ANB, a leading firm in the Information Risk Management practices, especially the Insurance services industry and having client relationship with large number of Insurance Companies can leverage upon its tremendous experience and strong knowledge management practices to provide thought leadership in the form of a benchmarking study with respect to various information technology processes and procedures implemented by the Insurance Companies.

When the CISO at a midsize life insurance company first approached us to conduct a data leakage audit, he figured the audit would uncover a few weak spots in the company’s data leak defenses and he would then be able to leverage the audit results into funding for additional security resources.

“Data leakage is an area that doesn’t get a lot of focus until something bad happens. Your biggest hope is that when you raise concerns about data vulnerability, someone will see the value in allowing you to move forward to protect it,” the CTO also said. But they got way more than he bargained for. The three month intensive audit identified 50+ potential leaks, and revealed gaping holes in the IT team’s security practices.

The audit, conducted by ANB, examined application interfaces, outbound e-mail, FTP and Web communications. Specifically, ANB looked for violations of the insurance firm’s internal confidentiality policy, corporate information security policy, Privacy Laws, Health Insurance Portability and Accountability Act (HIPAA) and Sarbanes-Oxley regulations. The targets were leaks of general financial information, corporate plans and strategies, employee and other personal identifiable information, intellectual property and proprietary processes.

Some of the worst leaks uncovered in the audit were Confidential zip file, Confidential attachment, Clinical study shared, Sensitive spreadsheet.ANB made detailed recommendations around a two-pronged approach for the organization and asked that they revisit their business processes and technology fortification.