preview

Case Study: Heart-Healthy Insurance

Decent Essays

Heart-Healthy Insurance is an important and successful insurance company that prides itself on its commitment to its user’s privacy. This privacy we provide to our customers creates a mutual trust that makes our company more valuable than our competitors. To keep this client trust, we must meet certain criteria to ensure our security practices are up to par to provide the utmost protection to our customer's privacy.
My greatest concern to the out current security policy as of now are the New Users creation policy and the Password Requirements policy. I felt that these policies are lacking and don’t quite meet the current standards that are required for our organization and the type of data we handle and store. The present new user policy states: …show more content…

The success of your information security plan depends largely on the employees who implement it. Consider, checking references or doing background checks before hiring employees who will have access to customer information.” (FTC) By vetting any new user accounts, we would be by establishing a more secure baseline to operate at and ensure social engineering attacks would not be successful. The use of segregated accounts with regular access and administrative access enables our current User Creation policy under HIPAA and HITECH standards. “Passwords should be changed periodically based on threat exposures (e.g., every 30, 60, or 90 days, with timing an output of the practice’s risk analysis). Implement and carry out sanctions for any workforce member who posts a password on a workstation terminal or desktop, or who shares a password with other workforce members.”(Jones) Increasing the password characters and complexity is a requirement for PCI-DSS “PCI compliance password requirements are the following: Require a minimum length of at least seven characters, Contain both numeric and alphabetic characters, Users to change passwords at least every 90 days.” (Charles) I feel these changes are the steps that need to be taken to continue our trust with our customers and is only the first step to combating the attacks against those who wish to gain our sensitive

Get Access