💾 Archived View for gmi.noulin.net › mobileNews › 2915.gmi captured on 2021-12-05 at 23:47:19. Gemini links have been rewritten to link to archived content

View Raw

More Information

⬅️ Previous capture (2021-12-03)

➡️ Next capture (2023-01-29)

-=-=-=-=-=-=-

The leaky corporation

Companies and information

Digital information is easy not only to store but also to leak. Companies must

decide what they really need to keep secret, and how best to do so

Feb 24th 2011 | from the print edition

IN EARLY February Hewlett-Packard showed off its new tablet computer, which it

hopes will be a rival to Apple s iPad. The event was less exciting than it

might have been, thanks to the leaking of the design in mid-January. Other

technology companies have suffered similar embarrassments lately. Dell s

timetable for bringing tablets to market appeared on a tech-news website. A

schedule for new products from NVIDIA, which makes graphics chips, also seeped

out.

Geeks aren t the only ones who can t keep a secret. In January it emerged that

Renault had suspended three senior executives, allegedly for passing on

blueprints for electric cars (which the executives deny). An American radio

show has claimed to have found the recipe for Coca-Cola s secret ingredient in

an old newspaper photograph. Facebook s corporate privacy settings went awry

when some of the social network s finances were published. A strategy document

from AOL came to light, revealing that the internet and media firm s

journalists were expected to write five to ten articles a day.

Meanwhile, Julian Assange has been doing his best to make bankers sweat. In

November the founder of WikiLeaks promised a megaleak early in 2011. He was

said to be in possession of a hard drive from the laptop of a former executive

of an unnamed American bank, containing documents even more toxic than the

copiously leaked diplomatic cables from the State Department. They would reveal

an ecosystem of corruption and take down a bank or two .

I think it s great, Mr Assange said in a television interview in January. We

have all these banks squirming, thinking maybe it s them. At Bank of America

(BofA), widely thought to be the bank in question, an internal investigation

began. Had any laptop gone missing? What could be on its hard drive? And how

should BofA react if, say, compromising e-mails were leaked?

The bank s bosses and investigators can relax a bit. Recent reports say that Mr

Assange has acknowledged in private that the material may be less revealing

than he had suggested. Financial experts would be needed to determine whether

any of it was at all newsworthy.

Even so, the WikiLeaks threat and the persistent leaking of other supposedly

confidential corporate information have brought an important issue to the fore.

Companies are creating an ever-growing pile of digital information, from

product designs to employees e-mails. Keeping tabs on it all is increasingly

hard, not only because there is so much of it but also because of the ease of

storing and sending it. Much of this information would do little damage if it

seeped into the outside world; some of it, indeed, might well do some good. But

some could also be valuable to competitors or simply embarrassing and needs to

be protected. Companies therefore have to decide what they should try to keep

to themselves and how best to secure it.

Trying to prevent leaks by employees or to fight off hackers only helps so

much. Powerful forces are pushing companies to become more transparent.

Technology is turning the firm, long a safe box for information, into something

more like a sieve, unable to contain all its data. Furthermore, transparency

can bring huge benefits. The end result will be more openness, predicts Bruce

Schneier, a data-security guru.

From safe to sieve

When corporate information lived only on paper, which was complemented by

microfilm about 50 years ago, it was much easier to manage and protect than it

is today. Accountants and archivists classified it; the most secret documents

were put in a safe. Copying was difficult: it would have taken Bradley Manning,

the soldier who is alleged to have sent the diplomatic cables to WikiLeaks,

years to photograph or smuggle out all the 250,000 documents he is said to have

downloaded assuming that he was not detected.

Things did not change much when computers first made an appearance in firms.

They were used mostly for accounting or other transactions, known as

structured information . And they were self-contained systems to which few

people had access. Even the introduction in the 1980s of more decentralised

information-technology (IT) systems and personal computers (PCs) did not make

much of a difference. PCs served at first as glorified typewriters.

It was only with the advent of the internet and its corporate counterpart, the

intranet, that information began to flow more quickly. Employees had access to

lots more data and could exchange electronic messages with the outer world. PCs

became a receptacle for huge amounts of unstructured information , such as

text files and presentations. The banker s hard drive in Mr Assange s

possession is rumoured to contain several years worth of e-mails and

attachments.

