Great Eastern Assurance

Great Eastern Assurance replaced script-based data masking with PKWARE. The account from its IT manager is specific about why: running scripts meant handling validations and access grants separately, with governance sitting outside the tool doing the work. Automated discovery, classification and custom masking put those controls in one place, and the insurer reports its data security improved by 25 to 50 percent.

Background

This case study of Great Eastern Assurance is based on a December 2020 survey of PKWARE customers by TechValidate, a third-party research service.

The findings here come from a third-party survey rather than from PKWARE, which is worth holding in mind when reading the percentages. TechValidate collected them directly from the customer in December 2020, so they record what the organization itself observed after deployment rather than a vendor projection.

Challenges

The cybersecurity needs that most influenced their decision to use PKWARE solutions:

• Automation
• Data tracking (discovery/classification)
• Unauthorized files sharing or theft
• Custom data masking

The compliance measures that most influenced their decision to use PKWARE solutions:

• GDPR

Script-based masking fails in a particular way. Each script is correct when it is written and drifts as the data changes, and the person who understands it becomes a dependency. Validations and access grants are then managed apart from the masking itself, so the governance record and the actual behaviour can diverge with nothing to signal it. Coupling governance to the tool removes that gap.

Our Approach

With the help of PKWARE, this customer Improved the efficiency of both a business process and protection of PI/PII.

Download PDF

Script-based masking has been very challenging in terms of running scripts, validations and access grants to the stakeholders. With PKWARE, there is no risk as the governance process is tightly coupled with the tool. Kanganalapatti Janarthanan Jayanthi, IT Manager

Use Cases

Great Eastern Assurance uses PKWARE to protect the following data types:

• Personal data (SSNs, race, religion, minors, etc.)
• Confidential files

They protect the data uncovered by PKWARE’s data discovery using:

• Masking (redaction, de-identification, etc.)

They use PKWARE functionality for data security with these additional use cases:

• DLP enhancement
• Moving data to the cloud
• Data protection (masking or encryption)
• Reporting on file contents and activity
• Data classification

The data types listed here carry different obligations. Personal data covering race and religion is special category data under GDPR, which sets a higher bar for justification and retention than an ordinary customer record. An insurer in Singapore serving customers with European ties therefore answers to a local regime and to GDPR at once, and classification is what makes it possible to apply the stricter rule only where it is owed.

Results

• The immediate benefits they experienced following the deployment of PKWARE:
  • Located and classified sensitive data
  • Met audit and compliance requirements
  • Improved the efficiency of a business process
  • Improved protection of PI/PII
  • Satisfied customer and/or board mandates
  • Increased their data security by 25 – 50% since implementing PKWARE technology
  • Saved up to 25% of time by moving from manually applied protection to PKWARE’s automated discovery and protection solution

The two percentages measure different things and both matter. An increase of 25 to 50 percent in data security reflects coverage, meaning sensitive data that was previously unlocated is now found and protected. Up to 25 percent of time saved reflects effort, and that time was spent applying protection by hand, which is the same manual work that produced the inconsistency the IT manager describes.