💾 Archived View for gmi.noulin.net › mobileNews › 2915.gmi captured on 2023-01-29 at 07:07:28. Gemini links have been rewritten to link to archived content
⬅️ Previous capture (2021-12-03)
-=-=-=-=-=-=-
2011-03-01 06:25:20
Companies and information
Digital information is easy not only to store but also to leak. Companies must
decide what they really need to keep secret, and how best to do so
Feb 24th 2011 | from the print edition
IN EARLY February Hewlett-Packard showed off its new tablet computer, which it
hopes will be a rival to Apple s iPad. The event was less exciting than it
might have been, thanks to the leaking of the design in mid-January. Other
technology companies have suffered similar embarrassments lately. Dell s
timetable for bringing tablets to market appeared on a tech-news website. A
schedule for new products from NVIDIA, which makes graphics chips, also seeped
out.
Geeks aren t the only ones who can t keep a secret. In January it emerged that
Renault had suspended three senior executives, allegedly for passing on
blueprints for electric cars (which the executives deny). An American radio
show has claimed to have found the recipe for Coca-Cola s secret ingredient in
an old newspaper photograph. Facebook s corporate privacy settings went awry
when some of the social network s finances were published. A strategy document
from AOL came to light, revealing that the internet and media firm s
journalists were expected to write five to ten articles a day.
Meanwhile, Julian Assange has been doing his best to make bankers sweat. In
November the founder of WikiLeaks promised a megaleak early in 2011. He was
said to be in possession of a hard drive from the laptop of a former executive
of an unnamed American bank, containing documents even more toxic than the
copiously leaked diplomatic cables from the State Department. They would reveal
an ecosystem of corruption and take down a bank or two .
I think it s great, Mr Assange said in a television interview in January. We
have all these banks squirming, thinking maybe it s them. At Bank of America
(BofA), widely thought to be the bank in question, an internal investigation
began. Had any laptop gone missing? What could be on its hard drive? And how
should BofA react if, say, compromising e-mails were leaked?
The bank s bosses and investigators can relax a bit. Recent reports say that Mr
Assange has acknowledged in private that the material may be less revealing
than he had suggested. Financial experts would be needed to determine whether
any of it was at all newsworthy.
Even so, the WikiLeaks threat and the persistent leaking of other supposedly
confidential corporate information have brought an important issue to the fore.
Companies are creating an ever-growing pile of digital information, from
product designs to employees e-mails. Keeping tabs on it all is increasingly
hard, not only because there is so much of it but also because of the ease of
storing and sending it. Much of this information would do little damage if it
seeped into the outside world; some of it, indeed, might well do some good. But
some could also be valuable to competitors or simply embarrassing and needs to
be protected. Companies therefore have to decide what they should try to keep
to themselves and how best to secure it.
Trying to prevent leaks by employees or to fight off hackers only helps so
much. Powerful forces are pushing companies to become more transparent.
Technology is turning the firm, long a safe box for information, into something
more like a sieve, unable to contain all its data. Furthermore, transparency
can bring huge benefits. The end result will be more openness, predicts Bruce
Schneier, a data-security guru.
From safe to sieve
When corporate information lived only on paper, which was complemented by
microfilm about 50 years ago, it was much easier to manage and protect than it
is today. Accountants and archivists classified it; the most secret documents
were put in a safe. Copying was difficult: it would have taken Bradley Manning,
the soldier who is alleged to have sent the diplomatic cables to WikiLeaks,
years to photograph or smuggle out all the 250,000 documents he is said to have
downloaded assuming that he was not detected.
Things did not change much when computers first made an appearance in firms.
They were used mostly for accounting or other transactions, known as
structured information . And they were self-contained systems to which few
people had access. Even the introduction in the 1980s of more decentralised
information-technology (IT) systems and personal computers (PCs) did not make
much of a difference. PCs served at first as glorified typewriters.
It was only with the advent of the internet and its corporate counterpart, the
intranet, that information began to flow more quickly. Employees had access to
lots more data and could exchange electronic messages with the outer world. PCs
became a receptacle for huge amounts of unstructured information , such as
text files and presentations. The banker s hard drive in Mr Assange s
possession is rumoured to contain several years worth of e-mails and
attachments.
Now an even more important change is taking place. So far firms have spent
their IT budgets mostly on what Geoffrey Moore of TCG Advisors, a firm of
consultants, calls systems of record , which track the flow of money, products
and people within a company and, more recently, its network of suppliers. Now,
he says, firms are increasingly investing in systems of engagement . By this
he means all kinds of technologies that digitise, speed up and automate a firm
s interaction with the outer world.
