Proofpoint: Security, Compliance and the Cloud

September 21, 2014

Latest in the Microsoft v US Govt Odyssey: LEADS Act

The unanswered question of whether the US Government can access your email stored in a non-US location took a new twist on Thursday with the introduction of new legislation that attempts to limit that access - http://www.hatch.senate.gov/public/_cache/files/1f3692d5-f41f-4c73-acf2-063c61da366f/LEADS%20Act,%20September%2018,%202014.pdf

The bi-partisan Senate bill, called the Law Enforcement Access to Data Stored Abroad (LEADS) Act, would amend the woefully outdated Stored Communications Act of 1986, would require that courts issue warrants when requesting content from service providers for both US and foreign citizens when data is stored in the US - or to notify users directly if a warrant is not issued. As significantly, it calls for warrants for data of US citizens stored abroad to be modified or vacated if found to violate the laws of a foreign country.

Not surprisingly, the Act was quickly applauded by Microsoft's General Counsel Brad Smith (http://blogs.microsoft.com/on-the-issues/2014/09/18/new-milestone-conversation-electronic-privacy-laws/), who stated:

“It is important that government demands for customer data comply with the laws of countries where the data are stored. And these laws must provide adequate legal protections for the privacy and human rights of users”

If enacted, the Act would apply only to data of US citizens - with warrants for non-US data of non-US citizens continuing to be addressed by the Mutual Legal Assistance Treaties (MLATs).

Implications

The LEADs Act would provide a big step forward in transparency by requiring warrants for data stored in the US ("warrant for content"), and in creating more uniform guidance for US citizen data stored abroad in light of data privacy mandates in those jurisdictions. However, its passage would accompanied by complications including;

  • The ability to quickly and accurately identify nationality and status of end user data
  • Reaction from foreign governments to processes that can be used by the US government to collect their citizen's data stored in the US
  • The potential impact on new data locality requirements
  • The unequal processes for US citizens and foreign nationals, in particular in light of a slow and inefficient MLAT system

These complications- along with the simple challenge of determining the location of data stored by a cloud provider utilizing a multi-tenant storage model - will no doubt be thoroughly debated as the LEADs Act makes its way through congress.

However, in light of LEAD Act, organizations evaluating cloud providers now are well served to:

  • Determine if the cloud provider has the ability to store data exclusively in the jurisdiction of your choosing
  • Prioritize cloud providers that do not have readable access to information through the separation and client control of encryption keys
  • Investigate policy management capabilities, in particular the ability to provide role-based access privileges to limit access to regional data to those with knowledge of data privacy mandates in those regions

---

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

Linkedin_icon Twitter-icon1  

September 17, 2014

More FOIA: New Fed Email Guidance Issued

As an update to the previous post– yesterday, the Federal Government’s Office of Management and Budget (OMB) issued new Guidance on Managing Email (http://www.whitehouse.gov/sites/default/files/omb/memoranda/2014/m-14-16.pdf). It states that the OMB will begin to more actively enforce Government agency progress in implementing systems to ensure that email is being managed in an electronically accessible format to meet FOIA requirements.

Immediate actions outlined by the OMB require that agencies have made progress in initiated NARA Records Certifications and implemented training programs by December 31, 2014. Ultimately, agencies must have programs and processes in place to meet all legal and FOIA obligations by December 2016.

The bulletin also reiterates the importance of implementing automated approaches to records management given the limitations of user-dependent approaches. According to the newly issued NARA Bulletin 2014-06 attached to the guidance:

NARA recognizes that places the responsibility of making decisions on email-by-email basis can create a tremendous burden. NARA therefore recommends that agencies immediately begin to adopt automated or rule-based records management policies for email management.

Implications

While the guidance yesterday serves primarily as a reminder to Federal government agencies on the actions they should be taking now, it is also very timely given the recent auto delete missteps making the news.

