Welcome!

Containers Expo Blog Authors: Liz McMillan, Yeshim Deniz, Elizabeth White, Zakia Bouachraoui, Pat Romanski

Related Topics: Containers Expo Blog

Containers Expo Blog: Article

Assuring Compliance with Content Security

Lessons from the trenches

Regulations and audits have become a way of life for many security officers, especially those in the financial and healthcare industries. For example, the Gramm-Leach-Bliley Act (GLBA) requires banks and financial institutions to establish comprehensive security policies to safeguard customer data. Likewise, the Sarbanes-Oxley Act of 2002 requires all publicly held companies to establish and maintain internal controls over their financial reporting systems and ensure their effectiveness.

At the time these regulations were drafted, however, their far-reaching consequences weren't understood. The cost of non-compliance can be high ranging from a loss of company reputation, to prohibitive fines, to imprisonment. For employees, expectations of privacy have been forever altered. And yet, most compliance regulations don't provide the specifics needed to translate broad security mandates into day-to-day guidelines and procedures. If there was ever a formula for a headache, this was it. As a result, companies are only now coming to grips with what compliance means to their organizations. As IT makes its way forward in this wilderness, lessons have been learned. Here are some of them.

Follow the Framework
What's become clear is that when it comes to compliance, legislators are better at spelling out the end point they want to arrive at, rather than the road to get there. In particular, none of the information security or privacy regulations provide more than the broadest of guidelines when it comes to the nitty-gritty of drafting effective acceptable use policies (AUPs) in the organization. Indeed, while Congress may have set down the broad requirements, it will be the courts that, in the end, determine how the law applies to real companies under real circumstances. What does that mean to you? In essence, you must connect the dots yourself, tailoring the intent of the regulations to your specific business or industry, as well as special constraints and considerations and other facts of operational life. In doing so, you may find that you are describing policies that are specific not just to your industry, but your company. Two companies in the same industry with similar organizations may, in fact, have quite different policies depending on slight variations in how they do business. The best advice we can give you is to use externally validated frameworks as your guideposts, including ISO 17799, COBIT, which is most commonly used in relation to Sarbanes-Oxley, and the guidelines coming out of the National Institute for Standards and Technologies.

The E-Mail Retention Balancing Act
Some of the most eye-grabbing tales about compliance have to do with e-mail - how long to keep it, whether to filter it, what to do if it's subpoenaed. In some cases, government regulations mandate what needs to be retained and for how long - particularly in the financial and healthcare sectors. Otherwise, the choice is up to you, and, for most companies, the emerging conventional wisdom is to retain as long as necessary and not a day longer. This isn't about burying potential evidence; there are valid legal reasons that once a piece of correspondence isn't absolutely required, you should get rid of it. Not doing so has caused many companies, including Microsoft, major financial burdens.

And then there's the punishing cost of pulling the relevant documents up from a massive offline archive of correspondence. The number of e-mail messages generated in a week by even a mid-size company can number in the millions, and the cost of retrieval rises exponentially with the number of years retained. If you don't have the tools in place ahead of time, the cost of doing so in time to meet court-mandated deadlines can be extraordinarily expensive.

As a result, some companies are starting to filter correspondence up-front if possible - determining message content that in turn determines longevity at the time an e-mail is sent and received. For example, correspondence related to patient care may be retained for the life of the patient - if it has to do with diagnosis. Or it might be retained for a much shorter period - if it's related to billing. We may eventually see in the U.S. what some European countries already permit: an "opt-out" policy in which employees can mark a given piece of correspondence as personal, not business-related. The e-mail goes out and - not being business-related - is classified as such. European countries also tend to present more real-time policy reminders to employees when an activity is performed. In some environments, for example, each time a staffer sends an e-mail, a prompt message comes up as a reminder that the system is meant for business use only. Those reminders are also another way of demonstrating that a company is doing the right thing - proving that an individual knowingly violated corporate policy.

Whatever policy you set, remember that investigating agencies make a distinction between your written AUP and the de facto policy you actually follow. If, for example, you say that you retain e-mail for a year but your archive extends to three, the de facto retention policy is the one that may apply.

Webmail, IM'ing, and Webcams
During the early stages of regulatory compliance, companies turned their full attention to e-mail as the communications link between their internal staff and the outside world. In practice, however, the picture is a bit more complicated. When we first install our e-mail security tool at a customer site, employees who want to communicate privately switch over to a Web mail account such as Hotmail, Yahoo! Mail, or Google's Gmail. The shift is both immediate and predictable. And when those venues are covered, resourceful employees shift again - to instant messaging.