Mobile devices, video conferencing and online chat are the most obvious
examples of these technologies: they allow instant communication. But they are
only part of the picture, says Mr Moore. Equally important are a growing number
of tools that enable new forms of collaboration: employees collectively edit
online documents, called wikis; web-conferencing services help firms and their
customers to design products together; and smartphone applications let
companies collect information about people s likes and dislikes and hence about
market trends.
It is easy to see how such services will produce ever more data. They are one
reason why IDC, a market-research firm, predicts that the digital universe ,
the amount of digital information created and replicated in a year, will
increase to 35 zettabytes by 2020, from less than 1 zettabyte in 2009 (see
chart); 1 zettabyte is 1 trillion gigabytes, or the equivalent of 250 billion
DVDs. But these tools will also make a firm s borders ever more porous.
WikiLeaks is just a reflection of the problem that more and more data are
produced and can leak out, says John Mancini, president of AIIM, an
organisation dedicated to improving information management.
Two other developments are also poking holes in companies digital firewalls.
One is outsourcing: contractors often need to be connected to their clients
computer systems. The other is employees own gadgets. Younger staff,
especially, who are attuned to easy-to-use consumer technology, want to bring
their own gear to work. They don t like to use a boring corporate BlackBerry,
explains Mr Mancini.
The data drain
As a result, more and more data are seeping out of companies, even of the sort
that should be well protected. When Eric Johnson of the Tuck School of Business
at Dartmouth College and his fellow researchers went through popular
file-sharing services last year, they found files that contained health-related
information as well as names, addresses and dates of birth. In many cases,
explains Mr Johnson, the reason for such leaks is not malice or even
recklessness, but that corporate applications are often difficult to use, in
particular in health care. To be able to work better with data, employees often
transfer them into spreadsheets and other types of files that are easier to
manipulate but also easier to lose control of.
Although most leaks are not deliberate, many are. Renault, for example, claims
to be a victim of industrial espionage. In a prominent insider-trading case in
the United States, some hedge-fund managers are accused of having benefited
from data leaked from Taiwanese semiconductor foundries, including spreadsheets
showing the orders and thus the sales expectations of their customers.
Not surprisingly, therefore, companies feel a growing urge to prevent leaks.
The pressure is regulatory as well as commercial. Stricter data-protection and
other rules are also pushing firms to keep a closer watch on information. In
America, for instance, the Health Insurance Portability and Accountability Act
(HIPAA) introduced security standards for personal health data. In lawsuits
companies must be able to produce all relevant digital information in court. No
wonder that some executives have taken to using e-mail sparingly or not at all.
Whole companies, however, cannot dodge the digital flow.
To help them plug the holes, companies are being offered special types of
software. One is called content management . Programs sold by Alfresco, EMC
Documentum and others let firms keep tabs on their digital content, classify it
and define who has access to it. A junior salesman, for instance, will not be
able to see the latest financial results before publication and thus cannot
send them to a friend.
Another type, in which Symantec and Websense are the market leaders, is data
loss prevention (DLP). This is software that sits at the edge of a firm s
network and inspects the outgoing data traffic. If it detects sensitive
information, it sounds the alarm and can block the incriminating bits. The
software is often used to prevent social-security and credit-card numbers from
leaving a company and thus make it comply with HIPAA and similar regulations.
A third field, newer than the first two, is network forensics . The idea is to
keep an eye on everything that is happening in a corporate network, and thus to
detect a leaker. NetWitness, a start-up company, says that its software records
all the digital goings-on and then looks for suspicious patterns, creating
real-time situation awareness , in the words of Edward Schwartz, its chief
security officer.
There are also any number of more exotic approaches. Autonomy, a British
software firm, offers bells in the dark . False records made-up pieces of
e-mail, say are spread around the network. Because they are false, no one
should gain access to them. If somebody does, an alarm is triggered, as a
burglar might set off an alarm breaking into a house at night.
These programs deter some leakers and keep employees from doing stupid things.
But reality rarely matches the marketing. Content-management programs are hard
to use and rarely fully implemented. Role-based access control sounds fine in
theory but is difficult in practice. Firms often do not know exactly what
access should be assigned to whom. Even if they do, jobs tend to change
quickly. A field study of an investment bank by Mr Johnson and his colleagues
found that one department of 3,000 employees saw 1,000 organisational changes
within only a few months.
