How ACV Auctions uses Cyera to Control Sensitive Cloud Data Exposure

Improve security posture

Cyera’s rapid identification of publicly accessible records and the encryption state of data assists in ACV’s efforts to dramatically improve the overall security posture. Today, the company uses Cyera to identify all cloud data stores, classify the data inside of each store, and show the identities with access to that data. Along with the principles of zero trust architectures and least privileged access, ACV continuously strives to limit data access to applications and accounts based on a well-defined business purpose for accessing data.

‍

Increase context to improve vulnerability management

ACV’s Security team leverages Cyera's Data Insights API to enrich their Vulnerability Management Pipeline and Incident Response capabilities.  Cyera issues, classifications, and context are aggregated and correlated in a central vulnerability management system. These help to establish the risk, severity, and priority of a signal or issue or asset by providing data context on the blast radius and potential business impact. Relevant teams and stakeholders can then make intelligent business decisions and resolutions depending on the situation at hand. Additionally, the Threat Detection and Response Team can leverage the Cyera signals to gauge the potential exposure from a threat signal detected by the SEIM.

‍

Minimize data and optimize costs

The principle of data minimization means the objective is to limit the collection of information to what is directly relevant and necessary to accomplish a specific purpose.

‍

Data stores that no longer exist can comprise up to 30% of cloud storage volume. 56% of those data stores contain sensitive data.

Data minimization is also a critical aspect of cloud cost optimization. Because cloud resource consumption dictates price, reducing overconsumption and unnecessary storage costs helps ACV Auctions contain cloud costs. Cyera’s platform helps ACV Auctions discover, understand, and remediate overconsumption from:

‍

• Stale data - by identifying the overall volume and number of sensitive records in sensitive data stores, helping data owners minimize the storage of data that is no longer in use, optimizing costs
• Ghost data - by identifying the compliance and security risks ghost data represents and eliminating snapshots of data stores that no longer exist
• Copy data - by identifying copies of backup data and eliminating it safely

‍

ACV relies on Cyera to understand its cloud data, assist in meeting requirements, and manage cloud costs. "When we implemented Cyera, we got a full picture of our cloud data landscape. Cyera showed us that we had a lot of ghost data that was not being accessed or used. Eliminating all of it would save us over $50,000 per year in cloud storage costs," said Erik Bataller, VP of Information Security at ACV. “Cyera also helps me show our executive team and other business stakeholders how we are managing, governing, and securing our data, and how we are keeping it private.” As cloud use increases and cloud data continues to proliferate, it is more important than ever for ACV  to identify, protect, and eliminate data when appropriate to control costs and increase overall security.

That’s why ACV chose Cyera’s cloud data security platform to perform a data risk assessment on the ACV Auctions environment to help establish a baseline and ensure that the security team was well-positioned to respond to any incidents in their large and expanding cloud environment.

‍

Cyera helped to ensure ACV’s security team:

‍

1. Understood the security posture of data across their cloud environments
2. Were able to identify and monitor changes to the data landscape
3. Received actionable guidance to implement security controls to protect the business

‍

Cyera worked collaboratively with the company’s security team to maximize ACV’s security posture and controls without impacting ongoing business operations. The risk assessment enabled ACV to quickly evaluate its current security posture and understand the controls that needed to be implemented. And, ACV Auctions also needed continuous visibility of any new data stores or data across datastores and clouds to understand, manage, and secure their ever-changing cloud data landscape.

‍

"ACV Auctions provides a leading digital marketplace for wholesale vehicle transactions and data services. The company enables dealers and commercial partners to buy, sell, and value vehicles confidently and efficiently. Cyera enabled ACV Auctions to quickly gain a full picture of their cloud data landscape, improve their security posture, and optimize their cloud costs."

‍

Erik Bataller,

Chief Information Security Officer at ACV Auctions