Bloomberg clamps down with data-access policies after scandal
The financial data and news company develops in-house access controls after controversy over journalists seeing client information
IDG News Service - Financial data and news company Bloomberg has developed in-house access controls and embraced several other technological fixes after it emerged last year that the company's journalists had routinely accessed data on how Wall Street clients were using the company's computer terminals.
Bloomberg on Thursday released a report outlining more than 65 technology and process changes the company has made based on August recommendations from outside advisers, including law firm Hogan Lovells and regulatory compliance firm Promontory Financial Group. The company has adopted, or is working to adopt, every recommendation from the outside auditors, Bloomberg CEO Daniel Doctoroff said in a letter accompanying the report.
"We have tapped the best technical minds at our company, including our R&D department, to build off some of our historic innovations like the use of biometric finger image authentication, and to perform a comprehensive analysis of our systems to identify deficiencies and recommend enhancements," Doctoroff wrote.
Bloomberg journalists were able to see information on how the company's terminals were used on Wall Street, including when customers had logged in and when they looked up data on equities, bonds or other broad categories, according to news reports from last May. Bloomberg client Goldman Sachs had raised concerns about a reporter's questions related to an employee's terminal use.
One of the goals of releasing the report is for Bloomberg to "reach out so that we can set more standards across the industry, so that others can learn from what we went through," said Paul Wood, Bloomberg's new chief risk and compliance officer.
The company has pumped up its access controls, by monitoring user activity logs and employing automated triggers to check on systems access, the report said. The access controls implemented by the company may be among the most sophisticated available and allow the company granular control over who has access to company data, based on employee roles, geography and other factors, Wood said.
The company integrated its access control systems with its personnel databases, allowing Bloomberg to track employees as they change positions, Doctoroff said in his letter.
Bloomberg, using access control systems developed in house, has tried to "transform the access to data," Wood said. Access control is a difficult challenge that many companies are still wrestling with, he said.
The company has long used fingerprints as part of the log-on process on its financial terminals, and that functionality helps Bloomberg monitor information access and "prevent an inflation of permissions" as employees change jobs within the company, said Steven Ross, Bloomberg's chief client data compliance officer.
The company has centralized its activity logs to review users' attempts to log in to unauthorized parts of its system, the company said in the report. It has scheduled periodic testing on the role-based access system, as Hogan Lovells recommended, and it has established a working group to search its software code for instances where passwords might be able to exceed role-based restrictions.
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- Preparing Your Infrastructure for the Hyperconvergence Era From cloud computing and virtualization to mobility and unified communications, an array of innovative technologies is transforming today's data centers.
- How WAN Optimization Helps Enterprises Reduce Costs If you wanted to break down innovation into a tidy equation, it might go something like this: Technology + Connectivity = Productivity. Productivity...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Cybercrime and Hacking White Papers | Webcasts