Security's In the Details

Shumard's role as Cigna's chief information security officer has changed dramatically since the job was created in 1999. In the late '90s, the main focus was beating back viruses that could bring down computers and disrupt business. "Little thought was given to identity theft, misuse of intellectual property, hackers, or trusted computing," he says.

Combating these threats requires knowing as much as possible about who's using your company's systems and what they're doing while they're logged on. "We're focusing on [creating] trusted users and making sure that the people we've credentialed and given access to continue to use that access appropriately," Shumard says.

Cigna maintains an audit path to track where users go in its systems; admins use Verdasys' Digital Guardian to control application and storage device usage, network communications, clipboard cutting and pasting, and printing. It warns admins about how devices are being used and can block usage if necessary. Digital Guardian is helping the company meet regulatory requirements, such as Sarbanes-Oxley and the Health Insurance Portability and Accountability Act.

Looking ahead, complexity will continue to be the enemy of security at Cigna. IT systems loaded with new features and capabilities are great for employees and customers, but "it really causes a lot of angst" for tech managers, Shumard says.

Cigna is implementing a federated identity management system that will let customers log on to the system and go to their employer's benefits page without having to go through a second logon. This is convenient, but "what goes on behind the scenes to do this is fairly complicated," Shumard says. "We need to make sure that as we establish a circle of trust with your company that we don't do anything to jeopardize the integrity of the data or your privacy."

Cigna's information security progress over the past year indicates the company is up to the challenge. Still, with stolen personal data commanding a premium among criminals, Cigna will need to keep looking over its shoulder.

This story was updated Sept. 12, 2006.