However, a key point of emphasis from the guidance is the concept that information should be stored in manner to be electronically accessible for search and retrieval in accordance with FOIA and legal discovery requirements. - reinforcing points made in the previous post. Dependence on back-up tapes, restoration of computer hard drives, or on-going reliance on outdated systems operated on-premises provide neither the accessibility nor the automated policy management to deliver to this standard mandated by NARA.

---

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

Linkedin_icon Twitter-icon1  

September 15, 2014

Freedom of Information: Defeat the Auto Delete

Interesting news from the great state of PA (http://www.post-gazette.com/news/state/2014/08/29/Pennsylvania-eyes-purchasing-email-archiving-system/stories/201408280307 ), who has just discovered that it needs a system to preserve email of 80,000 employees across 47 agencies beyond the current Auto Delete practice after 5 days. According to the Post-Gazette article,

  • Employees are themselves determining what are business records;
  • Email is retained for only 5 days on department servers then Auto Deleted;
  • It has no interim plan to preserve deleted email past the 5 days while an archiving system is deployed

The implications in lacking such a system have already been felt by the State of PA – whether pertaining to the most recent issues surrounding the Pennsylvania Education Department’s ability to produce a grand total of 5 emails over a 1 year time frame pertaining to a specific matter, or missing documents that arose during the Sandusky trial.

Not to be outdone, New York State has also undergone criticism for implementing an auto-delete process after 90 days for items not flagged by users as meeting one of 218 different records classes (http://www.propublica.org/article/why-is-cuomo-administration-automatically-deleting-state-employees-emails). This, even after implementing Microsoft Office 365 and being provided with an ample quantity of email storage per user. The justification, according to an unnamed state official in the article:

"Just because you have a big house doesn't mean you have to shove stuff in it".

Good argument. Even if storage costs continue to fall, searching through a large quantity of Office 365 data to respond to a time-bounded FOIA request can be a challenge. But clearly, the ability to address Freedom of Information requests can be compromised, at best, if the Auto Delete function does its work.

It should be noted that some states (Florida, Washington, Connecticut, as examples) do not automatically dispose of items reaching the end of retention periods – all require a review process by authorized representative with visibility into potential litigation or other business reasons that would necessitate that the information continue to be retained.

A useful resource listing of records policy for each state can be found here:http://rc.statearchivists.org/Resource-Center/Topics/Records-schedules/State-records.aspx

Implications

When you add the States of PA and NY to the well publicized email retention challenges of the IRS and Veterans Administration, we clearly have a long way to go in effectively managing retention and disposition policy. As a starting point, State, Local, and Federal Government agencies are well served to:

  • Explore archiving technology that automatically assigns specific retention periods to individual items so that dependence on users to understand unwieldy retention procedures is reduced
  • Examine cloud-based archival solutions that removes storage cost as a variable in the retention policy decision
  • Understand the performance capabilities of these archival systems to know which are suitable to address broad, time-sensitive FOIA requests
  • Ensure that a specific authorized individual retains the responsibility to hit the red button - based upon their knowledge of whether that information has potential value in satisfying an investigative or public right to know.

And, visit http://www.proofpoint.com/products/archive-governance/enterprise-archive/index.php to learn more about how to defeat the Auto Delete.

---

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

Linkedin_icon Twitter-icon1  

September 04, 2014

Social Media and Regulatory Compliance?

Register Now for our upcoming Live Demo focused on social media and regulatory compliance next Wednesday, Sept. 10 at 11:00am PST. We will discuss the core requirements that any FINRA, SEC, IIROC or FCA regulated firm should be considering in order to minimize compliance risk, while also highlighting the Proofpoint Social Platform for Archiving.

---

Not a surprise, but noteworthy to see the interest level surrounding social media and regulatory compliance at the recent LIMRA Social Media for Financial Services conference in Boston. Good coverage provided here by Forbes Magazine.

Two interesting comments by Thomas Selman of FINRA were noted by Forbes that resulted from last summer's Social Media Sweep conducted against 23 FINRA regulated firms. Namely that, while over-all compliance appears to be good, regulatory concern has arisen that:

  • Registered reps claimed more acumen than they had.
  • Business records were stored in such a way that the social media formatting was lost when retrieved. This presents a real challenge to supervisory review.

