Never Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.
Trust Matters To Cigna
Benefits provider toes that fine line between providing access to health information and protecting sensitive data.
3 Min Read
Security's In the Details
Shumard's role as Cigna's chief information security officer has changed dramatically since the job was created in 1999. In the late '90s, the main focus was beating back viruses that could bring down computers and disrupt business. "Little thought was given to identity theft, misuse of intellectual property, hackers, or trusted computing," he says.
Combating these threats requires knowing as much as possible about who's using your company's systems and what they're doing while they're logged on. "We're focusing on [creating] trusted users and making sure that the people we've credentialed and given access to continue to use that access appropriately," Shumard says.
Cigna maintains an audit path to track where users go in its systems; admins use Verdasys' Digital Guardian to control application and storage device usage, network communications, clipboard cutting and pasting, and printing. It warns admins about how devices are being used and can block usage if necessary. Digital Guardian is helping the company meet regulatory requirements, such as Sarbanes-Oxley and the Health Insurance Portability and Accountability Act.
Looking ahead, complexity will continue to be the enemy of security at Cigna. IT systems loaded with new features and capabilities are great for employees and customers, but "it really causes a lot of angst" for tech managers, Shumard says.
Cigna is implementing a federated identity management system that will let customers log on to the system and go to their employer's benefits page without having to go through a second logon. This is convenient, but "what goes on behind the scenes to do this is fairly complicated," Shumard says. "We need to make sure that as we establish a circle of trust with your company that we don't do anything to jeopardize the integrity of the data or your privacy."
Cigna's information security progress over the past year indicates the company is up to the challenge. Still, with stolen personal data commanding a premium among criminals, Cigna will need to keep looking over its shoulder.
Cigna must offer its 9 million members more online transparency and access to their health and benefits information, while ensuring the privacy and security of that information. Last year, the company developed and implemented an operating model that improved the integration of information protection with business processes. The rollout included: Cigna also developed a strategy to facilitate secure offshore business process outsourcing, reduced systems access setup time by 60%, and minimized business disruption using an incident-response process, intrusion detection, and virus and spam controls. |
This story was updated Sept. 12, 2006.
About the Author
You May Also Like
More Insights
