Italian Insurer Relies on Forcepoint to Protect Against Internal and External Threats While Safeguarding Employee Privacy
One of Italy’s largest private insurance companies protects sensitive financial data while adhering to employee privacy regulations
This Bologna, Italy-based insurance company must protect its sensitive customer data from internal and external threats, in the network and in the cloud, while also respecting the privacy of its employees. For a solution that fit all its complex needs, allowing it to roll out a solution that was “just right,” the company turned to Forcepoint Web DLP. Now it has data protection that complies with data security and employee privacy regulations, working in tandem with Forcepoint Web Security and Advanced Malware Detection to defend against external threats across its different business units.
- Protect data from both internal and external threats.
- Comply with both data protection and employee privacy regulations.
- Improve security for employee use of cloud-based apps.
- Turn on Forcepoint DLP to safeguard against internal data loss.
- Deploy Forcepoint AMD to protect against external threats.
- Transition to Forcepoint Web Security Hybrid implementation.
- Data loss prevention and external threat protection that’s “just right” for regulatory compliance.
This Italian insurance company is especially attuned to the need to safeguard sensitive customer information the right way. As one of Italy’s largest private insurers, the company must secure its data from internal and external threats in accordance with data protection laws and industry standards, while also following government privacy rules. The insurer is headquartered in Bologna, where it must balance the need to protect sensitive customer data with Italian employee protection laws and the city’s own strict local rules about employee privacy rights.
The company needs a data security solution that complies with the local rules for businesses in Bologna but also meets the guidelines set out by European Union regulations like GDPR. That presents the insurer with a classic Goldilocks problem—it needs data loss protection (DLP) and external threat protection that’s neither too invasive nor too hands-off, but rather “just right.”
What’s more, the company has been in a lengthy, years-long restructuring process, which has seen it consolidate its life insurance, auto insurance, and property insurance businesses. Its cybersecurity posture must be adaptive to frequently changing business circumstances, including an increasing reliance on cloud applications and services. One-size-fits-all, inflexible security products wouldn’t meet the company’s needs, so it began shopping for adaptable solutions that could keep up with the changing dynamics of its business requirements and the regulatory environment.
Getting data loss prevention “just right”
The company had to tread carefully with data loss protection. The insurer was already running Forcepoint Web Security to safeguard employee internet use and opted to turn on the DLP features in the product.
This gave the company the protection of industry-leading integrated data theft defenses and the option to detect and intercept data theft attempts. Capabilities in Forcepoint Web DLP include detection of:
- Custom-encrypted uploads
- Password file data theft
- Slow data leaks (Drip-DLP)
- Optical character recognition (OCR) of text within images
Crucially, Web DLP provided the IT team with an extensive, out-of-the-box policy library, giving admins the ability to deploy ready-made DLP policies that complied with both data protection regulations like GDPR and local employee privacy rules in Bologna and the company’s other operational locations. Forcepoint’s extensive policy library has helped the IT security team strike the right balance among all of the regulations and standards to which the company must adhere.
Taking on internal and external threats
Forcepoint Web DLP offers more than enough data security to meet the exfiltration protection requirements of financial services companies. The solution is quick to deploy and secures critical data from leaving the network via web channels, while being easy to manage on a single user interface that combines reporting, data management, and policy management.
But the company was also ready to strengthen its defenses against external threats. The company had Web Security in place as its main line of protection against threats coming from outside the company, such as malware. It decided to fortify that protection with Forcepoint Advanced Malware Detection (AMD).
Forcepoint AMD leverages market-leading technology to detect zeroday and other advanced malware. Using its Deep Content Inspection technology, Forcepoint AMD emulates an entire host, interacting with malware to expose and observe a malicious object’s possible actions. These include advanced evasion techniques, operating system- or application-specific threats, dormant code analysis, and even CPU and in-memory activity.
Continuously adapting to a cloud-driven world
In addition to the need to better address data security, the company needed to rethink its approach to cloud security. Like so many financial services companies, it was becoming more reliant on cloud applications like Office 365 and Salesforce, while employees were increasingly likely to use non-vetted cloud apps for various tasks.
Adding Forcepoint Web Security Cloud gave the ability to discover cloud applications being used within the organization and to create policies for use of those applications. But to do this, the company needed to move to the hybrid configuration, which meant adding and enabling Web Security Hybrid modules to its deployment of on-premise Web Security appliances.
This configuration allows the company to run Web Security DLP on its on-prem appliances while running AMD via the cloud. This arrangement allows it to better prevent users from jeopardizing the company’s data regardless of file format or whether data is being stored and shared via physical devices or over the cloud.
With Forcepoint’s help, the company has all the tools it needs to stay compliant while being ready for whatever tomorrow may bring.