Proofpoint: Security, Compliance and the Cloud

39 posts categorized "Security"

November 21, 2014

Gartner MQ on Enterprise Information Archiving: Top 5 Take-Aways

Given the dynamic world of malicious, targeted attacks and daily incidents of data breach, you may have missed the most recent release of the Gartner Magic Quadrant for Enterprise Information Archiving. (In case you did, it can be downloaded here: http://www.proofpoint.com/id/gartner-email-archiving-enterprise-information-archiving-magic-quadrant/index.php)

EIA MQ 2014

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from [insert client name or reprint URL].

No doubt, you are asking yourself “why archive when we have our email in Office365 (or gmail + Vault)?” or  “what does archiving have to do with data protection?”, or “cloud is nice, but my day job is to keep our 100TB(+?) in EV alive”, or “only small companies archive data in the cloud”.  All good questions, which I will address in the Top 5 Take-Aways from the Gartner Enterprise Information Archiving report. Here goes:

1. Why do I need an archive? Not a new question for some, but as noted in the report, organizations are increasingly viewing archiving investments as “active” or “near-line” sources of data that will continue to create greater separation from the simple, infrequent access of historical data on back-up data storage. That frequent, time-sensitive access requires features that will satisfy legal and compliance users as well as safeguards to ensure that data can be preserved in real-time. As regulatory complexity and unique data privacy mandates continue to grow these features will continue to  evolve beyond the basic  “good enough” capabilities provided natively by Microsoft and Google.

2. It’s about information value:  the need for this frequent access is quickly extending beyond the realm of email due to rapid expansion of sanctioned employee communication channels as well as the broadened regulatory purview (e.g. FINRA, FFIEC, FDA guidance on social media). As is being now being stated too frequently: the goal is manage information according to its value – regardless of its location. This goal extends beyond email, to files, collaboration applications, IM, social media and Web page content given the sensitivity and value of content increasingly delivered through those channels.

3. Scattered Clouds: It is no surprise that cloud-based archiving continues to shift spending from outdated on-premise legacy technologies to those are proving to deliver lower TCO and removal of IT hassle . In fact, the report notes that “Gartner sees 60% to 70% of new or replacement email archiving implementations as being cloud-based (1)”, which is up from small percentages only a few years ago. However, what is clear from this year’s report is that cloud offerings are not homogenous. Commentary provided on each vendor shows greater stratification of capabilities, where some are noted to provide solutions appropriate for small firms primarily to outsource the management of email, versus those designed to meet complex regulatory compliance, eDiscovery, and information governance demands. I’d expect that this stratification to accelerate as due diligence processes mature and non-IT stakeholders (e.g. legal, compliance, IT security) increasingly shape cloud requirements.

4. Migration friction falling: the time, cost, and disruption of moving off over-grown, poorly performing on-premise legacy systems has represented the largest – and most uncertain – variable in the 1-3 year archive planning cycles for many organizations. Consequently, some have stayed with outdated systems even when those products had reached end-of-life, end-of-support, or had been sold off to small consulting outfits (e.g. http://capaxdiscovery.com/pdfs/Capax%20HP%20EAS,%20Nearpoint,%20and%20CAMM%20announcement%2019%20Sept%202014%20v2.pdf). But, that switching cost is falling as more migration options are available, migration tools improve, and firms with eDiscovery pedigrees (e.g. DTI) become more active in the migration market.

5. Convergence is coming:  As witnessed daily, data security and privacy are becoming top C-level priorities for more and more organizations. This is also impacting the information archiving market, as CISOs become more active in buying cycles and firms look at how potential risks of cyber-attack or data breach can be mitigated across their information management investments. As one tangible example, Gartner, for the first time, publishing an accompanying piece titled “Financial Services Context”, where they called out capabilities uniquely suited to complex regulatory compliance. This need for integrated security and compliance will drive a greater shared view of information value and risk, and will lead more firms to create cross-functional forums in attempt to reconcile priorities in areas such as policy management and data classification.

