For LTC Partners, the decision to invest in data governance software was a no-brainer.
The Portsmouth, N.H.-based company has been administering long-term care insurance for federal employees since 2002. When LTC's seven-year contract with the government came up for renewal this year, the feds demanded better accountability of LTC's data assets.
Specifically, the government implemented new regulations that required LTC to track and monitor who accesses its 15 plus terabytes of customer, financial and human resources data, what they do with it, and when. To meet the new requirements, LTC turned to a small data governance vendor called Varonis Systems.
While data governance is often thought of more as a discipline than a technology per se, there is software available to help companies implement data governance policies, including who "owns" data and who is able to access it.
The Varonis data governance suite, for example, lets LTC's IT workers monitor employee data access permissions from a single Web portal. Permissions can be granted to individual workers or groups of workers and is even granular enough to allow LTC to grant customized data access to workers in the same group, according to Casey Cole, network security architect at LTC.
The software is also able to pick up patterns of access and suggest changes to permission settings, Cole said. If a worker with permission to certain data never actually accesses it after a few weeks, for example, the software might recommend removing that person's permission to access it.
Data governance software also helps LTC keep tabs on "2,000 potential hackers," Cole said, referring to the temporary call center reps LTC hires each fall to handle the influx of calls during open enrollment period. The extra help, who work out of a Georgia call center, are granted temporary access to certain customer files, but not all of LTC's corporate data.
LTC generates canned weekly and monthly reports for upper management, Casey said, detailing employee activity via the Varonis software. It also uses the software to report to the government that the company is indeed monitoring data access, which it is required to do every three years as part of its contract with the feds.
LTC's CEO, Paul Forte, "takes security very seriously," Cole said, and views LTC's new data governance capabilities as a potential selling point when the company bids on new government business.
But in addition to governance capabilities, the software has turned out to be helpful for LTC help desk workers. If one of LTC's 250 plus employees misplaces a report or other data on LTC's file system, the help desk can simply check the data governance software to see where it was last saved to.
Before using Varonis, it was often too time consuming to look for such data, hidden among thousands of files, and often required the help desk to restore the data from backup tape, Cole said.
In addition, LTC uses Varonis software to identify which files are accessed most often – and therefore are most important to LTC workers – and should be backed up at the company's data center in Chicago, which has limited data storage capabilities.
The software is also used as a performance management tool, Casey said. It lets managers keep tabs on employee workflow and see who's accessing which files and when.
LTC plans to extend its use of Varonis in the coming months to monitor its SharePoint collaboration software, Cole said. In addition to internal LTC employees using SharePoint, the company uses the program to share documents with outside partners and the government.
Cole said he also eventually plans to allow managers to administer the data governance software themselves, rather than IT, taking a burden off his staff and freeing them up for more demanding projects.
But while the software was easy enough to deploy – it was up and running in a couple of hours after a three-month evaluation period earlier this year – it required significant training to get the hang of it.
"It's definitely a project you need a lot of training on," said John Wiegert, IT infrastructure manager at LTC. "I found it overwhelming at first."
Cole agreed, adding: "You can't just spend a couple of hours with it and be an expert."
Still, despite the extensive training requirements, Cole and his staff are happy with Varonis, saying, "We now feel a lot more comfortable with our sensitive data." He added, "It's already paid for itself."