Information security policy | Security team

Concerned about the volume of data in its estate, and how widespread its personal and sensitive information might be across the business, our client, a global pharmaceutical company's Chief Information Security Officer (CISO), needed to know exactly what data the business had and where it was.

Finding and deploying Exonar is bringing clarity to a mature organisation that has accumulated a treasure trove of information over the years. Now able to see its data at scale, and how users are interacting with that data, this global pharmaceuticals organisation can employ the right remediation actions to secure and protect it.

"Everyone needs to know where their data is and to understand the controls around it. Exonar is solving this specific problem that everyone’s got, and that’s where the value comes in.

Exonar Reveal is compelling because it can find all the data, wherever it is. Where other products might focus on spotting breaches, Exonar Reveal helps us to take early remediation actions. I’d rather prevent a breach than only be geared up to respond to a breach. We haven’t found another provider that has the depth of Exonar’s data discovery proposition.”

Chief Information Security Officer,
Global Pharmaceutical Company

Background

The security and governance team at this global pharmaceutical company is responsible for information security policy and overseeing how its 4,500 users access and process data, to ensure it is secured and well-protected in case of a breach.

Like all organisations, our client knew it stored a lot of data within the estate but had no idea about what data they had and where it was located. The team recognised that not having this information to hand was a big problem, leaving the business unnecessarily exposed to an information security breach.

“Exonar Reveal is compelling because it can find all the data, wherever it is. Where other products might focus on spotting breaches, Exonar Reveal helps us to take early remediation actions. I’d rather prevent a breach than only be geared up to respond to a breach. We haven’t found another provider that has the depth of Exonar’s data discovery proposition.”

Chief Information Security Officer, Global Pharmaceutical Company

The Challenge

In the process of simply doing their jobs, our clients users are accessing different data sets across different systems, involving thousands of endpoints. And with remote working well-established within the company, that data is regularly being accessed outside of the office environment.

While data is viewed as a big asset to the business, it also presents a huge vulnerability if it’s not handled in the right way. Therefore, our client is cautious in how it approaches information security to ensure the data and the business is protected, while ensuring users can access what they need to get on with their jobs.

“We knew we had a tonne of data, but we needed to know where the crown jewels were, and then where all the sensitive data was to ensure security and compliance,” said the CISO. “We’d previously had a few attempts to identify and then secure that data. Those tools were ok, but we couldn’t look at all the data sources we needed to, only a subset. We needed a tool that could find everything, no matter where it’s stored.”

Exonar Reveal is a world-leading software

Exonar Reveal is a world-leading software product that ingests all of a company’s data at scale across all of its data repositories. It then enriches that data to identify sensitive information, such as PII, and builds an instantly searchable index of everything within the organisation.

This helps organizations find information at scale, so they can act to govern what’s sensitive while using what’s valuable to grow the business.

“Before Exonar I was continually concerned about any unknowns in our data. Now we have Exonar Reveal, there’s a sense of relief. We still know there’s lots of data out there, but at least we know where it all is and understand what controls we need to put around it. Exonar presents a real improvement opportunity for us when it comes to data.”

Chief Information Security Officer, Global Pharmaceutical Company

Placing a high focus on data

Rather than attempt to be all things to all people, Exonar has always focused on the specific problem that every business has – finding data. Then by integrating and empowering users of the tool to take appropriate remediation actions.

“As a business we’re very focused on data so I appreciated the high focus that Exonar Reveal places on finding it above all else. It’s a unique approach compared to anything else I’ve come across. I’d much rather have a tool that’s really good at finding data and then plug it into my own security technologies to secure that data in different ways.”

Informing data retention policy

When GDPR came into effect, it forced organisations to re-think data privacy, ensuring that personal data was kept properly secured and only retained for as long as is necessary. Through Exonar Reveal, our client gained the intelligence to enact its retention policy and to delete data with confidence.

“Through Exonar Reveal’s index we can understand what data we have and what we actually need to keep, so we can reduce our exposure. With the visibility it brings, we can use Exonar Reveal to help shape our retention policy.”

Driving awareness and education

Exonar Reveal allows users to run regular searches to identify any risky data within the estate so that remediation actions can be taken, as well as highlighting where policies aren’t being adhered to so the business can be nudged into doing the right thing.

The CISO described how Exonar Reveal can be used to find high risk data: “Exonar Reveal can help us to identify behaviours that we don’t want to see, like people sending emails containing personal or sensitive data. When we know this, we can build one-to-many training programmes that drive awareness and educate people on how to securely transfer different data sets.”

BOLDLY GOING WHERE NO-ONE HAS GONE BEFORE

Partner_1_Line_1

results_mundi

“Having Exonar Reveal to interrogate our enterprise vault was a big win for us. Previously there was no way to search it and we couldn’t find any products that could do so. It’s a treasure trove of information. Being able to see it is incredibly valuable for us,” explained the CISO.

“We’ve also found lots of stuff that just shouldn’t be there. Like an email containing an Excel file with salary data. It was password protected – but the password had been emailed separately. Exonar Reveal has enabled us to drive home the importance of security around emails and educate the business.”

The Future

Today, every company is a data company thanks to the explosion of information and data in our lives. But before you can do anything to manage the volume and complexity of that data, you first need to know what you have, where it is, and who has access to it. And as our world becomes ever more digitally complex, the task of managing data only becomes harder.

Exonar delivers world-leading data discovery software, with a unique combination of capabilities in terms of range, scale and detail of discovery that no similar technologies can match. Combined with our external API and ability to integrate with other remediation and analytics technologies, we are becoming the crucial element in our customers’ data strategy.

It enables the users of Exonar Reveal to better understand the content of the data within their estate. They can take appropriate remediation actions to delete with confidence and secure and protect the personal and sensitive data that needs retaining.

“You’re always at risk of a breach, they’re a part of life. But a breach isn’t just about data, it’s also the systems and tools you use. These are all controlled by people and processes that aren’t perfect. Millions of files can’t be remediated manually, so you have to look at how technology can support you,” said the CISO.

Based on the insights they have already gained with Exonar Reveal, our client hopes to deepen the deployment of the technology. They are continuously improving their knowledge of the data they hold, their ability to govern it, and the opportunity to extract more value from it too.

Referring to Exonar’s API and third-party integrations, the CISO commented, “Exonar has exactly the right strategy to be the best out there at data discovery and then to enable people like me to choose a range of other remediation technologies to protect the data itself in the most appropriate way.”

Our clients are also considering how to integrate Exonar with technologies that can help secure sensitive file share data. The CISO clarified: “We’ve talked about plugging into Azure Information Protection, as well as systems that can help with securing our file share data. Exonar is also used in conjunction with other discovery tools such as Office365 Compliance Centre to provide us with a rounded approach to discovery and remediation.”

Our View

Most organisations we talk to view data as either a valuable asset or a business liability. our client likes to perceive its data as both of these. But what’s really interesting about the company’s perspective is that even when data is viewed as a liability, it’s seen as an opportunity to improve.

The focus isn’t on locking down the data at source to protect against a breach – that’s not really a viable option when users need to access that data to do their jobs. The focus is on cleaning up the data estate – knowing what data is there, evaluating whether the controls around it are adequate and then taking appropriate remediation actions to delete at scale, or plug in ‘best of breed’ technologies to secure different data sets in different ways.

For more information, read our Report to find out How to Strengthen Information Security with Data Discovery