1 Source: Magic Quadrant for Enterprise Information Archiving by Alan Dayley, Garth Landers, Anthony Kros, and Jie Zhang, Gartner, Inc., November 10, 2014

How Proofpoint Can Help

Proofpoint Enterprise Archive is a next generation archiving solution that addresses three key challenges—legal discovery, regulatory compliance, and end user email access—without the headaches of managing archiving in-house. Built with an architecture explicitly designed to leverage the cloud, Proofpoint Enterprise Archive is up-and-running in days, delivering low, predictable lifetime cost, and scales to handle the largest global organizations. All data stored in the archive is secured via Proofpoint’s patented DoubleBlindTM Key Architecture ensuring only customers have keys to access unencrypted information. Backed by a search performance guarantee, Proofpoint Enterprise Archive searches are sustainably fast and reliable across email, documents, instant messages and social media content. This functionality scales even as archived data volume reaches to hundreds of terabytes in size.

To further extend visibility and security, many organizations complement Proofpoint Enterprise Archive with Proofpoint Enterprise Governance. This full information governance suite allows organizations to proactively monitor and control critical information—wherever it resides. With Proofpoint, organizations can efficiently track, classify, monitor and apply policies to unstructured information across the enterprise. Most recently, Proofpoint further enhanced its social media compliance and security offerings with the acquisition of Nexgate. This addition allows Proofpoint customers to harness social media opportunities, mitigate information risks and satisfy evolving regulatory mandates.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

---

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

Linkedin_icon Twitter-icon1  

October 24, 2014

What do naked mole rats teach us about information governance?

ARMA 2014: Stephen Chan, senior director of Products and Information Governance, will present “Informational Convergence—corporate departments are increasingly in need of corporate wide classifications that span the needs of security, legal and records management.” His presentation will take place at 11:15 a.m. PDT (2:15 p.m. EDT) on Sunday, October 26 in the San Diego Convention Center, Hall Room 528.

---

Naked mole rat

Despite being named 2013’s Vertebrate of the Year, this little fellow did not appear on the cover of People, US, or other checkout counter fare.

Still, some of you may already know of the naked mole rat, a unique and unusual species and one of the best examples of convergent evolution.

Apart from their singular appearance, naked mole rats have quite a few remarkable characteristics. They are insensitive to pain. They do not get cancer. They live as much as 30 times as long as typical rats. They are like little yogis, decreasing their heart rate and metabolism when needed to survive periods of shortage.

But what’s most interesting, however, is that they are eusocial animals, living in colonies much like bees or ants with a single queen, a few males, and otherwise sterile workers and soldiers.

Despite their similarities, naked role mats, which are mammals, evolved this behavior independently from bees and ants, which are both part of the order Hymenoptera. This type of coincident in evolutionary biology is called convergent evolution, which describes biological systems that independently evolve similar traits to adapt to similar environments or to overcome similar survival challenges. It’s when a behavior is so advantageous that more than one organism evolves it.

Now what does this little guy have to do with our blog? Well, in the same way that convergent evolution exists in nature, so too can it come about in technology, and I believe we’re seeing the same thing happening with information governance, specifically with regards to content classification, which can be called Informational Convergence.

Whether you’re an attorney, a records manager, or a CISO, you’re a stakeholder who is highly concerned with risk and looking for tools that can help classify and identify where information breaches would be most disruptive and damaging. To do this, companies are demanding strong, sophisticated classification tools to identify important or sensitive data. Where informational convergence comes into play is despite the broad types of stakeholders that need classification, all need the same thing, accurate classification. It does not matter what topics firms are classifying for, so long as it is accurate. What organizations do with their content after classification has taken place, such as legal hold, quarantine, disposition, etc.  is still important, of course, but the domain where the most improvements are being demanded and must be made are with new, accurate, and cost effective classifying technologies.                                                                                                                               

While convergent evolution in nature occurs where two different organisms evolve similar characteristics or behaviors, informational convergence describes how groups or departments within organizations are demanding the same or similar capabilities. As technology vendors, we want to identify and meet new customer needs. As Proofpoint, we’re identifying the organizational domains with the greatest need when it comes to classification, particularly where our current coverage areas are strong. In Proofpoint’s case, this in the areas of e-discovery, security, and records management.

Over the next year, technologies related to classification both novel and tried will continue to pop up. Proofpoint will look to innovate in ways that can best provide customers with a holistic solution that classifies across a broad range of roles and in a highly accurate and cost effective manner, creating a robust and durable solution, just like the naked mole rat.

---

Stephen Chan Blue Bckgnd

Stephen leads products for the Information Governance team at Proofpoint. Successfully merging 15 years of expertise in the areas of e-discovery, compliance, and records management together with their most relevant technologies, Stephen drives thought leadership in the industry and has advised the SEC and Global 1,000 organizations. Prior to Proofpoint, Stephen was co-founder of several enterprise and consumer software firms, served as primary investigator on two government funded research projects, and has been published in over twenty magazines and books. Stephen is a graduate of the University of California at Davis and Harvard University.

