Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Why MassMutual's security chief doesn’t have to outrun bears

Financial firm's security lead sets policies, educates users and ensures his infrastructure is more secure than the competition's
By Denise Dubie , Network World , 02/28/2007

Bruce Bonsall, security lead at MassMutual Financial Group since 1991, says one of the best changes in the financial industry over the years has been increased collaboration to fight IT threats. That's not to say, though, that he doesn’t want his company's level of security to be a differentiator. "There is an old saying that explains if you are hiking in the woods with a friend and a bear attacks, you don’t have to be able to outrun the bear, you just have to be able to outrun the friend," says the CISO for the Springfield, Mass., company. "If we have better security than the company down the street, then it's more likely they are going to get attacked." Bonsall, who has 50 people in his charge and oversees management of some 3.4 million identities, recently shared more of his thoughts on network security with Network World Senior Editor Denise Dubie.

Getting personal:Bruce Bonsall

Organization: MassMutual Financial Group
Title: Vice President and Chief Information Security Officer (has managed the MassMutual security team since 1991).
Responsibilities: With 19 years of experience managing large-scale corporate information security programs, Bonsall is responsible for all aspects of information security for MassMutual. Bonsall and his team set strategy, establish and enforce policies, manage security infrastructure, maintain over 3.4 million identities and consult on hundreds of projects throughout the enterprise each year. Much of Bonsall's focus over the past few years has been in the area of security governance and regulatory compliance.
Staff size: 50
Annual budget: Undisclosed
Previous jobs: Security Analyst, Monarch Systems Group 
Education: Associates degree in civilÊ engineering from Springfield Technical Community College 1982.
If he wasn't in IT he'd be: Writing spy novels
Claims to fame: Winner of 2006 National Information Security Executive of the Year Award; Certified Information Systems Security Professional (CISSP), since 1997.
Fun fact: Loves outdoor sports. "Navigating rapids in a kayak is like navigating corporate politics. You have to know when to go with the current and know when to paddle like hell!"
Click to see: Bruce Bonsall's background

What projects top your priority list for 2007?

Our priorities fall along a couple of lines. One is automating a lot of the manual work that we do, particularly in the identity management area in terms of adding IDs to all the systems and setting up all the access that people need. The reason we need to automate is that although we are very good at [ID management], we have grown to the point where we just can't scale. We could keep throwing bodies at it, but I think through automation we will be a lot more nimble. The company is in growth mode, and we'd like to be in a position where we can acquire other companies and bring them on board quickly. If we have to do that manually, it can really hinder our growth.

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask to prospective vendors to get the right endpoint solution.

Download the white paper.

Unauthorized applications: Taking back control

Employees installing and using unauthorized applications like IM, VoIP, games and peer-to-peer file-sharing applications cause many businesses serious concern. How do you control these applications?

Download the white paper.

Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to moderator approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed
Save The Date!
What They Are Saying

If the IT manager is knowledgeable regarding Cisco technology, he would have 2 options. Option 1 - Consult...- Anonymous

Join the Discussion