Now an even more important change is taking place. So far firms have spent

their IT budgets mostly on what Geoffrey Moore of TCG Advisors, a firm of

consultants, calls systems of record , which track the flow of money, products

and people within a company and, more recently, its network of suppliers. Now,

he says, firms are increasingly investing in systems of engagement . By this

he means all kinds of technologies that digitise, speed up and automate a firm

s interaction with the outer world.

Mobile devices, video conferencing and online chat are the most obvious

examples of these technologies: they allow instant communication. But they are

only part of the picture, says Mr Moore. Equally important are a growing number

of tools that enable new forms of collaboration: employees collectively edit

online documents, called wikis; web-conferencing services help firms and their

customers to design products together; and smartphone applications let

companies collect information about people s likes and dislikes and hence about

market trends.

It is easy to see how such services will produce ever more data. They are one

reason why IDC, a market-research firm, predicts that the digital universe ,

the amount of digital information created and replicated in a year, will

increase to 35 zettabytes by 2020, from less than 1 zettabyte in 2009 (see

chart); 1 zettabyte is 1 trillion gigabytes, or the equivalent of 250 billion

DVDs. But these tools will also make a firm s borders ever more porous.

WikiLeaks is just a reflection of the problem that more and more data are

produced and can leak out, says John Mancini, president of AIIM, an

organisation dedicated to improving information management.

Two other developments are also poking holes in companies digital firewalls.

One is outsourcing: contractors often need to be connected to their clients

computer systems. The other is employees own gadgets. Younger staff,

especially, who are attuned to easy-to-use consumer technology, want to bring

their own gear to work. They don t like to use a boring corporate BlackBerry,

explains Mr Mancini.

The data drain

As a result, more and more data are seeping out of companies, even of the sort

that should be well protected. When Eric Johnson of the Tuck School of Business

at Dartmouth College and his fellow researchers went through popular

file-sharing services last year, they found files that contained health-related

information as well as names, addresses and dates of birth. In many cases,

explains Mr Johnson, the reason for such leaks is not malice or even

recklessness, but that corporate applications are often difficult to use, in

particular in health care. To be able to work better with data, employees often

transfer them into spreadsheets and other types of files that are easier to

manipulate but also easier to lose control of.

Although most leaks are not deliberate, many are. Renault, for example, claims

to be a victim of industrial espionage. In a prominent insider-trading case in

the United States, some hedge-fund managers are accused of having benefited

from data leaked from Taiwanese semiconductor foundries, including spreadsheets

showing the orders and thus the sales expectations of their customers.

Not surprisingly, therefore, companies feel a growing urge to prevent leaks.

The pressure is regulatory as well as commercial. Stricter data-protection and

other rules are also pushing firms to keep a closer watch on information. In

America, for instance, the Health Insurance Portability and Accountability Act

(HIPAA) introduced security standards for personal health data. In lawsuits

companies must be able to produce all relevant digital information in court. No

wonder that some executives have taken to using e-mail sparingly or not at all.

Whole companies, however, cannot dodge the digital flow.

To help them plug the holes, companies are being offered special types of

software. One is called content management . Programs sold by Alfresco, EMC

Documentum and others let firms keep tabs on their digital content, classify it

and define who has access to it. A junior salesman, for instance, will not be

able to see the latest financial results before publication and thus cannot

send them to a friend.

Another type, in which Symantec and Websense are the market leaders, is data

loss prevention (DLP). This is software that sits at the edge of a firm s

network and inspects the outgoing data traffic. If it detects sensitive

information, it sounds the alarm and can block the incriminating bits. The

software is often used to prevent social-security and credit-card numbers from

leaving a company and thus make it comply with HIPAA and similar regulations.

A third field, newer than the first two, is network forensics . The idea is to

keep an eye on everything that is happening in a corporate network, and thus to

detect a leaker. NetWitness, a start-up company, says that its software records

all the digital goings-on and then looks for suspicious patterns, creating

real-time situation awareness , in the words of Edward Schwartz, its chief

security officer.

There are also any number of more exotic approaches. Autonomy, a British

software firm, offers bells in the dark . False records made-up pieces of

e-mail, say are spread around the network. Because they are false, no one

should gain access to them. If somebody does, an alarm is triggered, as a

burglar might set off an alarm breaking into a house at night.

These programs deter some leakers and keep employees from doing stupid things.

But reality rarely matches the marketing. Content-management programs are hard

to use and rarely fully implemented. Role-based access control sounds fine in

theory but is difficult in practice. Firms often do not know exactly what

access should be assigned to whom. Even if they do, jobs tend to change

quickly. A field study of an investment bank by Mr Johnson and his colleagues

found that one department of 3,000 employees saw 1,000 organisational changes

within only a few months.