Linkedin_icon Twitter-icon1  

September 04, 2014

Social Media and Regulatory Compliance?

Register Now for our upcoming Live Demo focused on social media and regulatory compliance next Wednesday, Sept. 10 at 11:00am PST. We will discuss the core requirements that any FINRA, SEC, IIROC or FCA regulated firm should be considering in order to minimize compliance risk, while also highlighting the Proofpoint Social Platform for Archiving.

---

Not a surprise, but noteworthy to see the interest level surrounding social media and regulatory compliance at the recent LIMRA Social Media for Financial Services conference in Boston. Good coverage provided here by Forbes Magazine.

Two interesting comments by Thomas Selman of FINRA were noted by Forbes that resulted from last summer's Social Media Sweep conducted against 23 FINRA regulated firms. Namely that, while over-all compliance appears to be good, regulatory concern has arisen that:

  • Registered reps claimed more acumen than they had.
  • Business records were stored in such a way that the social media formatting was lost when retrieved. This presents a real challenge to supervisory review.

Both concerns have been previously noted here, along with others that can arise if utilizing social archiving solutions not designed to withstand the rigors of financial regulatory compliance. For example, if:

  • methods used to collect content are not complete or comprehensive;
  • dependence of manual methods to map social identities to Active Directory information;
  • use of data storage that does not ensure information is stored immutably according to defined retention requirements;
  • data privacy and/or data security capabilities that do not meet internal IT standards
  • review of social content for regulatory requires the deployment of new tools and costly and time consuming data migration

So, how can Proofpoint help?

Proofpoint’s Social Platform for Archiving automates the capture and archiving of social media content from specific social channels as required for regulatory purposes. Native APIs are used to capture social content from leading channels including Salesforce Chatter, Microsoft Yammer, LinkedIn, Facebook, and Twitter – with all content captured to establish a complete regulatory record. Social content is then fully integrated into the archiving solution that you already have in place, thereby eliminating the need to manage multiple supervisory tools for regulatory compliance. This enables the compliance officer to view the entire context of the content in each captured item, enabling fast and efficient compliance review  in light of requirements set forth by IIROC and other regulatory entities.

---

ChrisRicciutiNewChristopher Ricciuti is Vice President of Financial Services Archiving Solutions at Proofpoint, where he brings 10+ years of Financial Services industry experience. He focuses mainly on helping regulated organizations leverage next-gen communication technologies, such as social media, while maintaining regulatory compliance. Prior to Proofpoint, Christopher worked as a CTO on Wall Street and founded eDynamics, a social media compliance start-up. He holds an MBA from Babson College. 

Linkedin_icon Twitter-icon1

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

 Linkedin_icon Twitter-icon1  

August 22, 2014

ILTA14 Highlights the Importance of CTRL

#ILTA14 Marks Debut of CTRL: The Coalition of Technology Resources for Lawyers

http://www.businesswire.com/news/home/20140820005167/en/ILTA-Marks-Debut-CTRL-Coalition-Technology-Resources#.U_TJ1GMx5i8

End of another great ILTA conference, with plenty of interest around information, cloud - and a significant increase in interest around data privacy and security. ILTA also provided a good forum to launch an interesting new initiative - the Coalition of Technology Resources for Lawyers (CTRL) - aiming to address the challenges created by the lack of standards and shared cross-functional vocabulary to describe the intersection of technology and daily needs of those in the legal profession. The challenge the coalition expects to tackle is well stated on the CTRL website (http://ctrlinitiative.com/) :

The availability of technology—even within the practice of law—has increased just as has the volume and complexity of discoverable information. But instead of the discovery process benefiting directly from these advances, technological unease has resulted largely in an e-discovery culture of bare-bones compliance, where technology remains a necessary evil and little more than a tactical means-to-an-end within a deadline-intensive environment

We believe the initiative is directly in line with our history and strategy of helping our clients to proactively control and protect critical information. Our involvement is driven by several factors:

  • The unchecked growth of data volume and proliferation: as stated many times here, information doubling in the next 2.5 years, more of it uniquely in mobile + social + cloud. The challenge of controlling information will never get any easier - and the need for standards to drive greater data leverage and re-use never greater
  • The collision of InfoGov and eDiscovery: moving away from the tactical, event-driven model of Discovery start with arriving at a cross-functional view of data value and risk - efforts such as CTRL can help drive the vocabulary
  • The trend toward converged InfoGov and InfoSec priorities: as soon as the eDiscovery world begins to embrace the InfoGov concepts and stakeholders, we are seeing another set of stakeholders join the discussion representing information security and data privacy. The reasons are obvious given the frequency and repercussions of data breach. The addition of the Chief Security Office adds yet another language and priorities, but one that must be heard in order to move from the culture of bare-bones compliance

We look forward to contributing to the dialog.