Both concerns have been previously noted here, along with others that can arise if utilizing social archiving solutions not designed to withstand the rigors of financial regulatory compliance. For example, if:

  • methods used to collect content are not complete or comprehensive;
  • dependence of manual methods to map social identities to Active Directory information;
  • use of data storage that does not ensure information is stored immutably according to defined retention requirements;
  • data privacy and/or data security capabilities that do not meet internal IT standards
  • review of social content for regulatory requires the deployment of new tools and costly and time consuming data migration

So, how can Proofpoint help?

Proofpoint’s Social Platform for Archiving automates the capture and archiving of social media content from specific social channels as required for regulatory purposes. Native APIs are used to capture social content from leading channels including Salesforce Chatter, Microsoft Yammer, LinkedIn, Facebook, and Twitter – with all content captured to establish a complete regulatory record. Social content is then fully integrated into the archiving solution that you already have in place, thereby eliminating the need to manage multiple supervisory tools for regulatory compliance. This enables the compliance officer to view the entire context of the content in each captured item, enabling fast and efficient compliance review  in light of requirements set forth by IIROC and other regulatory entities.

---

ChrisRicciutiNewChristopher Ricciuti is Vice President of Financial Services Archiving Solutions at Proofpoint, where he brings 10+ years of Financial Services industry experience. He focuses mainly on helping regulated organizations leverage next-gen communication technologies, such as social media, while maintaining regulatory compliance. Prior to Proofpoint, Christopher worked as a CTO on Wall Street and founded eDynamics, a social media compliance start-up. He holds an MBA from Babson College. 

Linkedin_icon Twitter-icon1

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

 Linkedin_icon Twitter-icon1  

August 22, 2014

ILTA14 Highlights the Importance of CTRL

#ILTA14 Marks Debut of CTRL: The Coalition of Technology Resources for Lawyers

http://www.businesswire.com/news/home/20140820005167/en/ILTA-Marks-Debut-CTRL-Coalition-Technology-Resources#.U_TJ1GMx5i8

End of another great ILTA conference, with plenty of interest around information, cloud - and a significant increase in interest around data privacy and security. ILTA also provided a good forum to launch an interesting new initiative - the Coalition of Technology Resources for Lawyers (CTRL) - aiming to address the challenges created by the lack of standards and shared cross-functional vocabulary to describe the intersection of technology and daily needs of those in the legal profession. The challenge the coalition expects to tackle is well stated on the CTRL website (http://ctrlinitiative.com/) :

The availability of technology—even within the practice of law—has increased just as has the volume and complexity of discoverable information. But instead of the discovery process benefiting directly from these advances, technological unease has resulted largely in an e-discovery culture of bare-bones compliance, where technology remains a necessary evil and little more than a tactical means-to-an-end within a deadline-intensive environment

We believe the initiative is directly in line with our history and strategy of helping our clients to proactively control and protect critical information. Our involvement is driven by several factors:

  • The unchecked growth of data volume and proliferation: as stated many times here, information doubling in the next 2.5 years, more of it uniquely in mobile + social + cloud. The challenge of controlling information will never get any easier - and the need for standards to drive greater data leverage and re-use never greater
  • The collision of InfoGov and eDiscovery: moving away from the tactical, event-driven model of Discovery start with arriving at a cross-functional view of data value and risk - efforts such as CTRL can help drive the vocabulary
  • The trend toward converged InfoGov and InfoSec priorities: as soon as the eDiscovery world begins to embrace the InfoGov concepts and stakeholders, we are seeing another set of stakeholders join the discussion representing information security and data privacy. The reasons are obvious given the frequency and repercussions of data breach. The addition of the Chief Security Office adds yet another language and priorities, but one that must be heard in order to move from the culture of bare-bones compliance

We look forward to contributing to the dialog.

