Mundipharma’s Information Security Team uses Exonar Reveal to secure data on the inside
Concerned about the volume of data in its estate, and how widespread its personal and sensitive information might be across the business, Mundipharma’s Chief Information Security Officer (CISO), Gareth Stewart needed to know exactly what data the business had and where it was.
Finding and deploying Exonar is bringing clarity to a mature organisation that has accumulated a treasure trove of information over the years. Now able to see its data at scale, and how users are interacting with that data, Mundipharma can employ the right remediation actions to secure and protect it.
Use the links below to go directly to a specific section of the case study:
Mundipharma IT Services is a global network of independent associated companies that shares a common purpose to identify and accelerate the development of meaningful medicines, which adds value for patients and healthcare providers around the globe.
Founded in 1952 it has a presence in over 120 countries, employs over 4,500 people in Europe alone and generates revenue exceeding $2 billion.
"Everyone needs to know where their data is and to understand the controls around it. Exonar is solving this specific problem that everyone’s got, and that’s where the value comes in.
Exonar Reveal is compelling because it can find all the data, wherever it is. Where other products might focus on spotting breaches, Exonar Reveal helps us to take early remediation actions. I’d rather prevent a breach than only be geared up to respond to a breach. We haven’t found another provider that has the depth of Exonar’s data discovery proposition.”
Chief Information Security Officer, Mundipharma
The security and governance team at Mundipharma is responsible for information security policy and overseeing how its 4,500 users access and process data, to ensure it is secured and well-protected in case of a breach.
Like all organisations, Mundipharma knew it stored a lot of data within the estate but had no idea about what data they had and where it was located. The team recognised that not having this information to hand was a big problem, leaving the business unnecessarily exposed to an information security breach.
““Exonar Reveal is compelling because it can find all the data, wherever it is. Where other products might focus on spotting breaches, Exonar Reveal helps us to take early remediation actions. I’d rather prevent a breach than only be geared up to respond to a breach. We haven’t found another provider that has the depth of Exonar’s data discovery proposition.”
Gareth Stewart, Chief Information Security Officer, Mundipharma
In the process of simply doing their jobs, Mundipharma’s users are accessing different data sets across different systems, involving thousands of endpoints. And with remote working well-established within the company, that data is regularly being accessed outside of the office environment.
While data is viewed as a big asset to the business, it also presents a huge vulnerability if it’s not handled in the right way. Therefore, Mundipharma is cautious in how it approaches information security to ensure the data and the business is protected, while ensuring users can access what they need to get on with their jobs.
“We knew we had a tonne of data, but we needed to know where the crown jewels were, and then where all the sensitive data was to ensure security and compliance,” said Gareth. “We’d previously had a few attempts to identify and then secure that data. Those tools were ok, but we couldn’t look at all the data sources we needed to, only a subset. We needed a tool that could find everything, no matter where it’s stored.”
Exonar is born from the idea that every organisation faces the same challenge:
- They don’t know what information they’ve got.
- They don’t know where it’s stored.
- They can’t extract value from it.
Unless we address this problem, data becomes a liability and its true value will never be realised.
Exonar Reveal is a world-leading software
Exonar Reveal is a world-leading software product that ingests all of a company’s data at scale across all of its data repositories. It then enriches that data to identify sensitive information, such as PII, and builds an instantly searchable index of everything within the organisation.
This helps organizations find information at scale, so they can act to govern what’s sensitive while using what’s valuable to grow the business.
“Before Exonar I was continually concerned about any unknowns in our data. Now we have Exonar Reveal, there’s a sense of relief. We still know there’s lots of data out there, but at least we know where it all is and understand what controls we need to put around it. Exonar presents a real improvement opportunity for us when it comes to data.”
Gareth Stewart, Chief Information Security Officer, Mundipharma
Placing a high focus on data
Rather than attempt to be all things to all people, Exonar has always focused on the specific problem that every business has – finding data. Then by integrating and empowering users of the tool to take appropriate remediation actions.
“As a business we’re very focused on data so I appreciated the high focus that Exonar Reveal places on finding it above all else. It’s a unique approach compared to anything else I’ve come across. I’d much rather have a tool that’s really good at finding data and then plug it into my own security technologies to secure that data in different ways.”
Informing data retention policy
“Through Exonar Reveal’s index we can understand what data we have and what we actually need to keep, so we can reduce our exposure. With the visibility it brings, we can use Exonar Reveal to help shape our retention policy.”
Driving awareness and education
Gareth described how Exonar Reveal can be used to find high risk data: “Exonar Reveal can help us to identify behaviours that we don’t want to see, like people sending emails containing personal or sensitive data. When we know this, we can build one-to-many training programmes that drive awareness and educate people on how to securely transfer different data sets.”
BOLDLY GOING WHERE NO-ONE HAS GONE BEFORE
“Having Exonar Reveal to interrogate our enterprise vault was a big win for us. Previously there was no way to search it and we couldn’t find any products that could do so. It’s a treasure trove of information. Being able to see it is incredibly valuable for us,” explained Gareth.
“We’ve also found lots of stuff that just shouldn’t be there. Like an email containing an Excel file with salary data. It was password protected – but the password had been emailed separately. Exonar Reveal has enabled us to drive home the importance of security around emails and educate the business.”
Today, every company is a data company thanks to the explosion of information and data in our lives. But before you can do anything to manage the volume and complexity of that data, you first need to know what you have, where it is, and who has access to it. And as our world becomes ever more digitally complex, the task of managing data only becomes harder.
Exonar delivers world-leading data discovery software, with a unique combination of capabilities in terms of range, scale and detail of discovery that no similar technologies can match. Combined with our external API and ability to integrate with other remediation and analytics technologies, we are becoming the crucial element in our customers’ data strategy.
It enables the users of Exonar Reveal to better understand the content of the data within their estate. They can take appropriate remediation actions to delete with confidence and secure and protect the personal and sensitive data that needs retaining.
“You’re always at risk of a breach, they’re a part of life. But a breach isn’t just about data, it’s also the systems and tools you use. These are all controlled by people and processes that aren’t perfect. Millions of files can’t be remediated manually, so you have to look at how technology can support you,” said Gareth.
Based on the insights they have already gained with Exonar Reveal, Mundipharma hopes to deepen the deployment of the technology. They are continuously improving their knowledge of the data they hold, their ability to govern it, and the opportunity to extract more value from it too.
Referring to Exonar’s API and third-party integrations, Gareth commented, “Exonar has exactly the right strategy to be the best out there at data discovery and then to enable people like me to choose a range of other remediation technologies to protect the data itself in the most appropriate way.”
Mundipharma is also considering how to integrate Exonar with technologies that can help secure sensitive file share data. Gareth clarified: “We’ve talked about plugging into Azure Information Protection, as well as systems that can help with securing our file share data. Exonar is also used in conjunction with other discovery tools such as Office365 Compliance Centre to provide us with a rounded approach to discovery and remediation.”
Most organisations we talk to view data as either a valuable asset or a business liability. Mundipharma likes to perceive its data as both of these. But what’s really interesting about the company’s perspective is that even when data is viewed as a liability, it’s seen as an opportunity to improve.
The focus isn’t on locking down the data at source to protect against a breach – that’s not really a viable option when users need to access that data to do their jobs. No, the focus is on cleaning up the data estate – knowing what data is there, evaluating whether the controls around it are adequate and then taking appropriate remediation actions to delete at scale, or plug in ‘best of breed’ technologies to secure different data sets in different ways.
For more information, read our Report to find out How to Strengthen Information Security with Data Discovery