An injury that doesn’t happen needs no treatment. An emergency that doesn’t occur requires no response. An illness that doesn’t develop demands no remedy. The best way to stay safe … is to avoid getting into trouble in the first place. That requires planning, training, leadership, good judgment, and accepting responsibility—in short, risk management.  

– Boy Scout Field Book

Insurance companies are the experts at analyzing and managing risk. They identify, quantify and set pricing based on the calculated costs of risk. Naturally, the higher the perceived risk, the higher the cost to mitigate the potential losses.

Yet here is the irony.  While those in the insurance industry excel at evaluating risk management for their clients, they often neglect risk mitigation within their own operation.

Exposed data is serious risk

The insurance industry collects and analyzes overwhelming amounts of data. This often sensitive and confidential information becomes the basis upon which many critical decisions are made, and which produces the competitive advantage to provide better policies, prices, and solutions to the market.

All of this data, both historical and cutting-edge, is truly the lifeblood of the insurance industry. Therefore, the astute management and protection of this data is the infrastructure of arteries and veins delivering this lifeblood to all of the appendages of the company that need the results of this data compilation.

In addition, this sensitive and private information is disseminated to various internal and external associates, customers, partners and collaborators usually via the Internet, which exposes this data to compromise.

And yet, despite their expertise in risk analysis, many in the insurance industry fail to ask these questions:

• Given how much data we’re exchanging with clients, partners, financial institutions, healthcare organizations, etc., what is our risk of a data breach?
• What is our liability if we suffer a data breach?
• What can be done to mitigate potential losses?

When examined this way, any underwriter would agree that failure to adequately protect the sensitive data continually in transit in an insurance company’s daily workflow presents an extremely high risk.

Insurance industry, heal thyself

If data really is the lifeblood of the insurance business, and the data center is at the heart of the company, then the arteries and veins are the methods of moving that data to and from your departments, clients, business partners, and others.

While adding layers of physical security to the data center is a top priority for insurance IT professionals, securing the pathways in and out of that data center tends to be overlooked, despite media coverage of data breaches at companies worldwide.   This lack of action underestimates the extent of the public’s concern that their private data may be compromised, and state and federal efforts to more strictly regulate data storage and transfer policies.

Effectively managing FTP transactions is essential to mitigating the risks of data loss.  The costs of implementing managed file transfer solutions are minimal and provide tremendous flexibility when striving to meet the requirements of trading partners and compliance regulations.

As the insurance industry knows better than anyone, the best approach is to mitigate risk with a cost efficient solution.  In this case, taking direct action to protect data transfers is the obvious prescription for any organization — especially one based on risk management.

It happens in your office every day:  someone on your team hits a roadblock when they realize that email just won’t handle the huge file they need to send – immediately. Or another coworker starts to send an account number or password via email and realizes that perhaps, email isn’t all that secure.

That’s when the tech savvy gal in the corner suggests the obvious solution: just send that file or sensitive personal information via FTP!  She lists a variety of “free” tools that can be downloaded easily, as well as a couple cloud solutions, and in desperation (and often ignorance), your coworker takes her advice and a new FTPer is born.

FTP, or “file transfer protocol,” is a solution that’s been available for more than 30 years.  Within the last decade, so many free or inexpensive FTP tools have become available that many of us assume that FTP must be a reliable solution, or why would so many people be using it?

As we know with many of society’s ills, just because something is easy to find and popular to use doesn’t mean it’s a smart or effective idea.

The downside of FTP

While FTP may be able to send large files, standard FTP – like email — is not secure, and is therefore vulnerable to hackers.

Rogue FTP tools, like those free tools sprinkled on employees’ PCs, start to become a liability to the company, both financially and to its reputation and credibility.

To begin with, multiple employees with multiple FTP tools mean that no one has a master view of the flow of data in and out of your company. It’s impossible to know who is sending what to whom, and who is receiving files from where.

State and Federal laws require that data which contains personally identifiable information must be encrypted and secured. This also applies to most of the financial data that we collect and create. How can you keep tabs on all of this with a lot of FTP processes running on various PCs throughout the office?

Second, because FTP is not secure, the company increases its risk for a data breach.  Costs to notify those affected when a data breach occurs, combined with the fines that can be assessed, can be in the millions of dollars, not to mention the damage to the company’s brand.

If not FTP, then what?

One approach to control FTP traffic is to set up restrictions on the corporate firewall, essentially prohibiting access for all but specifically authorized personnel to the ports required for FTP processes to work.

Chances are, though, that the same tech savvy employee who suggested FTP in the first place also knows how to bypass this restriction by finding different ports or switching to online FTP services. For determined FTPers, even our cell phones are equipped to send and receive files.

So, if it’s hard to stop it, the next best option is to educate your employees, and to develop and promote clear expectations and consequences regarding sending files and sensitive data from work. Many employees want to do the right thing, but don’t understand the implications of sending sensitive data through the easiest – though not necessarily the safest – means.

Another option that is rapidly growing in popularity is the implementation of a managed FTP solution that can be configured to allow users to send and receive large files  and sensitive information within their daily workflow, but with the addition of administrative control and much greater security.

A managed file transfer solution such as Linoma Software’s GoAnywhere Suite, in combination with setting up appropriate firewall rules and educating all employees of corporate policy and procedures,  will keep your employees – tech savvy or not – productive and happy, and give your IT department peace of mind knowing that the company data is secure.

Many Americans have spent the last few days frantically searching for receipts and other documentation to finish their taxes before Tuesday, April 17.  No doubt some of those people thought they knew exactly where to find what they needed, and were dismayed to discover that their confidence — as well as their data — had been misplaced.