This leads to what Mr Johnson calls over-entitlement . So that workers can get
their jobs done, they are given access to more information than they really
need. At the investment bank, more than 50% were over-entitled. Because access
is rarely revoked, over time employees gain the right to see more and more. In
some companies, Mr Johnson was able to predict a worker s length of employment
from how much access he had. But he adds that if role-based access control is
enforced too strictly, employees have too little data to do their jobs.
Similarly, DLP is no guarantee against leaks: because it cannot tell what is in
encrypted files, data can be wrapped up and smuggled out. Network forensics can
certainly show what is happening in a small group of people working on a
top-secret product. But it is hard to see how it can keep track of the
ever-growing traffic that passes through or leaves big corporate IT systems,
for instance through a simple memory stick (which plugs into a PC and can hold
the equivalent of dozens of feature-length films). Technology can t solve the
problem, just lower the probability of accidents, explains John Stewart, the
chief security officer of Cisco, a maker of networking equipment.
Other experts point out that companies face a fundamental difficulty. There is
a tension in handling large amounts of data that can be seen by many people,
argues Ross Anderson, of Cambridge University. If a system lets a few people do
only very simple things such as checking whether a product is available the
risks can be managed; but if it lets a lot of people do general inquiries it
becomes insecure. SIPRNet, where the American diplomatic cables given to
WikiLeaks had been stored, is a case in point: it provided generous access to
several hundred thousand people.
In the corporate world, to limit the channels through which data can escape,
some companies do not allow employees to bring their own gear to work or to use
memory sticks or certain online services. Although firms have probably become
more permissive since, a survey by Robert Half Technology, a recruitment
agency, found in 2009 that more than half of chief information officers in
America blocked the use of sites such as Facebook at work.
Yet this approach comes at a price, and not only because it makes a firm less
attractive to Facebook-using, iPhone-toting youngsters. More openness also
creates trust, argues Jeff Jarvis, a new-media sage who is writing a book
about the virtues of transparency, entitled Public Parts . Dell, he says,
gained a lot of goodwill when it started talking openly about its products
technical problems, such as exploding laptop batteries. If you open the
kimono, a lot of good things happen, says Don Tapscott, a management
consultant and author: it keeps the company honest, creates more loyalty among
employees and lowers transaction costs with suppliers.
More important still, if the McKinsey Global Institute, the research arm of a
consulting firm, has its numbers right, limiting the adoption of systems of
engagement can hurt profits. In a recent survey it found that firms that made
extensive use of social networks, wikis and so forth reaped important benefits,
including faster decision-making and increased innovation.
How then to strike the right balance between secrecy and transparency? It may
be useful to think of a computer network as being like a system of roads. Just
like accidents, leaks are bound to happen and attempts to stop the traffic will
fail, says Mr Schneier, the security expert. The best way to start reducing
accidents may not be employing more technology but making sure that staff
understand the rules of the road and its dangers. Transferring files onto a
home PC, for instance, can be a recipe for disaster. It may explain how health
data have found their way onto file-sharing networks. If a member of the
employee s family has joined such a network, the data can be replicated on many
other computers.
Don t do that again
Companies also have to set the right incentives. To avoid the problems of
role-based access control, Mr Johnson proposes a system akin to a speed trap:
it allows users to gain access to more data easily, but records what they do
and hands out penalties if they abuse the privilege. He reports that Intel, the
world s largest chipmaker, issues speeding tickets to employees who break its
rules.
Mr Johnson is the first to admit that this approach is too risky for data that
are very valuable or the release of which could cause a lot of damage. But most
companies do not even realise what kind of information they have and how
valuable or sensitive it is. They are often trying to protect everything
instead of concentrating on the important stuff, reports John Newton, the
chief technology officer of Alfresco.
The WikiLeaks incident is an opportunity to improve information governance,
wrote Debra Logan, an analyst at Gartner, a research firm, and her colleagues
in a recent note. A first step is to decide which data should be kept and for
how long; many firms store too much, making leaks more likely. In a second
round, says Ms Logan, companies must classify information according to how
sensitive it is. Only then can you have an intelligent discussion about what
to protect and what to do when something gets leaked.