---

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

Linkedin_icon Twitter-icon1  

August 12, 2014

Top 5 InfoGov Drivers of 1h 2014

We are a bit late, but thought it would be a good time to revisit some of the key drivers that have shaped the #InfoGov landscape in the 1st half of 2014. A few surprises in comparing to our January predictions (http://blog.proofpoint.com/2014/01/top-5-infogov-trends-for-2014.html), but the general trend line shows that information governance is becoming prioritized as a top initiative by more organizations than ever. So, here are the Top 5 InfoGov Drivers we've seen so far this year:

  1. Cloud buyers become more discriminating: without a doubt, cloud adoption has accelerated in the first half of 2014, in particular in application areas that have been plagued with unchecked data growth - and the resulting challenge and headache of managing large on-premise data repositories. In fact, Gartner has stated that over 70% of all new information archive deployments are now cloud-based. However, as the use cases where cloud-based options are available expands, buyers have also become more rigorous in their due diligence efforts. For example, those with larger volumes of eDiscovery with multi-national scope are diving deeper into the cloud provider's ability to meet the complex web of regulatory and data privacy requirements. Clearly, cloud-based solutions are not homogenous, and cloud market maturity is driving more toward solutions designed to meet their use cases as opposed to merely providing cheaper storage and reduced IT hassle. There is no 'one-size-fits-all' in the cloud. (Robert)
  2. Office 365 adoption continues: Microsoft continues to invest heavily in Office 365, and appears to be pleased with the rate it’s converting its Exchange install base. Earlier this year, the company revealed a roadmap inclusive of critical security and information governance functionality. For example, they have committed to bring DLP capabilities to SharePoint while also expanding the number of mailboxes in scope―from 5,000 to unlimited―for an eDiscovery search. This is clearly an attempt to address the needs of larger organizations with more stringent security, eDiscovery and compliance requirements. We expect Microsoft to continue investing here through technology partnerships and acquisitions, while also gradually building out basic functionality at a clip that’s somewhat slower than what’s demanded by the market. (Joe D)
  3. Enterprise Social Media Explodes: As we’re sure you’ve noticed, electronic communications have evolved beyond more traditional forms such as email. And while organizations have since found novel ways to best leverage this evolution, such as selling and marketing, they’ve not always done so with Information Governance in mind. The fact is, Social Media use is downright dangerous if correct governance controls are not put in place and the need to capture, archive, retain and discover Social Media content has, as a result, never been greater. Regulators are increasing taking note - mandates and fines around Social Media information governance are on the rise. Smart organizations, therefore, have Information Governance controls around their Social Media use in place, and organizations that neglect this important issue do so at their own peril (Chris Riciutti)
  4. InfoSec and InfoGov Collide: As the urgency around data security and data privacy commands more focus at C-level, we are seeing an increased level of involvement from Chief Security Officers in InfoGov initiatives. This appears to be in part due to priorities that already were aligned, but simply separated by organizational lines with different vocabularies. Information risk is described with one set of terminologies by the security office versus those in the regulatory compliance department or within inside counsel. Ultimately, we expect to see information security and privacy as full-fledged stakeholders within infogov initiatives, and within standing working groups and committees tasked with reducing information risk across multiple application areas and functions (Stephen)
  5. eDiscovery dependency on InfoGov becomes clearer: the first half of 2014 spotlighted a number of topics that impact organizational InfoGov efforts including the continued rise in eDiscovery expense, the realities of new FRCP rules to create uniform standards for failure to preserve ESI and elevate the proportionality standard, and the increased adoption of predictive and technology assisted review approaches. The continued reality, however, is the data volume continues to explode, increasingly in unmanaged locations including social media, mobile, cloud, and networked file share locations. eDiscovery tools designed to address clean, context-specific datasets are proving to have limited practice use in attacking large, overgrown information repositories and dark data locations. The value of proactive technologies and internal processes to identify and track data so that value can be separated from junk has never been higher (Robert)

We look forward to the InfoGov momentum continuing for the remainder of 2014.