How about your confidence regarding your organization’s sensitive data? As managers, are you aware of all of the transactions going in and out of the company network? Who is sending and pulling files, and why? What’s the best way to manage all of these data exchanges? Isn’t there a more user-friendly solution than prohibiting all FTP communications except from specified computers or user profiles?

Efficient workflow requires efficient data flow

No doubt data security is critical.  So is the ability to exchange information to accomplish daily business goals.  Almost every department needs to exchange files with trading partners, customers, vendors, remote employees, and more.

Here are just a few examples of data your company may be exchanging every day:

Finance/Accounting/HR

• Tax documents
• Annual, quarterly monthly reports to shareholders, investors, banks, financial partners
• Personnel reporting

Marketing/Sales

• Art files to/from artists, printers, marketing partners
• Video and other content for web, publishers, printers
• PDF brochures, proposals, whitepapers to prospects, partners, customers

Information Technologies

• Data files to/from system integration partners
• Database exchanges with business networks
• System updates
• EDI file transaction exchanges
• Update to HA and offsite systems

Customer Service

• Customer update documents
• Client reporting documents
• Receipt of supporting documents

Production/Warehousing

• Supplier data exchange
• Customer data exchange
• Inventory reporting

Research & Development

• Product specifications to/from manufacturing partners
• Large CAD/engineering data to/from development partners

How do you control the data flow?

Educate your employees

Each organization has developed rules and codes of conduct to maintain productivity, positive morale, and customer confidence.  Ideally, these policies are documented and part of employee training. It’s imperative that the rules governing data management are also included in the documented policies, and all employees regardless of their roles need to demonstrate their understanding of the data management policies. Clear directives regarding management’s expectations is the first line of defense against data breach.

Implement the appropriate technology solution

The right technology tools can also be a valuable part of the data control approach.  Most data exchanges can be performed through secure email, FTP and network communications. A combined implementation of firewall and managed FTP solutions will help secure and distribute the resource requirements as appropriate for every department’s needs.

Firewalls not only protect the company network from outside intruders, but can also help manage internal traffic.  A managed file transfer (MFT) system allows specific types of transfers based on users’ permissions or specified events so the inbound/outbound flow of data can be better managed and monitored. With an MFT system, audit logs are automatically kept of each data exchange, and files and emails can be encrypted and secured to ease worries that they might be sent to the wrong people.

The bottom line

Given the multitude of data files that need to be moved in and out of your organization, and the need to create efficient workflows that allow employees to do their jobs while maintaining strict vigilance about data security, few facets of your business are more important than controlling your data flow.  Getting information in the right hands and keeping sensitive data shielded from non-authorized access is an ongoing challenge, but education and the right tools are the keys to success.

If you’re doing business and collecting payments via credit card, debit card, or other e-commerce options that allow you to store and/or transmit cardholder data, you are subject to PCI DSS compliance regulations.

In an attempt to reduce credit card fraud, the Payment Card Industry Security Standards Council developed an information security standard for those with access to consumers’ transactions and card numbers.  This standard continues to evolve, and is now labeled PCI DSS 2.0.  While the compliance verification process isn’t formal for all organizations, they all must meet the standard to manage liability in case of credit card fraud.

Linoma Software has published a new white paper entitled PCI DSS Compliance with Managed File Transfer that reviews the requirements for PCI DSS 2.0, and explains what role implementing a managed file transfer solution can have in meeting several aspects of the regulations, especially the protection of cardholder data. Download the white paper now, and review other resources available at GoAnywhereMFT.com.

During the past few years, the media has highlighted a variety of examples of the loss of private information by large companies either by theft or misuse.

One of the reasons for the increased media attention is the renewed focus on establishing and enforcing data breach notification laws which apply to companies that own, lease or store private, personally identifiable information. If that data is exposed to unauthorized use either by accident, cyber attack, employee misconduct, or other causes, most states require companies responsible for protecting that data to announce the data breach and individually notify everyone affected. Some states require that credit agencies are also notified.

For clarification, private data means any information that can be used to identify an individual, including sensitive information such as a credit card number, social security number, or health related data.

There are a few exceptions to having to report the data breach. If the compromised files were encrypted while in transit across the Internet or stored on stolen backup tapes, for example, it is unlikely that the files could be unencrypted, so the individuals’ privacy isn’t as likely to be compromised.

A company that finds itself dealing with a data breach learns quickly that the process is not just embarrassing and costly (sending notifications, providing free credit reports, etc.), it can also damage the company’s hard-earned reputation resulting in the loss of customers. The point is that companies are responsible – and legally liable — for the information that is in their hands.

Securing File Transfers

Most companies use FTP (file transfer protocol) to send data files back and forth to their trading partners, vendors, remote employees, etc. Most often, FTP is used to send files that are too large to email.

However, file transfers like these are captured and compromised by data thieves on the Internet every day — unless security procedures have been put into place to safeguard the files’ data.

Companies need to implement procedures that secure both an in-motion process (files in transit over the Internet) and an at-rest process (files stored on servers or backup tapes). SFTP and FTPS protocols both secure the file while in motion by encrypting the communication link between two systems during the file transfer. PGP encrypts the file itself, protecting it while at rest on the server or backup tapes.

When addressing the challenge of sending ad-hoc files that are too big to email, finding a managed file transfer solution that includes a secure mail feature can mean the difference between an accidental data breach and a successfully delivered file.

Implementing these security procedures is a significant step organizations can take to greatly reduce their risk of data breach, and therefore their exposure to the financial liability and the loss of confidence of their customers and trading partners.