848 Enhances Data Security and Governance for a Global Biopharmaceutical Company.
Key Facts.
Industry sector
Biopharmaceutical
Size
6000 users
Solution
Improved Data Security
Overview.
-
The client was facing critical data leaks due to issues with data governance, lacking controls over data access, transfer, and security, both internally and externally.
-
848’s Microsoft Certified Consultants, worked with the client’s IT and Data Security teams to overhaul data security and governance, focusing on data classification, data loss prevention, policy management, and leveraging Microsoft E5 compliance licenses.
-
The team developed a Zero Trust environment, deployed sensitivity labels and DLP policies, and introduced a custom DLP incident reporting system for monitoring and prevention of data misuse.
-
The company achieved enhanced data protection with advanced endpoint security, better control over data access and sharing, and a significant reduction in the risk of data leaks, leading to improved data governance.
Background.
The client is a large biopharmaceutical company with a mission to improve patients’ lives through innovative and transformative medicines. The client focuses on therapeutic areas producing and commercialising medicines for people living with unmet medical needs on a global scale.
The Challenge.
The company faced significant challenges with data leaks and insufficient data governance. They lacked knowledge of the data they possessed, and there were no adequate controls over data management, including its transfer, access, and security, both internally and externally. A notable concern was the misuse of sensitive data, including unauthorised printing, exporting to USB devices, and transmission of sensitive information without appropriate protection.
The Solution.
The 848 team collaborated with the client’s IT and Data Security teams to enhance data security and governance. This process involved:
• Assessment: Conducting a thorough assessment of data, processes, and user security to identify gaps, leaks, and vulnerabilities.
• Data Classification and Policy Management: Implementing a unified approach for data classification, policy management, analytics, and APIs.
• Utilising Microsoft E5 Compliance Licenses: Maximising the benefits of existing Microsoft E5 compliance licenses through an in-depth assessment of their existing Microsoft 365 environment.
• Developing a Zero Trust Environment: Using Microsoft’s Data Governance Model, the focus was understanding and classifying data, encryption, access restriction, data loss prevention, and governance through policies, automation, compliance procedures, and user training.
• Deployment of Sensitivity Labels and DLP Policies: Implementing sensitivity labels for critical data protection and onboarding all Windows devices onto Microsoft Purview Data Loss Protection (DLP) for Endpoint. This included the creation of DLP policies for internal and external data process assessment and protection.
• Custom Vulnerability Reporting System: Establishing a system to capture and alert about data misuse and high-risk events, preventing actions in near real-time.
The Result.
As a result of the collaboration with the 848 Group, the biopharmaceutical company has significantly enhanced its understanding and management of data security. They now have a deeper understanding of their data types and have implemented robust measures to protect against unauthorised access and sharing.
The integration of advanced endpoint protection and Data Loss Prevention (DLP) policies further fortifies their defence against data breaches. The newly established vulnerability reporting system enables weekly monitoring and rapid response to potential data security incidents, significantly reducing the risk of data leaks and enhancing overall data governance.
The 848 Methodology in Action.
Plan.
Assess data security gaps and design a Zero Trust security solution utilising Microsoft E5 compliance licenses DLP strategies.
Build.
Implement Zero Trust environment, deploy DLP policies and sensitivity labels, set up a vulnerability reporting system.
Run.
Monitor and manage data security measures, continuously improve based on feedback and performance analysis.