-Joe, Stephen, Chris, Robert

---

Joe-diamondJoe has more than a decade of engineering, product management, product marketing and software leadership expertise in both the consumer and enterprise markets. In his role at Proofpoint, Joe is responsible for defining and bringing to market Proofpoint's next generation information governance products. Prior to Proofpoint, Joe was the Head of Product Management & Marketing for RiskIQ, led enterprise product management for Symantec's Emerging Products and Technologies and served in product management and marketing roles for hosted email archiving vendor LiveOffice, which was acquired by Symantec.

 

 

 

Stephen Chan Blue BckgndStephen leads products for the Information Governance team at Proofpoint. Successfully merging 15 years of expertise in the areas of e-discovery, compliance, and records management together with their most relevant technologies, Stephen drives thought leadership in the industry and has advised the SEC and Global 1,000 organizations. Prior to Proofpoint, Stephen was co-founder of several enterprise and consumer software firms, served as primary investigator on two government funded research projects, and has been published in over twenty magazines and books. Stephen is a graduate of the University of California at Davis and Harvard University.

Linkedin_icon Twitter-icon1  

ChrisRicciutiNewChristopher Ricciuti is Vice President of Financial Services Archiving Solutions at Proofpoint, where he brings 10+ years of Financial Services industry experience. He focuses mainly on helping regulated organizations leverage next-gen communication technologies, such as social media, while maintaining regulatory compliance. Prior to Proofpoint, Christopher worked as a CTO on Wall Street and founded eDynamics, a social media compliance start-up. He holds an MBA from Babson College. 

 Linkedin_icon Twitter-icon1

Robert.Cruz150x175Robert Cruz is Senior Director of eDiscovery and Information Governance, bringing 20+ years of Silicon Valley based subject matter expertise in the areas of eDiscovery and regulatory compliance. He works with Proofpoint customers via workshops, seminars, and industry conferences to share best practices and review changes in regulatory environments. He previously held similar posts within the ECM and eDiscovery markets, and holds an MBA from Stanford University.

Linkedin_icon Twitter-icon1  

July 16, 2014

How big of a threat is intellectual property theft?

While digital solutions like email, mobile devices and the cloud have greatly benefited most businesses, they also raise the specter of intellectual property theft. In order to safeguard mission-critical assets at all times, companies should adopt enterprise security solutions from Proofpoint to make sure their intellectual property is never leaked out or stolen.

In a recent speech to filmmakers, media professionals and other businesspeople, Vice President Joe Biden said that intellectual property theft is a multibillion-dollar issue, according to The Hollywood Reporter. As the Internet rose in prominence, however, the threat landscape changed dramatically. For example, Biden said that instead of bringing a camcorder into a movie theater, someone can get an illegal recording of that film much more easily online. This is just one example of how it has become easier than ever for criminals to pilfer intellectual property.

While exact numbers related to the overall costs of IP theft are not known, most estimates corroborate the figure Biden noted. A May 2013 report from The Commission on the Theft of American Intellectual Property estimated that the United States loses more than $300 billion a year from this issue, and numbers cited by the National Crime Prevention Council put potential losses at up to $5.5 trillion.

Although IP theft is often considered a victimless crime, the NCPC noted that it is typically anything but that. The crime inhibits many companies' ability to grow and hire, and often businesses need to recoup related losses by charging consumers more for their goods or services.

"The effects of this theft are twofold," The IP Commission Report stated. "The first is the tremendous loss of revenue and reward for those who made the inventions or who have purchased licenses to provide goods and services based on them, as well as of the jobs associated with those losses. American companies of all sizes are victimized. The second and even more pernicious effect is that illegal theft of intellectual property is undermining both the means and the incentive for entrepreneurs to innovate, which will slow the development of new inventions and industries that can further expand the world economy and continue to raise the prosperity and quality of life for everyone."

How can companies stem the IP theft tide?
The situation relating to IP today may seem dire, but companies can take steps to significantly insulate themselves against this threat. In particular, by adopting a best-in-class suite of cybersecurity solutions from Proofpoint, businesses will be able to keep their trade secrets, patents and other pieces of intellectual property safe from harm.

For example, Proofpoint Enterprise Archive allows organizations to keep a thorough record of all online messaging, and Proofpoint Enterprise Privacy secures email and other forms of communication that may contain sensitive information. To keep threats like malware on the outside looking in, businesses can use Proofpoint Enterprise Protection.

