Edith Mendez
Every day, insurance companies manage vast amounts of sensitive data, including medical records, financial information, and personal identifiers—all of which are processed and stored across various services, applications, and cloud resources. The types of sensitive data that these companies collect has become more complex and nuanced, with varying requirements for protection. Strict compliance frameworks—including HIPAA in the US, GDPR in Europe, and CCPA in California—require that this information is correctly managed and secured. The sheer volume of sensitive data, fragmented storage across multiple departments, reliance on legacy systems, and involvement of third-party SaaS solutions make safeguarding this information an ongoing challenge.
Insurance companies that use Datadog to monitor their systems can use Sensitive Data Scanner (SDS) to ensure that sensitive data is not exposed in telemetry data sent to Datadog. SDS can also be used to scan cloud storage environments, such as Amazon S3 and RDS instances, to locate where sensitive data is stored so that vulnerabilities can be addressed.
In this post, we will show you how insurance organizations use SDS to:
Insurance companies often store and process sensitive data across a diverse ecosystem that includes customer relationship management (CRM) systems, claims management systems (CMS), underwriting software, risk assessment solutions, health information systems, and document management tools. When using Datadog to monitor these services and resources, sensitive data can inadvertently be sent along with telemetry data.
For example, let’s say you work at a healthcare insurance organization that uses a CMS to collect patient information, including protected health information (PHI) such as social security numbers, email addresses, and medical histories. When using Datadog, if this sensitive data is exposed in the logs, APM spans, or RUM events sent to the plaform, it could negatively affect your security and compliance posture. Using SDS, you can obfuscate this data so that it is not exposed in Datadog.
SDS enables you to create scanning groups to define exactly what data you want to scan and from which services, environments, and applications. Once you set up your scanning groups, SDS will help ensure that any sensitive data you send to Datadog from these sources is obfuscated.
SDS comes with preconfigured and custom rules that make it easy to classify sensitive data based on popular data types and compliance standards. You can then define the action you want to take when those rules detect sensitive data—whether it be to hash, redact, or partially redact.
Teams may want to configure custom scanning rules for unique types of sensitive data such as insurance claim IDs, which have a structure that can vary among organizations. Custom scanning rules are simple to configure using regex patterns, with optional tagging for easy identification.
Once your rules are defined, SDS organizes the results by data type and priority, making it easy to understand, contextualize, and track your sensitive data posture within a single view in the Datadog platform.
Some organizations in highly regulated industries (like insurance) or in specific geographic regions may be required to ensure that certain types of sensitive information do not leave their environment at all. In cases like these, you can use Observability Pipelines to redact sensitive data before it leaves your environment. Observability Pipelines is an on-premises logs pipeline that aggregates, processes, and routes logs from various sources to destinations of your choice.
With Observability Pipelines and SDS, you can easily configure scanning rules for your data stream before sending it to third-party solutions (like Datadog). Though the pipelines reside in your environment, you can easily design, deploy, and manage them within Datadog.
Insurance companies also need to know where sensitive data resides throughout their cloud environments. Sensitive data is often stored in isolated “data silos” within different departments—such as underwriting, claims, and customer service—and across multiple systems. As organizations grow and scale across the cloud, it becomes increasingly challenging to keep track of where these documents are stored and whether that environment is properly safeguarded. This fragmented structure, paired with the massive volumes of sensitive data from various sources—including customers, healthcare providers, financial institutions, and third-party vendors—makes it difficult for insurance companies to gain a comprehensive, real-time view of their data risks and vulnerabilities.
For example, let’s say you work at a dental insurance company that uses a document management system to store contracts, policies, quotes, and other customer data. You may use a cloud storage environment or repository, such as an S3 bucket, to store these documents. However, you may have little control over the content of the uploaded documents, many of which could contain sensitive data. Using a backend, manual process to keep track of this data can be error-prone and burdensome.
With Sensitive Data Scanner for Cloud Storage, you can eliminate blind spots by automatically identifying sensitive data in cloud repositories like S3 buckets and RDS instances, even as new resources are created. SDS for Cloud Storage conducts regularly scheduled scans to flag buckets that contain documents with sensitive information and provides a detailed breakdown of the data types that match predefined rules. By easily locating sensitive data, categorizing it, and assessing potential security risks, SDS helps you efficiently identify sensitive data vulnerabilities in the cloud and informs your remediation strategies.
Once teams have determined the whereabouts of sensitive data in the cloud, they must take appropriate action to remediate vulnerabilities and exposure. Insurance companies may store hundreds of documents across multiple cloud environments, making it more difficult to understand and prioritize vulnerable files. For example, many insurance organizations need to store documents related to their customers’ insurance claims, which may contain health-related or other sensitive information. While some of these claims may be stored in an appropriately secure environment, others may be held in misconfigured or publicly accessible S3 buckets.
To triage and remediate these issues, SDS users can easily pivot to Cloud Security to understand security posture, identify any potential vulnerabilities for the S3 bucket, and ensure that the right teams are notified about any security issues.
Teams can jump to the organization’s AWS console by selecting “Fix in AWS.” From there, you can understand how the resource is configured, update management policies, and view or redact sensitive data findings.
Correlating sensitive data issues with at-risk cloud resources provides context about potential vulnerabilities across the cloud, leading to faster, more informed remediation processes.
For insurance companies, centralizing data security and compliance protocols is an essential but often difficult task. To mitigate risk and help comply with regulations, insurance companies using Datadog can use SDS to simplify the discovery, classification, and management of sensitive data across their telemetry data and cloud storage environments.
To begin using SDS, navigate to the Security tab in the Datadog application and select “Sensitive Data Scanner.” You can also sign up for Sensitive Data Scanner for Cloud Storage, which is now in Limited Availability for AWS cloud environments. To join, you must have SDS enabled and Amazon S3 buckets and/or RDS instances in your cloud environment.
To learn more about SDS, see our documentation. If you don’t already have a Datadog account, you can sign up for a free 14-day trial today.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。