Challenge
Modern Health faced several data management challenges due to its extensive infrastructure, which includes over 20 Postgres databases. The primary issues included:
- Inefficient Access Management: The absence of automated user provisioning and deprovisioning for database access was a significant bottleneck.
- Difficult User Governance: Without a centralized system tied directly to Modern Health’s IDP, it was hard to track and audit user access to Modern Health databases for employees who needed this access for their role
- Audit Limitations: The default Postgres logging system did not provide the necessary detail to track user queries effectively.
- Manual Processes: The reliance on manual processes for database provisioning was time-consuming and prone to errors.
- Data Privacy Concerns: Without adequate data masking, there was a higher risk of exposing sensitive data
Solution
Choosing Formal as a partner, Modern Health has integrated a comprehensive governance framework that streamlines data security and compliance. This collaboration has transformed Modern Health’s approach to data management, emphasizing the importance of robust cybersecurity practices.
Michael Hensley, Head of Cyber Security at Modern Health, emphasizes the strategic value of this partnership: “Formal’s advanced solutions in data observability and governance equip our team with leading-edge tools, ensuring unparalleled security for our customer’s data. Formal’s solution, with it’s robust data governance model and deep integrations into Modern Health’s IDP, allowed database access to become more secure and more scalable for internal users that needed access.”
Key features of Formal solution include:
- End-to-end observability: Formal Sidecar enables Modern Health security team to have deep insights on how users are consuming data. Integration with AWS S3 let Modern Health archive the audit logs
- Granular Data Control: The Formal Sidecar, equipped with an open-policy agent, allows precise data handling, enabling real-time data masking and redaction.
- Operational Efficiency: Formal’s user-friendly interface and Terraform integration simplify resource management, enhancing collaboration and streamlining workflows.
- IDP Integration: Modern Health tied Formal to it’s access management platform and IDP, allowing for a very easy yet secure process for people requesting database access
Results
Formal’s infrastructure has revolutionized Modern Health’s internal development processes, leading to significant productivity gains. The ease of data access and governance has not only improved the developer experience but also fortified data security.
Michael Ivey, Staff Security Engineer at Modern Health, highlights the strategic advantage: “Formal’s evolving suite of security tools is crucial for our enterprise, simplifying complex security tasks like query storage in S3 buckets.”