---

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

Linkedin_icon Twitter-icon1  

August 19, 2014

What is the business case for #InfoGov?

#ILTA14 has kicked off, and information governance is one of the topics dominating the hallway discussion in Nashville.

We hear that many continue in the on-going search of a metric to justify expenditure in information governance. A part of the challenge appears to be semantics - with info gov viewed by some as simply a new paint job on records management or short hand way to describe a "comprehensive filing system" (as noted here: http://www.defenselitigationinsider.com/2014/08/05/discovery-costs-how-companies-can-increase-efficiency-and-save-money-in-the-process/#.U-0aTqof99o.twitter)

Semantics aside, we seem to be over-complicating the business case question. Sure, gaining executive sponsorship, aligning multiple functional stakeholders, and selecting the appropriate technologies are not trivial tasks. But, as noted in the Information Governance Initiative (IGI) Annual Report, 92% of surveyed organizations see "value and risk as equal partners" in InfoGov projects, and 68% indicated that establishing a clear, quantifiable metric is essential to their organization.

So, given the $2M average project spend for large organizations (noted by IGI), what are some of the ROI metrics that have emerged? Here are some that we see most typically:

1. Lower storage cost: It may not be on top of list of strategic goals, but impacting the cost of data storage is real, tangible, and achievable when information is expected to grow 44x over the next 10 years. Case studies demonstrating storage cost reduction benefit are growing - such as ARMA 2012 Cobalt Winner CUNA Mutual who eliminated 160TB of outdated junk, realizing an accumulated savings of $2.1M as one example.

More active elimination of digital ROT through approaches to identify and eliminate junk is gaining momentum - which should accelerate now that FRCP 37(e) will provide greater clarity around "reasonable" preservation efforts.

2. Reduced eDiscovery cost: taking proactive steps to identify and control data from the outset has produce measurable ROI - not only in the elimination of manual methods of identifying and collecting ESI, but more significantly, in squeezing the number of documents that should not be carried forward to review. This math here is simple when the average average custodian generates between 3-5GB of data and the average attorney is reviewing 100 documents per hour. Case studies: vmware saving $300K per matter by proactively managing email, NYC-based law firm Graubard Miller saving $200K in collections expense alone per matter versus the use of back-up tapes. No advanced calculus required.

3. Reduced regulatory exposure: regulatory risk has jumped into the leader box of areas of litigation risk concerning corporate counsel (per Norton Rose). The reasons: increased regulatory complexity, increased attention of HIPAA, FINRA, and the SEC in light of data privacy mandates other preventative measures, and information increasingly finding its way into unmanaged locations (social, IM, mobile, cloud). With the average SEC fine reaching record levels in 2013, case studies are any regulated firm not appearing on the SEC Enforcement Reports, FINRA Disciplinary Summary or similar firm hit with sanction and the resulting reputation harm

4. Productivity Impact: often overlooked, the simple elimination of wasted effort in the attempt to locate data can be measurable and significant in contrast to current practices. Several interesting analyses have been produced measuring productivity impact, such as Bill Tolson's post (http://informationgovernance101.com/2014/08/08/infogov-productivity-gains-equal-revenue-gains/) which estimate the time regained per year valued at $3.8M and total recoverable revenue per year of $6.8M.

How Proofpoint can help

Given the results of early adopters, business case definition should not be the obstacle to investmet in information governance. Proofpoint provides a portfolio of information governance capabilities that can help organization to quickly achieve measureable results - whether those are focused on securing high value content or eliminating information that creates unneeded cost and unnecessary risk. For more information, please visit: http://www.proofpoint.com/products/archive-governance/index.php

---

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

Linkedin_icon Twitter-icon1  

Archives

Blog Search

Email Security Gateways, 2012

Magic Quadrant

Tweets

What people are saying right now about us.

©2012 Proofpoint, Inc.
threat protection: Proofpoint Enterprise Protection compliance: Proofpoint Enterprise Privacy governance: Proofpoint Enterprise Archive secure communication: Proofpoint Encryption