Fortune 500 insurance company automates Discovery and Classification of sensitive data

Download

This Fortune 500 property & casualty (P&C) insurance company had made significant investments in multiple data privacy and security solutions to be able to properly manage, protect, and leverage its vast portfolio of property, casualty, and other holdings. However, without a fully autonomous sensitive data discovery and classification engine, they were concerned that incomplete and inaccurate data was not only diminishing the efficacy of the tools they were using, but also that the existence of dark data was leaving them vulnerable.

case study
  • Automated discovery & classification of sensitive data with integration into existing DLP and GRC solutions to consolidate and fortify master catalog of personal sensitive data.
  • The initial proof of concept (POC) was designed, deployed, and completed within 30 days.
  • Comforte SecurDPS Discover & Classify is now client`s primary discovery and classification solution.

Property & casualty (P&C) insurers have unique needs that require robust, fully automated data discovery and classification capabilities:

  • Data Consolidation: Mergers and acquisitions result in disparate data sets coming together under a single corporate structure. Locating all personally identifiable information (PII) across all repositories and properly classifying discovered data is imperative to data consolidation efforts.
  • Discovery of Unstructured Data: PII can exist in assets as structured, semi-structured, or unstructured data. Successful governance depends on being able to identify, tag, and protect all data, no matter what form it takes. This can be especially challenging in the case of unstructured PII that is captured and recorded informally.
  • Data Segmentation: Large carriers may have multiple subsidiaries operating under a single corporate umbrella. Segmentation is essential to privacy, security, and compliance, so P&C insurers need accurate data discovery and classification with clear business context to ensure no data is residing on networks or in repositories that are not owned by the given subsidiary

To properly manage, protect, and leverage its vast portfolio of property, casualty, and other holdings, the client had made significant investments in several data privacy and security solutions. However, without a fully autonomous sensitive data discovery and classification engine to drive the optimal performance of these various solutions, the client was very concerned that incomplete and inaccurate data was not only diminishing the efficacy of the tools they were using but also that the existence of dark data was leaving them vulnerable.

Efficiency and accuracy around data discovery and classification solution were significant pain points: The client had been relying on an incumbent solution for data discovery and classification. The highly manual and static regex process utilized by the incumbent technology limited discovery to the repositories identified by the client. And the minimal ability to add business context to discovered data left company personnel with an immense, time-consuming, and tedious task of manually classifying and tagging discovered data.

Beyond automated discovery and classification, integration with the Microsoft 365 E5 suite and a number of other security and compliance solutions the client had invested in was essential. No company is fond of throwing good money after bad, and this client was rightfully concerned that the incumbent solution was not allowing them to realize a return on the investments they had made. Demonstrating comforte’s API-first approach to connect to other providers’ solutions – including Proofpoint, Microsoft 365, OnSpring, CyberArk, Alation, and Cortex XDR, among others – supplied incontrovertible evidence that relying on SecurDPS Discover & Classify as the engine to power the privacy and security tools the client had already deployed was an essential and obvious business decision.

No enterprises, especially those in the highly regulated property and casualty insurance industry, can risk remaining blind to dark data. The client understood that “unknown unknowns” represented a huge vulnerability, and through the initial project, they saw that SecurDPS Discover & Classify could greatly minimize their exposure.

Aside from the general needs of the industry outlined above, this client had specific use cases in mind to test the efficacy of the comforte SecurDPS Discover & Classify solution.

  • Automated Data Discovery: Demonstrate comforte’s superiority over the incumbent technology’s static, regex pattern scan approach by applying comforte’s automated discovery of structured, semistructured, and unstructured data both in cloud and on-premise repositories.
  • Microsoft Office 365 E5 Integration: Augment the security and compliance solutions that comprise the Microsoft E5 license application suite.
  • DLP, Privacy, Governance Catalyst: Leverage and enhance existing investments the client has already made in governance, risk management, and compliance (GRC) as well as data loss prevention (DLP) solutions, including OnSpring, CyberArk, Alation, and Cortex XDR. Elevate the value of existing solutions through deeper discovery of “unknown unknowns” and more effective classification of all data. Through integration, SecurDPS Discover & Classify allows for the tagging of files in the E5 DLP solution. This allows companies to enforce policies.
  • SecurDPS’s continuous and comprehensive search for unknown sensitive data in non-targeted repositories has increased the customers’ confidence after discovering a significant amount of dark data, so they can better assess and mitigate risks.
  • The automation that powers SecurDPS data discovery and classification frees up client resources to undertake highervalue data activities, so they can focus on growth rather than regulation.
  • Continuous discovery by comforte SecurDPS Discover & Classify ensures the application of global data privacy, governance, and security policies across structured and unstructured data residing anywhere on corporate networks.
  • Based on its innovative and unique RDA (single source of truth) approach, SecurDPS Discover & Classify massively reduces false positives, enhances accuracy, and creates an overall reduction in manual efforts for discovery and classification.