Only by leveraging a comprehensive and powerful data security and privacy suite will businesses be able to safeguard all of their intellectual property. As the IP threat environment grows larger and more potent, Proofpoint's solutions will become even more vital and mission critical for organizations operating in a wide variety of industries.

July 09, 2014

A CISO, GC, and Records Manager Walk into a Bar…

THE JOKE

A CISO, GC, and Records Manager walk into a bar.

The CISO says, “Can you believe a guy just tried to sell me a tool that can guarantee when intellectual property is about to leave my network?”

The GC says, “That’s hilarious, I just talked with a man who told me his software can tell me exactly where the smoking guns are amongst my entire corpus of data.”

The Records Manager says, “That’s odd because I just read about a solution claiming it can scan all my files and classify records according to my file plan.”

 The trio quickly realized they were all talking about the same solution. Of course, such “all in one” claims will cause many of us to drop to the floor, rolling with laughter. Yet, the statement above - while not remotely imaginable even a few years ago - today, is not that far off.

 THE SETUP

 CISO have no problem getting attention. Every hour, each day is another headline that keeps them up at night. Most recently, Goldman Sachs accidentally sent highly confidential information about its brokerage clients to a Google account, immediately going into damage control, requesting Google to block access to the email and to delete it. This type of exposure will continue to increase as the amount of sensitive information increases; as the number of locations sensitive information is stored in increases, and as the number of channels through which sensitive information can be passed increases.

 Breaches are happening every day around the world.

 GC’s have a sleep schedule similar to the CISO. However, their greatest challenge is identifying, controlling, and sifting through gigabytes of business documents typically associated with eDiscovery and large scale investigations. Doing so with a defensible process only adds to the Sominex bill.

 The sheep counting culprit is not only the amount of unstructured corporate information, (growing by at least 60% per year per IDG by 800% over the next 5 years per Gartner), but that information increasingly exists in new, often unmanaged data types such as social media, IM, and mobile.

 Records managers face a more insidious threat in that co-workers often choose the path of least resistance when it comes to records management, and this means any remotely complex policy will be casually ignored or circumvented. The consequences are tangible and often quantifiable when the company is in a regulated industry such as healthcare.

 THE DELIVERY

 Speaking to Jason R. Baron, former law of records management Jedi of NARA and now Of Counsel at Drinker Biddle & Reath LLP, he described the solution (and problem) of records management, in the most elegant fashion. Paraphrasing, there are two requirements for records management to work: 1) Simpler policies, 2) Machine assistance.

 While Jason is doing great work in helping firms simplify policies, it will be up to technology firms to ante up with usable, workable, and scalable machine assisted technologies to address the second requirement.

 Considering Jason’s points and listening to customers talk about their concerns around security, privacy, compliance, and records, it’s clear to me that there is an Informational Convergence taking place where corporate information, regardless of its business use or risk profile, is increasingly in need of a common, firm wide classification. This means centralized classification that can be shared across all groups, stakeholders, or leaders; be they CISOs, GCs, or records managers.

 Impossible?  Conventional wisdom divides departments into distinct groups possessing their unique view of information and what it means. The joke works because CISOs think differently from GCs who in turn differ from records managers. Or do they? The tenth time I heard a CISO ask if our DLP technology could be used to help their current records classification efforts I raised an eyebrow. Once ten records managers asked about the possibility of flagging records for security violations, I realized that the market is ignoring conventional thinking.

 The Informational Convergence of Information Governance (IG) provides a holistic view across every information-driven department. Each department is asking for the same thing in their own way and soon companies will realize this. As thought leading technology firms, we need to enable them.

 An equally important side effect to Informational Convergence is the need for IG platforms to support more sophisticated and cloudy ecosystems. Business relevant, cloud-based repositories are also corporate content containers and exposure points. Their rising popularity demands that the most advanced IG platforms support them as well as conventional repositories. Solutions like Box, Dropbox, or OneDrive, contain records, legal content, and represent risk like any other repository.

 THE PUNCHLINE

There are actually several punch lines to this joke. The saddest version is that no one knows what the records manager thinks about the solution because they forgot to invite him to the meeting. As noted above, this only makes everyone’s job harder because proper records management helps everyone in the end.

