Document Compliance Management ushers in a new order

How do most businesses enable collaboration today?

Email continues to be the most common method used for information sharing and communication. Organizations tend to collaborate through this ubiquitous technology, sending emails to their employees, partners, suppliers and customers. These emails, of course, include content, attachments and links, some of which contain sensitive information.

To supplement email functionality, individual departments sometimes acquire Cloud-based collaboration applications, often without advice from corporate IT on the selection, vetting or implementation of these services. These systems provide rudimentary content storage, distribution and work flow that email lacks.

Where do the current methods fall short?

To state the obvious, email was not designed to be a real-time, multi-user, secure collaboration system. We know that email makes it extremely easy for security policies to be bypassed. A simple “reply all” can find an employee, either unintentionally or maliciously, sending sensitive information to one or more unintended recipients. Email and any attachments that arrive at the recipient’s mail client could be forwarded to other parties that may not have the right or need to view the information. In this latter instance, the organization that owned the data may never find out that this unexpected data sharing activity took place.

Most commercially-available Cloud-based collaboration offerings were purpose-built with a simple, primary objective of sharing information; security became an afterthought for most products. This becomes a serious risk when you consider that these products typically leave the control of the policy and access to the data in the hands of the collaboration solution provider. Some of the top-performing solutions have attempted to wrap security around the content in such a way that end users can apply document protections, requiring them to define the classification and sharing policies themselves. Of course, by putting the decision into the hands of end users with no experience in defining policy, and without the perspective of the company’s central policy standard, poor decisions could be made and sensitive data still exposed to unauthorized access and misuse. Organizations with hundreds of users have no way to ensure consistent application of security measures. In addition to putting their own documents at risk, using unsecure collaboration applications may result in companies violating their contractual obligations to protect their partners’ confidential information.

To address some of these risks, organizations continue to make significant investments in the various perimeter security technologies designed to prevent information from leaving the organization. Some of the technologies used include firewalls, network intrusion prevention systems (IPS), data loss/leak prevention (DLP) and more. The main problem with this “protect the perimeter” approach is that these products focus on protecting at the infrastructure layer, not on the information itself, which must travel outside the network in order for the company to function. This effectively still leaves the user in control of the information’s destiny, which usually leads to the dangerous choice of expedience over security.

What is DCM and how does it fit in?

Document Compliance Management is a discipline that proactively manages information risk arising from sharing documents electronically.

As organizations move more of their information management processes outside the firewall to the extended enterprise, end users’ demands for collaboration come into conflict with corporate demands to protect information through consistent policy application and control over distribution. DCM seeks to reconcile these demands by creating security provisions that move with documents throughout their lifecycles, both inside and outside the network.

Organizations that are struggling to collaborate while meeting their regulatory, compliance and governance requirements are grappling with the issues Document Compliance Management addresses. Ultimately, these organizations want to collaborate and transact securely within their communities of trust. Regulatory auditors will look for a complete audit trail that captures the entire lifecycle of the organization’s sensitive information; who had access to which documents at which point in time.

Consider the scenario in which inside counsel is required to work with outside counsel, each sharing sensitive legal documents with their counterparts on the other end. They need to maintain control over their documents after they have left the corporate network and they are required to keep a full audit trail of all document activity. They may deal with documents of varying levels of sensitivity, and need an easy way for end users to apply the appropriate controls to each document.

Another example is the human resources team collaborating with healthcare providers, financial services providers, state and federal tax entities, and more. Again, the documents need to be shared with trust and a full audit trail must be available to ensure that employees’ personal information has been protected as it passes to external parties. Some key components of this audit trail must document which information has been provided to which business partner, and whether or not they were able to print it, save it locally, or forward it to other people.

Why not just block all access by default?

Looking historically at security, most responses to attacks, breaches or compliance exceptions have been to shut down the operation or block the action. Years ago, when organizations experienced viruses running wild through their email systems, they simply shut down email until the problem was resolved. If they were worried about data leaving via USB sticks, they would blanket block the use of USB ports throughout the entire organization. We see this same model being applied to data protection within the collaboration space — classify data as being sensitive and block it from being shared.

This model fails miserably. A block-by-default policy goes against the business models of today, which rely on employees, partners, suppliers, legal counsel, and other outside parties who must collaborate with each other using sensitive information.

Therefore, the main goal for DCM is to provide a secure means for end users to collaborate within corporate and regulatory policy for all approved parties, both inside and outside the organization. Corporate policy makers should risk rank business processes, define security policies and classifications, and roll them out to end users in a secure collaboration platform. This would ensure the proper use of documents, doing so in a way that is easy and transparent for the end user, without putting the end user in the unenviable position of having to make policy decisions. It must be simple enough that users will be comfortable doing their jobs within the systems they are already familiar with, as opposed to working around a protected system that is blocking them from collaborating.

What should an organization consider when implementing DCM?

Organizations should try to include these features in their own DCM programs:

• Centralized data classification, policy definition, and policy enforcement capabilities
• Enables end users to do their job without having to think about security, doing so without making them work outside of their existing business processes
• Is flexible enough to support a variety of business processes to prevent the proliferation of disparate point solutions, and can be easily integrated with the company’s existing ecosystem.

Organizations tend to focus on the tactical problems they face with data protection and often look to solve them with technology delivered by their traditional perimeter security vendor. If an organization really wants to be successful at enabling secure business collaboration, they must approach the problem at the document/information level: develop a plan to define and enable their end users, partners, and others to securely collaborate within the boundaries of their internal and/or regulatory constraints.

Peter Weger is CEO of Brainloop, which uses document compliance management to make online collaboration safe and compliant, giving users the peace of mind to focus on their business goals. Contact him at Peter.Weger@brainloop.com.