Bloomberg clamps down with data-access policies after scandal

The financial data and news company develops in-house access controls after controversy over journalists seeing client information

Financial data and news company Bloomberg has developed in-house access controls and embraced several other technological fixes after it emerged last year that the company's journalists had routinely accessed data on how Wall Street clients were using the company's computer terminals.

Bloomberg on Thursday released a report outlining more than 65 technology and process changes the company has made based on August recommendations from outside advisors, including law firm Hogan Lovells and regulatory compliance firm Promontory Financial Group. The company has adopted, or is working to adopt, every recommendation from the outside auditors, Bloomberg CEO Daniel Doctoroff said in a letter accompanying the report.

"We have tapped the best technical minds at our company, including our R&D department, to build off some of our historic innovations like the use of biometric finger image authentication, and to perform a comprehensive analysis of our systems to identify deficiencies and recommend enhancements," Doctoroff wrote.

Bloomberg journalists were able to see some information on how the company's terminals were used on Wall Street, including when customers had logged in and when they looked up data on equities, bonds or other broad categories, according to news reports from last May. Bloomberg client Goldman Sachs had raised concerns about a reporter's questions related to an employee's terminal use.

One of the goals of releasing the report is for Bloomberg to "reach out so that we can set more standards across the industry, so that others can learn from what we went through," said Paul Wood, Bloomberg's new chief risk and compliance officer.

The company has pumped up its access controls, by monitoring user activity logs and employing automated triggers to check on systems access, the report said. The access controls implemented by the company may be among the most sophisticated available and allow the company granular control over who has access to company data, based on employee roles, geography and other factors, Wood said.

The company integrated its access control systems with its personnel databases, allowing Bloomberg to track employees as they change positions, Doctoroff said in his letter.

Bloomberg, using access control systems developed in house, has tried to "transform the access to data," Wood said. Access control is a difficult challenge that many companies are still wrestling with, he said.

The company has long used fingerprints as part of the log-on process on its financial terminals, and that functionality helps Bloomberg monitor information access and "prevent an inflation of permissions" as employees change jobs within the company, said Steven Ross, Bloomberg's chief client data compliance officer.

The company has centralized its activity logs to review users' attempts to log in to unauthorized parts of its system, the company said in the report. It has scheduled periodic testing on the role-based access system, as Hogan Lovells recommended, and it has established a working group to search its software code for instances where passwords might be able to exceed role-based restrictions.

The report recommended a handful of changes related to internal software development, with Hogan Lovells saying that there was some use of production data in the software development process, without the data being scrubbed. Some of those changes, including a recommendation that the company consolidate the systems for tracking changing to software code, are scheduled to be completed this year.

Also in progress is a Hogan Lovells recommendation for Bloomberg to monitor activity logs and use automated triggers to detect unauthorized access to Bloomberg's databases containing sensitive client data.

Out of nearly 80 recommendations from outside advisors, Bloomberg has implemented all but 11, with most of those remaining items scheduled to be completed this year, Paul said.

The August report contains several recommendations from veteran journalist Clark Hoyt. He recommended that Bloomberg journalists not be banned from using the company's terminals, but that proper access control be implemented. He also recommended all employees sign a confidentiality agreement, and Bloomberg has completed that recommendation.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's email address is

Join the CSO newsletter!

Error: Please check your email address.

Tags Paul WoodSteven Rossaccording to news reportsHogan Lovellsfinancebusiness managementindustry verticalsBloombergPromontory Financial GroupClark HoytDaniel Doctoroffsecuritydata breach

More about BloombergGoldmanIDGWall Street

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Grant Gross

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place