Containers Expo Blog Authors: Zakia Bouachraoui, Elizabeth White, Liz McMillan, Pat Romanski, Yeshim Deniz

Related Topics: Containers Expo Blog

Containers Expo Blog: Article

Assuring Compliance with Content Security

Lessons from the trenches

Regulations and audits have become a way of life for many security officers, especially those in the financial and healthcare industries. For example, the Gramm-Leach-Bliley Act (GLBA) requires banks and financial institutions to establish comprehensive security policies to safeguard customer data. Likewise, the Sarbanes-Oxley Act of 2002 requires all publicly held companies to establish and maintain internal controls over their financial reporting systems and ensure their effectiveness.

At the time these regulations were drafted, however, their far-reaching consequences weren't understood. The cost of non-compliance can be high ranging from a loss of company reputation, to prohibitive fines, to imprisonment. For employees, expectations of privacy have been forever altered. And yet, most compliance regulations don't provide the specifics needed to translate broad security mandates into day-to-day guidelines and procedures. If there was ever a formula for a headache, this was it. As a result, companies are only now coming to grips with what compliance means to their organizations. As IT makes its way forward in this wilderness, lessons have been learned. Here are some of them.

Follow the Framework
What's become clear is that when it comes to compliance, legislators are better at spelling out the end point they want to arrive at, rather than the road to get there. In particular, none of the information security or privacy regulations provide more than the broadest of guidelines when it comes to the nitty-gritty of drafting effective acceptable use policies (AUPs) in the organization. Indeed, while Congress may have set down the broad requirements, it will be the courts that, in the end, determine how the law applies to real companies under real circumstances. What does that mean to you? In essence, you must connect the dots yourself, tailoring the intent of the regulations to your specific business or industry, as well as special constraints and considerations and other facts of operational life. In doing so, you may find that you are describing policies that are specific not just to your industry, but your company. Two companies in the same industry with similar organizations may, in fact, have quite different policies depending on slight variations in how they do business. The best advice we can give you is to use externally validated frameworks as your guideposts, including ISO 17799, COBIT, which is most commonly used in relation to Sarbanes-Oxley, and the guidelines coming out of the National Institute for Standards and Technologies.

The E-Mail Retention Balancing Act
Some of the most eye-grabbing tales about compliance have to do with e-mail - how long to keep it, whether to filter it, what to do if it's subpoenaed. In some cases, government regulations mandate what needs to be retained and for how long - particularly in the financial and healthcare sectors. Otherwise, the choice is up to you, and, for most companies, the emerging conventional wisdom is to retain as long as necessary and not a day longer. This isn't about burying potential evidence; there are valid legal reasons that once a piece of correspondence isn't absolutely required, you should get rid of it. Not doing so has caused many companies, including Microsoft, major financial burdens.

And then there's the punishing cost of pulling the relevant documents up from a massive offline archive of correspondence. The number of e-mail messages generated in a week by even a mid-size company can number in the millions, and the cost of retrieval rises exponentially with the number of years retained. If you don't have the tools in place ahead of time, the cost of doing so in time to meet court-mandated deadlines can be extraordinarily expensive.

As a result, some companies are starting to filter correspondence up-front if possible - determining message content that in turn determines longevity at the time an e-mail is sent and received. For example, correspondence related to patient care may be retained for the life of the patient - if it has to do with diagnosis. Or it might be retained for a much shorter period - if it's related to billing. We may eventually see in the U.S. what some European countries already permit: an "opt-out" policy in which employees can mark a given piece of correspondence as personal, not business-related. The e-mail goes out and - not being business-related - is classified as such. European countries also tend to present more real-time policy reminders to employees when an activity is performed. In some environments, for example, each time a staffer sends an e-mail, a prompt message comes up as a reminder that the system is meant for business use only. Those reminders are also another way of demonstrating that a company is doing the right thing - proving that an individual knowingly violated corporate policy.

Whatever policy you set, remember that investigating agencies make a distinction between your written AUP and the de facto policy you actually follow. If, for example, you say that you retain e-mail for a year but your archive extends to three, the de facto retention policy is the one that may apply.

Webmail, IM'ing, and Webcams
During the early stages of regulatory compliance, companies turned their full attention to e-mail as the communications link between their internal staff and the outside world. In practice, however, the picture is a bit more complicated. When we first install our e-mail security tool at a customer site, employees who want to communicate privately switch over to a Web mail account such as Hotmail, Yahoo! Mail, or Google's Gmail. The shift is both immediate and predictable. And when those venues are covered, resourceful employees shift again - to instant messaging.

As a result, companies are now planning from the get-go to monitor traffic on their corporate e-mail accounts, over the full gamut of Web mail services, and on messaging services as well. The scope of scrutiny is wider, but the method is the same. Good compliance tools will look for key words and phrases that could signal trouble, sometimes using standardized templates that attempt to recognize a type of activity an individual is undertaking. Sometimes information in combination can raise a red flag. A medical group exchanging medical terms might not raise suspicion, but that combined with a customer ID number or a social security number may raise a red flag.