As a result, companies are now planning from the get-go to monitor traffic on their corporate e-mail accounts, over the full gamut of Web mail services, and on messaging services as well. The scope of scrutiny is wider, but the method is the same. Good compliance tools will look for key words and phrases that could signal trouble, sometimes using standardized templates that attempt to recognize a type of activity an individual is undertaking. Sometimes information in combination can raise a red flag. A medical group exchanging medical terms might not raise suspicion, but that combined with a customer ID number or a social security number may raise a red flag.

A good tool will also let management put restrictions on the kinds of files that can be uploaded and downloaded and consider the content of those as well. In the long run, the answer will be one of employee expectations. The new compliance rules all but mandate that there's no such thing as truly private correspondence on the corporate network. If you have something to say and don't want others to know what you are saying, say it somewhere else. All electronic communications leaving the company network should be viewed the same way. The acid test is would you say what you're communicating via e-mail, the Web, or IM if it was typed in a letter on company letterhead? The courts will certainly view it as having the same weight and remember that it's just as permanent - just because you delete something from an archive don't assume that the communications trail has disappeared. If it was sent to one or many others what was their retention policy?

More Stories By Kimber Spradlin

Kimber Spradlin is a senior compliance architect at NetIQ corporation with eight years of experience in the information security field. She is a security subject matter expert currently focusing on understanding the needs of, and communicating with, the regulatory and policy compliance market.

More Stories By Skip Dostine

Skip Dostine is the product marketing manager for NetIQ's Marshal Content Security Solutions. With more than 25 years of international technology experience, Skip's background includes sales, product planning, project management and engineering, as well marketing and operations.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


IoT & Smart Cities Stories
The platform combines the strengths of Singtel's extensive, intelligent network capabilities with Microsoft's cloud expertise to create a unique solution that sets new standards for IoT applications," said Mr Diomedes Kastanis, Head of IoT at Singtel. "Our solution provides speed, transparency and flexibility, paving the way for a more pervasive use of IoT to accelerate enterprises' digitalisation efforts. AI-powered intelligent connectivity over Microsoft Azure will be the fastest connected pat...
There are many examples of disruption in consumer space – Uber disrupting the cab industry, Airbnb disrupting the hospitality industry and so on; but have you wondered who is disrupting support and operations? AISERA helps make businesses and customers successful by offering consumer-like user experience for support and operations. We have built the world’s first AI-driven IT / HR / Cloud / Customer Support and Operations solution.
Codete accelerates their clients growth through technological expertise and experience. Codite team works with organizations to meet the challenges that digitalization presents. Their clients include digital start-ups as well as established enterprises in the IT industry. To stay competitive in a highly innovative IT industry, strong R&D departments and bold spin-off initiatives is a must. Codete Data Science and Software Architects teams help corporate clients to stay up to date with the mod...
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...
Druva is the global leader in Cloud Data Protection and Management, delivering the industry's first data management-as-a-service solution that aggregates data from endpoints, servers and cloud applications and leverages the public cloud to offer a single pane of glass to enable data protection, governance and intelligence-dramatically increasing the availability and visibility of business critical information, while reducing the risk, cost and complexity of managing and protecting it. Druva's...
BMC has unmatched experience in IT management, supporting 92 of the Forbes Global 100, and earning recognition as an ITSM Gartner Magic Quadrant Leader for five years running. Our solutions offer speed, agility, and efficiency to tackle business challenges in the areas of service management, automation, operations, and the mainframe.
The Jevons Paradox suggests that when technological advances increase efficiency of a resource, it results in an overall increase in consumption. Writing on the increased use of coal as a result of technological improvements, 19th-century economist William Stanley Jevons found that these improvements led to the development of new ways to utilize coal. In his session at 19th Cloud Expo, Mark Thiele, Chief Strategy Officer for Apcera, compared the Jevons Paradox to modern-day enterprise IT, examin...
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, @CloudEXPO and DXWorldEXPO are two of the most important technology events of the year. Since its launch over eight years ago, @CloudEXPO and DXWorldEXPO have presented a rock star faculty as well as showcased hundreds of sponsors and exhibitors! In this blog post, we provide 7 tips on how, as part of our world-class faculty, you can deliver one of the most popular sessions at our events. But before reading...
DSR is a supplier of project management, consultancy services and IT solutions that increase effectiveness of a company's operations in the production sector. The company combines in-depth knowledge of international companies with expert knowledge utilising IT tools that support manufacturing and distribution processes. DSR ensures optimization and integration of internal processes which is necessary for companies to grow rapidly. The rapid growth is possible thanks, to specialized services an...
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...