AstraZeneca Improves Clinical Trial, Data-Sharing Resources

Cyber-Ark's secure virtual vault data technology is helping AstraZeneca upgrade its clinical trial and information-sharing functions, according to project team members who spoke to PIR recently.

Two years into the limited initial project rollout, some 500 AstraZeneca employees now use Cyber-Ark's virtual vault technology to securely and cost-effectively share sensitive information among the company's disparate research organizations, partners and distributed business units. The vault tool is helping AstraZeneca simplify how it shares information at rest and in motion, Cyber-Ark vice president Adam Bosnian said Feb. 28. The tool provides strong audit trail capabilities, document detail and access granularity -- the ability to change one cell rather than the entire document -- and is helping the company streamline its clinical trial operations, he said.

AstraZeneca first deployed Cyber-Ark's Inter-Business Vault for its drug development process. The investments and information tracking needed to bring a new drug to market is huge and it can take more than a decade to get FDA approval, Bosnian said. It costs pharmaceutical companies an estimated $1 million for each day a drug is under development, he said. "That's why it's so costly for any pharmaceutical company to spend time waiting for overnight couriers and inter-office mail," he added. Cyber-Ark has provided a quick way to speed the process.

This system is a big improvement over AstraZeneca's previous model, which was an in-house secure collaborative application, agreed AstraZeneca lead technical architect Patrick Meehan. For starters, the in-house application was too much of an upper management burden, he said. "We were always getting [help desk] calls about it," he recalled. "Either it didn't work, we had to constantly adjust firewall settings, or [there were] similar annoying issues."

The company knew it needed to find a better solution. As it searched among vendors for help, the company knew its system needed to have:

No required installation of plug-ins or software; A seamless tool for end users; and A web-based application.

"We wanted no setup overhead or concerns about having to open firewall ports," Meehan said.

After looking at several competing products, AstraZeneca tapped Cyber-Ark. "[Their system has] proven to be very easy to deploy and maintain," Meehan said. "There's no need to tweak any code."

Another factor that won AstraZeneca over, according to Bosnian, was that Cyber-Ark boasted the easy addition and subtraction of system users.

Just like a physical vault, Cyber-Ark's vaulting technology was developed to create information "safe havens," Bosnian said. Cyber-Ark's Inter-Business Vault incorporates layered security protection provided by its integrated firewall, authentication, access control, session and data encryption, content inspection, secure backup, version control and other granular security controls. Cyber-Ark's vaulting technology makes it possible for companies to create an instant wide-area network (WAN) to securely connect and collaborate with their partners, subcontractors and customers over the internet.

"It's our attempt at bringing a secure repository for data that can't be broken into," Bosnian said. Because of its layered security approach, he said it is safe for companies to actually store the vault outside their own network. That will free up their computer systems and also keep users from accessing a company's main computer network, he said. In a situation like a clinical trial, a sponsor is often obliged to work with many different partners who play different roles, he noted.

End users need only a web browser to access a highly secured vault, Bosnian said. Information is secured via HTTPS and Cyber-Ark's specialized encryption, and companies can choose to integrate other authentication methods including public key infrastructure, RSA security or Windows domain authentication. With Inter-Business Vault, security managers can create highly specific access rights so that users see only the vaults they're authorized to access and can limit how long individual users and vaults are active, he added.

"One of the key benefits Cyber-Ark [offers] is the ability to exchange data and documents more quickly with our business partners," says Meehan.

Another major benefit is Inter-Business Vault's ability to provide complete version control for each file uploaded to a vault, Meehan said. When files are placed inside the vault, new versions are created and existing files are never overwritten. This powerful version-control mechanism protects against deliberate and unintentional data corruption and has been "extremely useful," says Meehan. -- Michael Causey