Securing New England Federal Credit Union’s members PII

What NECFU lacked was enterprise wide visibility and granularity into sensitive, regulated data movement; NECFU could not determine exactly what data was received by whom. Michael Stridsberg, Information Security Program Manager, says: “In security, you are always concerned about what’s coming in to your organization,” he notes. “What we wanted to know here at New England Federal Credit Union was what data was going out – a 180 degree change from the typical security approach.”

Critical Success Factors

• Improve visibility into data sharing with vendors, partners and service providers 
• Classify data quickly and accurately
• Rapid deployment, low overhead
• Enforce appropriate use of data by users with varying privileges
• Maintain client trust

The Solution 

NEFCU selected Fortra's Digital Guardian® (DG) Network DLP for its simplicity, cost effectiveness and completeness of functionality in its architecture, which Stridsberg calls “elegant.” Digital Guardian began looking for a way to determine what data was being exchanged as well as any patterns of use. For the first three months, the NEFCU simply monitored the network. From detailed analysis provided by the Network DLP, Stridsberg and his team saw clear data usage patterns. While some matched the expectations of the infosec team, they also learned of other patterns they needed to address. During that period, they continued to build and refine their data security policies around their business rules, creating a system in which false positives are basically non-existent. They were also able to integrate protections to get visibility into web traffic. 

Digital Guardian Network DLP installation took only a few hours and requires minimal ongoing maintenance, this meant no additional staff and low TCO. “Once Digital Guardian Network DLP was installed, visibility into our network traffic was significantly improved,” said Stridsberg. “We could see exactly what data was being transmitted and where. Today I can’t imagine doing security work without it.”

The Results 

Today, they feel confident that their business rules and automatic blocking, encrypting and rerouting of data are accurate. Additionally, NEFCU has created a white list of vendors with whom they share information. Utilizing DG Network DLP, they have set-up different security controls to determine what data each vendor is able to receive.