 I’ll also note that some to whom I’ve told this story have immediately declared it a lie. That it’s all just a dream. Not because the notion of Informational Convergence is too complex to conceive. No. It’s because no one would ever believe these three individuals would be caught socializing.

- Stephen Chan

 ---

Stephen Chan Blue Bckgnd

Stephen leads products for the Information Governance team at Proofpoint. Successfully merging 15 years of expertise in the areas of e-discovery, compliance, and records management together with their most relevant technologies, Stephen drives thought leadership in the industry and has advised the SEC and Global 1,000 organizations. Prior to Proofpoint, Stephen was co-founder of several enterprise and consumer software firms, served as primary investigator on two government funded research projects, and has been published in over twenty magazines and books. Stephen is a graduate of the University of California at Davis and Harvard University.

Linkedin_icon Twitter-icon1  

July 01, 2014

Why All Libraries Need Robust Cybersecurity Solutions

As libraries transform from places to check out books into a critical digital resource for many people, these public services need to adopt best-of-breed cybersecurity solutions from Proofpoint to ensure that public computers remain safe and usable.

Libraries have always been a source of learning within communities, but now a lot of that education happens online instead of from books or periodicals. For many individuals today, the public library is their go-to option for getting online, checking email and browsing the Web. According to the latest statistics from the Pew Research Center, among those in the United States over the age of 16 that use the Internet at a library, 63 percent were browsing the Web for leisure and 54 percent said they checked email there.

In addition, numbers from the American Library Association just how critical these public services are for many people today. More than three-fourths of libraries provide Wi-Fi access, and 98.7 percent of them offer Internet access at no charge. Furthermore, not only does the average library now have around 11 computers per each facility, but more than 71 percent of libraries say they are the only source of free Internet access in their general vicinity.

But, too often, this rise in Internet usage at libraries does not accompany increased cybersecurity. The ALA noted that many of those who use library computers are not tech savvy, which means that they could inadvertently be introducing malware onto the library's network. Considering how many people are using these machines, libraries need to take every step possible to ensure that one lapse in judgment does not compromise the assets of hundreds or thousands of people.

"Think about it: Your constituents, volunteers, and donors entrust their personal information with you," TechSoup contributor Zac Mutrux wrote. "If you're not taking steps to secure your data, including using antivirus and anti-spyware software, their information may not be safe. Information security breaches can have major legal and financial ramifications."

Case study: South Dakota Library Network
For libraries that often strapped for cash, trying to keep their IT assets safe from the myriad threats that abound in cyberspace can seem like an insurmountable task. Users can accidentally click on a bad link in an email, and malware has become especially adept at duping unsuspecting people. Libraries may think that the only effective response to these issues is unobtainable to them, but the South Dakota Library Network shows that libraries can have all of their major cybersecurity needs covered with a suite of solutions with Proofpoint. Now, the South Dakota Library Network is able to effectively eliminate spam, encrypts emails, protect the network against viruses and ensure that all of their compliance needs are met.

"The Proofpoint Messaging Security Gateway has worked exactly as we've needed it to, eliminating all types of spam messages and detecting a wide variety confidential information with very high accuracy," said Sean Crooks, systems administrator with South Dakota Library Network. "As an added bonus, the appliance truly runs itself, requiring less than an hour of my time per week for administration."

June 04, 2014

New cybercrime survey highlights need for data loss prevention

06042014_keyThe amount of information companies store online increases everyday and its leading to an surge in cybersecurity incidents, creating a need for stronger data loss prevention solutions. A recent PricewaterhouseCoopers survey underscored the rising discrepancies between the number of cyber incidents and the extent of the data loss prevention techniques put in place by vulnerable organizations.

"Despite substantial investments in cybersecurity technologies, cyber criminals continue to find ways to circumvent these technologies in order to obtain sensitive information that they can monetize," said U.S. Secret Service Criminal Investigative Division special agent in charge Ed Lowery.

Fifty-nine percent of those surveyed said that cybersecurity was more of a concern this year than it had been in the past, but less than half of all respondents had implemented a plan for responding to threats.

Perhaps because of a lack of preparedness, 77 percent of participants said they experienced a security incident in the last 12 months, and 34 percent said this year brought an increase in the number of security events from the previous year. According to the report, organizations experienced an average of 135 security events in the past year. Not all of those surveyed were able to estimate the cost of a security breach on their organization, but for those who could, the average annual monetary loss was $415,000.

