These measures are fine, but there are two steps every insurance company should consider as part of any data protection plan. They should maintain one central, secure master copy of their information, and employ “data masking” to make the data meaningless to any malicious user.
That's the view of Mike Logan, president of Axis Technology, a provider of enterprise IT consulting and data security, on the issues around data management, who recently shared his thoughts with me on data management and security practices within the insurance industry.
Logan is bullish on the emerging best practice of master data management, which he considers to be “a very effective way to go because when you address everything there, particularly both organization and security, you set the stage for success for any upcoming uses.” He went down a list of areas where MDM will pave the way, including outsourcing, virtualization and remote access.
“Protect data assets at the source,” he admonishes. “If an insurance company wants to protect itself for the long term, safeguarding everything at the company's core is the best investment a business can make, followed by laying other tools on top.”
Logan observes that many of his company's insurance clients are now securing their database information with a process known as “data masking.” This process “removes confidential data elements and replaces them with usable, fictitious data,” he explains. “If someone hacks into a company via malicious links in e-mail, lifts data from a person’s account, or mishandles data in an outsource or networking situation, the masked data is useless to a thief because it is out of context with no way to utilize it outside of the environment.”
The threat isn't just outside thieves or hackers; production data is often sent to other parts of the enterprise, such as development shops, where it can fall outside of the control of security teams.
Encryption doesn't quite go as far as data masking in protecting data, Logan says. “Unlike masked data, encrypted information is merely a puzzle that takes a little time to decode. Also, if masked data is misplaced or stolen, it does not need to be reported, unlike encrypted data.”
By safeguarding information at the source, “insurance companies are eliminating their theft risks, saving them millions of dollars both in security measures and losses,” he says.
Visit InsuranceNetworking.com to comment.
Joe McKendrick is an independent consultant, author, blogger and frequent contributor to Insurance Networking News specializing in information technology. He can be reached at joe@mckendrickresearch.com.
Be the first to comment on this post using the section below.