Such an exercise could also be an occasion to develop what Mr Tapscott calls a
transparency strategy : how closed or open an organisation wants to be. The
answer depends on the business it is in. For companies such as Accenture, an IT
consultancy and outsourcing firm, security is a priority from the top down
because it is dealing with a lot of customer data, says Alastair MacWillson,
who runs its security business. Employees must undergo security training
regularly. As far as possible, software should control what leaves the company
s network. If you try to do something with your BlackBerry or your laptop that
you should not do, explains Mr MacWillson, the system will ask you: Should
you really be doing this?
At the other end of the scale is the Mozilla Foundation, which leads the
development of Firefox, an open-source browser. Transparency is not just a
natural inclination but a necessity, says Mitchell Baker, who chairs the
foundation. If Mozilla kept its cards close to the chest, its global community
of developers would not and could not help write the program. So it keeps
secrets to a minimum: employees personal information, data that business
partners do not want made public and security issues in its software.
Everything else can be found somewhere on Mozilla s many websites. And anyone
can take part in its weekly conference calls.
Few companies will go that far. But many will move in this direction. The
transparency strategy of Best Buy, an electronics retailer, is that its
customers should know as much as its employees. Twitter tells its employees
that they can tweet about anything, but that they should not do stupid things
. In the digital era of exploding quantities of data that are increasingly
hard to contain within companies systems, more companies are likely to become
more transparent. Mr Tapscott and Richard Hunter, another technology savant,
may not have been exaggerating much a decade ago, when they wrote books
foreseeing The Naked Corporation and a World Without Secrets .
mcji5os1 wrote:
Feb 24th 2011 8:43 GMT
Excellent article - sums it up well in two quotes:
(1) Technology can t solve the problem, just lower the probability of
accidents, and
(2) "The best way to start reducing accidents may not be employing more
technology but making sure that staff understand the rules of the road and its
dangers.", i.e. awareness
JollyRogerII wrote:
Feb 25th 2011 12:31 GMT
Companies need to realise that all their secrets will eventually get out if
their competitors are serious enough about finding out about them whether it's
by reverse engineering or by more insidious means. The only way to avoid this
is by intellectual property i.e. patenting (which only buys you 20 years
anyways) or by hiding the innovation/ playing down its significance. The latter
route is probably easier.
robertxx74 wrote:
Feb 25th 2011 2:25 GMT
The best security is for employers to be nice to employees and treat them like
valued members of a community rather than as spare parts for their big machine.
Dave Meizlik wrote:
Feb 25th 2011 3:15 GMT
Mr. Siegele does a great job in demonstrating some of the challenges to data
protection in today s business world. Today s business is borderless: with
mobile devices, smartphones, and tablet and cloud computing. When you add in
the online social behaviors and practices of the most recent generation to
enter the workforce, you find yourselves at a crossroads, with perhaps
differing expectations and understanding of privacy and what is acceptable to
share. This is challenging organizations are today more than ever before. A
myopic approach to solving the problem can be dangerous. Shutting down access -
a natural, gut reaction - will only create more obstacles and impede an
organizations ability to operate at their peak capacity.
And though data loss over the Web is four times more likely than other types, a
balance needs to be achieved between protecting what needs to be protected,
while simultaneously allowing access to the Web tools and functions your
employees are accustomed to.
Ultimately, the key to protecting assets and establishing effective security is
to keep it simple and map to three primary points:
1. What is the data you want to protect?
2. What are your use cases for protecting it?
3. What is the value to you to protect it (to help determine investment and
priority level)?
The potential of involuntary transparency of data becomes less of a concern
when it is not critically sensitive data.
DLP, like every technology, needs to be mapped to your needs and be applied in
a holistic approach to security in order to be effective. But if the WikiLeaks
incident proved anything, it is that there is a demonstrable incentive for you
to investigate your needs and the information you need to protect, and begin
securing your sensitive assets.
You can read more on this topic here: http://community.websense.com/blogs/
websense-insights/archive/2010/12/03/
part-3-conclusion-what-the-wikileaks-org-release-really-means-for-you.aspx?
smpid=pr
RCeloto wrote:
Feb 25th 2011 4:36 GMT
Very interesting article.
I think that most organizations overestimate the importance of secrecy of
information.
I would suggest to rules of thumb for dealing with information access
management:
Rule of thumb 1: information that is not from the organization (customers,
suppliers, employees etc) should be kept secret by default. In this case,
transparency should be the exception.
Rule of thumb 2: information that is from the organization (sales, expenses,
cash etc) should be kept transparent. In this case, secrecy should be the
exception.
I find it simple and practical.