This leads to what Mr Johnson calls over-entitlement . So that workers can get

their jobs done, they are given access to more information than they really

need. At the investment bank, more than 50% were over-entitled. Because access

is rarely revoked, over time employees gain the right to see more and more. In

some companies, Mr Johnson was able to predict a worker s length of employment

from how much access he had. But he adds that if role-based access control is

enforced too strictly, employees have too little data to do their jobs.

Similarly, DLP is no guarantee against leaks: because it cannot tell what is in

encrypted files, data can be wrapped up and smuggled out. Network forensics can

certainly show what is happening in a small group of people working on a

top-secret product. But it is hard to see how it can keep track of the

ever-growing traffic that passes through or leaves big corporate IT systems,

for instance through a simple memory stick (which plugs into a PC and can hold

the equivalent of dozens of feature-length films). Technology can t solve the

problem, just lower the probability of accidents, explains John Stewart, the

chief security officer of Cisco, a maker of networking equipment.

Other experts point out that companies face a fundamental difficulty. There is

a tension in handling large amounts of data that can be seen by many people,

argues Ross Anderson, of Cambridge University. If a system lets a few people do

only very simple things such as checking whether a product is available the

risks can be managed; but if it lets a lot of people do general inquiries it

becomes insecure. SIPRNet, where the American diplomatic cables given to

WikiLeaks had been stored, is a case in point: it provided generous access to

several hundred thousand people.

In the corporate world, to limit the channels through which data can escape,

some companies do not allow employees to bring their own gear to work or to use

memory sticks or certain online services. Although firms have probably become

more permissive since, a survey by Robert Half Technology, a recruitment

agency, found in 2009 that more than half of chief information officers in

America blocked the use of sites such as Facebook at work.

Yet this approach comes at a price, and not only because it makes a firm less

attractive to Facebook-using, iPhone-toting youngsters. More openness also

creates trust, argues Jeff Jarvis, a new-media sage who is writing a book

about the virtues of transparency, entitled Public Parts . Dell, he says,

gained a lot of goodwill when it started talking openly about its products

technical problems, such as exploding laptop batteries. If you open the

kimono, a lot of good things happen, says Don Tapscott, a management

consultant and author: it keeps the company honest, creates more loyalty among

employees and lowers transaction costs with suppliers.

More important still, if the McKinsey Global Institute, the research arm of a

consulting firm, has its numbers right, limiting the adoption of systems of

engagement can hurt profits. In a recent survey it found that firms that made

extensive use of social networks, wikis and so forth reaped important benefits,

including faster decision-making and increased innovation.

How then to strike the right balance between secrecy and transparency? It may

be useful to think of a computer network as being like a system of roads. Just

like accidents, leaks are bound to happen and attempts to stop the traffic will

fail, says Mr Schneier, the security expert. The best way to start reducing

accidents may not be employing more technology but making sure that staff

understand the rules of the road and its dangers. Transferring files onto a

home PC, for instance, can be a recipe for disaster. It may explain how health

data have found their way onto file-sharing networks. If a member of the

employee s family has joined such a network, the data can be replicated on many

other computers.

Don t do that again

Companies also have to set the right incentives. To avoid the problems of

role-based access control, Mr Johnson proposes a system akin to a speed trap:

it allows users to gain access to more data easily, but records what they do

and hands out penalties if they abuse the privilege. He reports that Intel, the

world s largest chipmaker, issues speeding tickets to employees who break its

rules.

Mr Johnson is the first to admit that this approach is too risky for data that

are very valuable or the release of which could cause a lot of damage. But most

companies do not even realise what kind of information they have and how

valuable or sensitive it is. They are often trying to protect everything

instead of concentrating on the important stuff, reports John Newton, the

chief technology officer of Alfresco.

The WikiLeaks incident is an opportunity to improve information governance,

wrote Debra Logan, an analyst at Gartner, a research firm, and her colleagues

in a recent note. A first step is to decide which data should be kept and for

how long; many firms store too much, making leaks more likely. In a second

round, says Ms Logan, companies must classify information according to how

sensitive it is. Only then can you have an intelligent discussion about what

to protect and what to do when something gets leaked.