A good tool will also let management put restrictions on the kinds of files that can be uploaded and downloaded and consider the content of those as well. In the long run, the answer will be one of employee expectations. The new compliance rules all but mandate that there's no such thing as truly private correspondence on the corporate network. If you have something to say and don't want others to know what you are saying, say it somewhere else. All electronic communications leaving the company network should be viewed the same way. The acid test is would you say what you're communicating via e-mail, the Web, or IM if it was typed in a letter on company letterhead? The courts will certainly view it as having the same weight and remember that it's just as permanent - just because you delete something from an archive don't assume that the communications trail has disappeared. If it was sent to one or many others what was their retention policy?

More Stories By Kimber Spradlin

Kimber Spradlin is a senior compliance architect at NetIQ corporation with eight years of experience in the information security field. She is a security subject matter expert currently focusing on understanding the needs of, and communicating with, the regulatory and policy compliance market.

More Stories By Skip Dostine

Skip Dostine is the product marketing manager for NetIQ's Marshal Content Security Solutions. With more than 25 years of international technology experience, Skip's background includes sales, product planning, project management and engineering, as well marketing and operations.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

IoT & Smart Cities Stories
The platform combines the strengths of Singtel's extensive, intelligent network capabilities with Microsoft's cloud expertise to create a unique solution that sets new standards for IoT applications," said Mr Diomedes Kastanis, Head of IoT at Singtel. "Our solution provides speed, transparency and flexibility, paving the way for a more pervasive use of IoT to accelerate enterprises' digitalisation efforts. AI-powered intelligent connectivity over Microsoft Azure will be the fastest connected pat...
CloudEXPO has been the M&A capital for Cloud companies for more than a decade with memorable acquisition news stories which came out of CloudEXPO expo floor. DevOpsSUMMIT New York faculty member Greg Bledsoe shared his views on IBM's Red Hat acquisition live from NASDAQ floor. Acquisition news was announced during CloudEXPO New York which took place November 12-13, 2019 in New York City.
BMC has unmatched experience in IT management, supporting 92 of the Forbes Global 100, and earning recognition as an ITSM Gartner Magic Quadrant Leader for five years running. Our solutions offer speed, agility, and efficiency to tackle business challenges in the areas of service management, automation, operations, and the mainframe.
Apptio fuels digital business transformation. Technology leaders use Apptio's machine learning to analyze and plan their technology spend so they can invest in products that increase the speed of business and deliver innovation. With Apptio, they translate raw costs, utilization, and billing data into business-centric views that help their organization optimize spending, plan strategically, and drive digital strategy that funds growth of the business. Technology leaders can gather instant recomm...
In an age of borderless networks, security for the cloud and security for the corporate network can no longer be separated. Security teams are now presented with the challenge of monitoring and controlling access to these cloud environments, at the same time that developers quickly spin up new cloud instances and executives push forwards new initiatives. The vulnerabilities created by migration to the cloud, such as misconfigurations and compromised credentials, require that security teams t...
AI and machine learning disruption for Enterprises started happening in the areas such as IT operations management (ITOPs) and Cloud management and SaaS apps. In 2019 CIOs will see disruptive solutions for Cloud & Devops, AI/ML driven IT Ops and Cloud Ops. Customers want AI-driven multi-cloud operations for monitoring, detection, prevention of disruptions. Disruptions cause revenue loss, unhappy users, impacts brand reputation etc.
As you know, enterprise IT conversation over the past year have often centered upon the open-source Kubernetes container orchestration system. In fact, Kubernetes has emerged as the key technology -- and even primary platform -- of cloud migrations for a wide variety of organizations. Kubernetes is critical to forward-looking enterprises that continue to push their IT infrastructures toward maximum functionality, scalability, and flexibility. As they do so, IT professionals are also embr...
@CloudEXPO and @ExpoDX, two of the most influential technology events in the world, have hosted hundreds of sponsors and exhibitors since our launch 10 years ago. @CloudEXPO and @ExpoDX New York and Silicon Valley provide a full year of face-to-face marketing opportunities for your company. Each sponsorship and exhibit package comes with pre and post-show marketing programs. By sponsoring and exhibiting in New York and Silicon Valley, you reach a full complement of decision makers and buyers in ...
While the focus and objectives of IoT initiatives are many and diverse, they all share a few common attributes, and one of those is the network. Commonly, that network includes the Internet, over which there isn't any real control for performance and availability. Or is there? The current state of the art for Big Data analytics, as applied to network telemetry, offers new opportunities for improving and assuring operational integrity. In his session at @ThingsExpo, Jim Frey, Vice President of S...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settl...