Ensuring Your File Sharing Solution is Secure and Compliant

Transcription

1 Ensuring Your File Sharing Solution is Secure and Compliant Hosts: Josh Bopp Rebekah Stevens Paisley Coxsey President Account Manager Relationship Manager focusit focusit focusit Presenter: Kevin Slaby Independent IT Security Consultant

2 Compliance Now Includes Ensuring Borrow Data, in all Forms, is Secure Today s mortgage environment is vastly different than when most file sharing solutions were initially implemented Keeping client data safe is now core to every mortgage operation Showing how files are shared with outside parties is now a key step in compliance audits

3 Mortgage Professionals Way of Thinking and Handling Borrower Files Must Change The four most common methods of sharing files each possess significant security and regulatory compliance problems FTP USB Drives BYOD (Bring-your-own-device)

4 Method 1: The Evolution of has assumed the role of being the primary data and file transport system for most enterprises attachments have grown

5 Method 1: Current Methods IT Personnel Utilize to Police are Ineffectual Quotas on the size of mailboxes Limitations on the size of the attachments that can be sent through and restricted by firewalls Use of personal Webmail accounts and other means

6 Method 1: There are Better Solutions to the Problem: File transfer should be regarded as a core business process Use a solution so that business users can send files more efficiently

7 Method 1: Encryption Alone Isn t a Complete Solution While encryption is a solution for sending attachments securely, it still utilizes and the disadvantages we have discussed Many organizations, including financial institutions, do not allow users to open secure file attachments

8 Method 2: File Transfer Protocol FTP Solves Some Problems Cannot, But Not All Tracking is difficult Auditing is incomplete Access controls do not meet all business requirements

9 Method 2: File Transfer Protocol Additional Issues FTP Presents Is not natively encrypted Is not standards-based for safeguarding customer information (GLBA concerns) End users find it difficult to use

10 Method 3: USB Drives & CDs Physical Media Solves FTP Security Issues, But Creates Its Own Challenges Data delivery delays as it relies on overnight physical delivery Expensive Susceptible to data loss

11 Method 4: Bring Your Own Device Solves Mobility and File Sharing but Creates Compliance and Data Leakage Issues Are there file access audit trails? Is borrower data retained according to GLBA requirements? Is corporate IT alerted if data is compromised? Which company files are in employees Dropbox folders? What to do when employees suddenly leave with company files in their Dropbox folder?

12 The New Priority #1: Security Today s Mortgage Environment Leaves Zero Tolerance Relative to Security Lapses Safeguarding borrower data is paramount to every mortgage operation Regulatory compliance now mandates proper safeguards are in place for all borrower information Record retention requirements are lengthier than ever

13 The New Priority #1: Security Employees Want Easy Access to Borrower Information Any Place, Anytime, Anywhere Business requirements are directly opposite to compliance needs IT departments must ensure remote workers use stringent authentication and permission rights Also must ensure data privacy and security at all times

14 The New Priority #1: Security Managers Must Have Complete Control and Visibility into What Employees Are Doing IT must also ensure data security for laptops and mobile devices As well as tracking user activity And administrator accounts and permissions

15 The New Priority #1: Security Regulatory Compliance Affects Everyone More audit and regulatory governance regarding file sharing and retention Regulatory Drivers: FRCP, SOX, HIPAA (health care), SEC 17a-4 (financial services),glba, FISMA, PCI

16 The New Priority #1: Security Two Choices to Deploy a Compliant File Sharing Solution: Build and self-host Subscribe to a Software as a Service solution

17 The New Priority #1: Security Self-hosted Solution Costs Include: Procurement or development of web application ($2,500 to $5,000) Procurement of storage solution ($3,000 to $15,000) Annual SSL certificate ($250 per year) Bandwidth ($300 to $500 per month) Ongoing Annual Maintenance (20% of initial application cost per year)

18 The New Priority #1: Security Outsourced Software as a Service Solution Costs Include: Per user monthly subscription ($5 to $50 per user) Storage costs ($0.12 to $12 per GB per month) Ongoing support ($0 to $500 per month)

19 Concerns to Ask Any Software as a Service Provider Does the solution provide proper recordkeeping for confidential data storage, retention and accessibility (GLBA compliance)? Does it ensure end-to end encryption of data? Does it reside within SAS 70 and SSAE 16 compliant data centers? Does it provide adequate uptime service guarantees?

20 FocusIT s SecureShare Provides One Option to Solve the Compliance Challenge FocusIT s SecureShare Provides One Option to Solve the Compliance Challenge Easy to manage and use Enterprise-class data security and compliance Setup and managed by a partner you already know and trust with your PointCentral data Strict adherence to mortgage policies and government regulations Cost effective ($19.00 per user per month)

21 Q&A Contact Us: focusit, Inc Kevin Slaby Sales Team Independent Consultant (480) opt. 2 (612) sales@focusitinc.com kmslaby@aol.com

22