According to PwC's Annual Global CEO Survey, 69 percent of U.S. executives are concerned that cybersecurity issues could curtail their organizations' growth. Despite the fear, many businesses still don't take steps to secure many new types of technology.

"Cybersecurity for disruptive technologies remains inadequate when considering Bring Your Own Device, cloud, [and] Software Defined Networking are always put in place first and then secured later," said vice president and publisher of CSO Magazine Bob Bragdon.

Three thousand organizations reported that they were not aware of any breach of their cybersecurity until they were notified by the FBI, according to the cybercrime survey.

"The United States faces real [cybersecurity] threats from criminals, terrorists, spies and malicious cyber actors," said FBI director James Comey. "The playground is a very dangerous place right now."

Protecting enterprise documents
There are a variety of data loss prevention solutions that companies can employ to better protect against cyberthreats. Proofpoint's digital asset security provides document fingerprinting that allows unstructured data to be accurately detected. Specific folders containing sensitive enterprise documents can be monitored and managed. The documents within the selected folders are fingerprinted and can be recognized either partially or fully by the program, whether in the original file format or not.

March 17, 2014

Office365 and eDiscovery? The confusion continues…

 

Ediscovery

Speaking to many customers considering Microsoft Office365 and its new features for eDiscovery leads me to one and only one conclusion: the confusion continues.

Articles published by Microsoft and others that have seen preview of the technology reinforce this point. (See here, referencing a Microsoft webinar where “no specifics were provided”). Hmmm.

Those looking for a simple, straight forward answer as to whether Office365 alone is sufficient to address one’s eDiscovery burdens will be greatly disappointed. No one likes to see a response of “it depends” to a simple RFP question. But, it depends. So, here are 5 simple questions to ask yourselves to determine whether Office365 could be sufficient to address your specific demands.

First, a simple question – do you work for a financial services provider? If yes, stop here. Office 365 and Exchange 2013 do not address requirements outlined by SEC 17a3-4 that outline how data must be stored immutably, or supervisory review requirements under FINRA. You should be engaging with archiving or data storage providers to address these requirements.

1. Do you need to conduct real-time, iterative search against multiple matters concurrently? Office 365 relies upon a batch-based searching process that is not designed for  large scale search – nor unlimited search against concurrent matters. IT must break up requests into multiple smaller searches, introducing multiple points of failure and unknown performance. Limits of 2 concurrent searches is difficult if you have (hmmm) 3 time sensitive matters.

2. Do you need to conduct keyword search against an entire enterprise or large department? Again, the number of mailboxes that can be searched is limited (and continues to be changed by Microsoft – is it 50 mailboxes? 500?). Not ideal for investigative purposes where a set of keywords are known, but the custodian scope/scale is not yet defined.

3. Do you need to search against non-Microsoft office content types? On average, organizations deal with 400+ different attachment types within email alone, and must be able to capture and extract text of these file types prior to sending to a storage environment in order to search and retrieve later. Office 365 cannot help you here.

4. Do you have strict retention and enforcement mandates? Within Office365, email is archived only after a configured time period (default is 2 years). Users can delete or otherwise do as they chose beforehand. In fact, per Microsoft’s own documentation: “Important   MRM doesn’t guarantee retention of every message. For example, a user can delete or remove a message from their mailbox before the message reaches its retention age; MRM isn't designed to prevent users from deleting their own messages.”

5. Do you need it now? Short term, inflexible discovery demands are challenged when all content sources must be within Exchange 2013 to be useable. And, when Microsoft lacks tools to migrate data from earlier versions of Exchange and third party archives that leverage the accepted industry standard approach of journaling. And, when IT command line tools must be used when tasks exceed the existing features – such as creating and managing multiple retention policies through Microsoft’s rolling hold features. And, when archived data needs to be manually segregated for ethical wall or local data privacy adherence. And, when non-Microsoft content must be manually collected, searched, and processed through other systems.

Like with any other early stage software, it is easy for technologists to give the “yes, it can be done” or “yes, on our roadmap” response question to address functional requirements that today do not exist in the product. But, is this adequate to address the immediate, real-time, and unpredictable nature of eDiscovery that your company faces?

“It depends”, as they say.

Archives

Blog Search

Email Security Gateways, 2012

Magic Quadrant

Tweets

What people are saying right now about us.

©2012 Proofpoint, Inc.
threat protection: Proofpoint Enterprise Protection compliance: Proofpoint Enterprise Privacy governance: Proofpoint Enterprise Archive secure communication: Proofpoint Encryption