Such an exercise could also be an occasion to develop what Mr Tapscott calls a

transparency strategy : how closed or open an organisation wants to be. The

answer depends on the business it is in. For companies such as Accenture, an IT

consultancy and outsourcing firm, security is a priority from the top down

because it is dealing with a lot of customer data, says Alastair MacWillson,

who runs its security business. Employees must undergo security training

regularly. As far as possible, software should control what leaves the company

s network. If you try to do something with your BlackBerry or your laptop that

you should not do, explains Mr MacWillson, the system will ask you: Should

you really be doing this?

At the other end of the scale is the Mozilla Foundation, which leads the

development of Firefox, an open-source browser. Transparency is not just a

natural inclination but a necessity, says Mitchell Baker, who chairs the

foundation. If Mozilla kept its cards close to the chest, its global community

of developers would not and could not help write the program. So it keeps

secrets to a minimum: employees personal information, data that business

partners do not want made public and security issues in its software.

Everything else can be found somewhere on Mozilla s many websites. And anyone

can take part in its weekly conference calls.

Few companies will go that far. But many will move in this direction. The

transparency strategy of Best Buy, an electronics retailer, is that its

customers should know as much as its employees. Twitter tells its employees

that they can tweet about anything, but that they should not do stupid things

. In the digital era of exploding quantities of data that are increasingly

hard to contain within companies systems, more companies are likely to become

more transparent. Mr Tapscott and Richard Hunter, another technology savant,

may not have been exaggerating much a decade ago, when they wrote books

foreseeing The Naked Corporation and a World Without Secrets .

mcji5os1 wrote:

Feb 24th 2011 8:43 GMT

Excellent article - sums it up well in two quotes:

(1) Technology can t solve the problem, just lower the probability of

accidents, and

(2) "The best way to start reducing accidents may not be employing more

technology but making sure that staff understand the rules of the road and its

dangers.", i.e. awareness

JollyRogerII wrote:

Feb 25th 2011 12:31 GMT

Companies need to realise that all their secrets will eventually get out if

their competitors are serious enough about finding out about them whether it's

by reverse engineering or by more insidious means. The only way to avoid this

is by intellectual property i.e. patenting (which only buys you 20 years

anyways) or by hiding the innovation/ playing down its significance. The latter

route is probably easier.

robertxx74 wrote:

Feb 25th 2011 2:25 GMT

The best security is for employers to be nice to employees and treat them like

valued members of a community rather than as spare parts for their big machine.

Dave Meizlik wrote:

Feb 25th 2011 3:15 GMT

Mr. Siegele does a great job in demonstrating some of the challenges to data

protection in today s business world. Today s business is borderless: with

mobile devices, smartphones, and tablet and cloud computing. When you add in

the online social behaviors and practices of the most recent generation to

enter the workforce, you find yourselves at a crossroads, with perhaps

differing expectations and understanding of privacy and what is acceptable to

share. This is challenging organizations are today more than ever before. A

myopic approach to solving the problem can be dangerous. Shutting down access -

a natural, gut reaction - will only create more obstacles and impede an

organizations ability to operate at their peak capacity.

And though data loss over the Web is four times more likely than other types, a

balance needs to be achieved between protecting what needs to be protected,

while simultaneously allowing access to the Web tools and functions your

employees are accustomed to.

Ultimately, the key to protecting assets and establishing effective security is

to keep it simple and map to three primary points:

1. What is the data you want to protect?

2. What are your use cases for protecting it?

3. What is the value to you to protect it (to help determine investment and

priority level)?

The potential of involuntary transparency of data becomes less of a concern

when it is not critically sensitive data.

DLP, like every technology, needs to be mapped to your needs and be applied in

a holistic approach to security in order to be effective. But if the WikiLeaks

incident proved anything, it is that there is a demonstrable incentive for you

to investigate your needs and the information you need to protect, and begin

securing your sensitive assets.

You can read more on this topic here: http://community.websense.com/blogs/

websense-insights/archive/2010/12/03/

part-3-conclusion-what-the-wikileaks-org-release-really-means-for-you.aspx?

smpid=pr

RCeloto wrote:

Feb 25th 2011 4:36 GMT

Very interesting article.

I think that most organizations overestimate the importance of secrecy of

information.

I would suggest to rules of thumb for dealing with information access

management:

Rule of thumb 1: information that is not from the organization (customers,

suppliers, employees etc) should be kept secret by default. In this case,

transparency should be the exception.

Rule of thumb 2: information that is from the organization (sales, expenses,

cash etc) should be kept transparent. In this case, secrecy should be the

exception.

I find it simple and practical.