their information, and employ “data masking” to make the data meaningless to any malicious user.

That's the view of Mike Logan, president of Axis Technology, a provider of enterprise IT consulting and data security, on the issues around data management, who recently shared his thoughts with me on data management and security practices within the insurance industry.

Logan is bullish on the emerging best practice of master data management, which he considers to be “a very effective way to go because when you address everything there, particularly both organization and security, you set the stage for success for any upcoming uses.” He went down a list of areas where MDM will pave the way, including outsourcing, virtualization and remote access.

“Protect data assets at the source,” he admonishes. “If an insurance company wants to protect itself for the long term, safeguarding everything at the company's core is the best investment a business can make, followed by laying other tools on top.”

Logan observes that many of his company's insurance clients are now securing their database information with a process known as “data masking.” This process “removes confidential data elements and replaces them with usable, fictitious data,” he explains. “If someone hacks into a company via malicious links in e-mail, lifts data from a person’s account, or mishandles data in an outsource or networking situation, the masked data is useless to a thief because it is out of context with no way to utilize it outside of the environment.”

The threat isn't just outside thieves or hackers; production data is often sent to other parts of the enterprise, such as development shops, where it can fall outside of the control of security teams.

Encryption doesn't quite go as far as data masking in protecting data, Logan says. “Unlike masked data, encrypted information is merely a puzzle that takes a little time to decode. Also, if masked data is misplaced or stolen, it does not need to be reported, unlike encrypted data.”

By safeguarding information at the source, “insurance companies are eliminating their theft risks, saving them millions of dollars both in security measures and losses,” he says.

Joe McKendrick is an author, consultant, blogger and frequent INN contributor specializing in information technology.

Readers are encouraged to respond to Joe using the “Add Your Comments” box below. He can also be reached at joe@mckendrickresearch.com.

This blog was exclusively written for Insurance Networking News. It may not be reposted or reused without permission from Insurance Networking News.

The opinions of bloggers on www.insurancenetworking.com do not necessarily reflect those of Insurance Networking News.

Comments (0)

Be the first to comment on this post using the section below.

Add Your Comments...

Already Registered?

If you have already registered to Insurance Networking News, please use the form below to login. When completed you will immeditely be directed to post a comment.

Forgot your password?

Not Registered?

You must be registered to post a comment. Click here to register.

Blog Archive

The Good, The Bad and The Ugly Of Enterprise BI

When IT can't deliver, business users build their own applications focusing on agility, flexibility and reaction times.

The IT-Savvy 10%

IBM survey reveals best practices of IT leaders.

The Software-Defined Health Insurer: Radical But Realistic?

Can a tech startup digitally assemble the pieces of a comprehensive, employer-provided health plan?

Data Governance in Insurance Carriers

As the insurance industry moves into a more data-centric world, data governance becomes more critical for ensuring the data is consistent, reliable and usable for analysis.

Fear This

Just days before this Issue, which contains our security cover story, went to press, we got some interesting news: 1.2 billion unique usernames and passwords and 542 million email addresses were reportedly stolen from 420,000 websites, according to The New York Times. The websites ranged from Fortune 500 companies down to small online retailers.

Should You Back Up Enterprise Data to the Cloud?

Six questions that need to be asked before signing on with an outside service.