Safeguarding critical e-documents: implementing a program for securing confidential information assets

Safeguarding Critical E-Documents......Page 3
Contents......Page 9
Foreword......Page 15
Preface......Page 17
Acknowledgments......Page 19
PART I THE PROBLEM AND BASIC TOOLS......Page 23
WikiLeaks: A Wake-Up Call......Page 25
Threats Persist across the Pond: U.K. Companies on Guard......Page 27
Increase in Corporate and Industrial Espionage......Page 28
Risks of Medical Identity Theft......Page 29
Why Don’t Organizations Safeguard Their Information Assets?......Page 30
The Blame Game: Where Does Fault Lie When Information Is Leaked?......Page 31
Consequences of Not Employing E-Document Security......Page 32
Notes......Page 33
First, Better Policies; Then, Better Technology for Better Enforcement......Page 35
Defining Information Governance......Page 36
Accountability Is Key......Page 38
Why IG Is Good Business......Page 39
Impact of a Successful IG Program......Page 40
Critical Factors in an IG Program......Page 41
Who Should Determine IG Policies?......Page 44
Notes......Page 45
PART II Information Platform Risks and Countermeasures......Page 47
Enterprise Content Management......Page 49
Document Management Principles......Page 50
Electronic Document Management Systems......Page 51
Electronic Records Management......Page 53
Notes......Page 55
CHAPTER 4 Information Governance and Security for E-mail Messages......Page 57
Employees Regularly Expose Organizations to E-mail Risk......Page 58
E-mail Policies Should Be Realistic and Technology Agnostic......Page 59
Is E-mail Encryption the Answer?......Page 60
Common E-mail Security Mistakes......Page 61
E-mail Security Myths......Page 62
E-record Retention: Fundamentally a Legal Issue......Page 63
E-mail Archiving Rationale: Compliance, Legal, and Business Reasons......Page 64
Are All E-mails Records?......Page 65
Destructive Retention of E-mail......Page 66
Notes......Page 68
CHAPTER 5 Information Governance and Security for Instant Messaging......Page 71
Denial-of-Service Attacks Freeze Access......Page 72
Best Practices for Business IM Use......Page 73
Tips for Safer IM......Page 75
Notes......Page 77
Types of Social Media in Web 2.0......Page 79
Social Media in the Enterprise......Page 81
Biggest Security Threats of Social Media......Page 82
Legal Risks of Social Media Posts......Page 85
Tools to Archive Facebook and Twitter......Page 86
IG Considerations for Social Media......Page 87
Notes......Page 88
CHAPTER 7 Information Governance and Security for Mobile Devices......Page 91
Current Trends in Mobile Computing......Page 93
Security Risks of Mobile Computing......Page 94
IG for Mobile Computing......Page 95
Building Security into Mobile Applications......Page 97
Real Threats Are Poorly Understood......Page 98
Innovation versus Security: Choices and Trade-Offs......Page 99
Best Practices to Secure Mobile Applications......Page 100
Notes......Page 102
CHAPTER 8 Information Governance and Security for Cloud Computing Use......Page 105
Defining Cloud Computing......Page 106
Key Characteristics of Cloud Computing......Page 107
What Cloud Computing Really Means......Page 108
Greatest Security Threats to Cloud Computing......Page 109
Document and Data Breaches......Page 110
The Enemy Within: Insider Threats......Page 111
Hacking and Rogue Intrusions......Page 112
Issues with Multi-tenancy and Technology Sharing......Page 113
Who Are Your Neighbors?......Page 115
IG Guidelines: Managing Documents and Records in the Cloud......Page 116
Managing E-Docs and Records in the Cloud: A Practical Approach......Page 117
Notes......Page 119
PART III E-Records Considerations......Page 121
Defining Vital Records......Page 123
Types of Vital Records......Page 125
Impact of Losing Vital Records......Page 126
Essential Steps to Implementing a Vital Records Program......Page 127
U.S. National Archives Approach to Identify Vital Records......Page 129
Implementing Protective Procedures......Page 130
Instant Continuous Backup......Page 132
Auditing the Vital Records Program......Page 133
Notes......Page 135
Defining Long-Term Digital Preservation......Page 137
Key Factors in LTDP......Page 138
Controlling the Process of Preserving Records......Page 140
Notes......Page 143
PART IV Information Technology Considerations......Page 145
Challenge of Securing E-Documents......Page 147
Protecting E-Documents: Limitations of Repository-Based Approaches......Page 148
Limitations of Current E-Document Security......Page 149
Where Do Deleted Files Go?......Page 150
Secure Printing......Page 151
Serious Security Issues with Large Print Files of Confidential Data......Page 152
Controlling Access to Documents Using Identity Access Management......Page 153
Data Governance Software to Manage Information Access......Page 155
Secure Communications Using Record-Free E-Mail......Page 156
Digital Signatures......Page 157
Data Loss Prevention Technology......Page 159
Basic DLP Methods......Page 160
The Missing Piece: Information Rights Management......Page 161
Key IRM Characteristics......Page 163
Other Key Characteristics of IRM......Page 164
Notes......Page 166
Cyber Attacks Proliferate......Page 169
The Insider Threat: Malicious or Not......Page 170
The Malicious Insider......Page 171
Is Encryption Enough?......Page 172
First-to-Market Enterprise Digital Rights Management Solutions......Page 173
The Promise of Data Loss Prevention......Page 174
Device Control Methods......Page 175
A Hybrid Approach: Combining DLP and IRM Technologies......Page 176
Securing Trade Secrets after Layoffs and Terminations......Page 177
Persistently Protecting Blueprints and CAD Documents......Page 178
Approaches for Securing Data Once It Leaves the Organization......Page 179
Document Labeling......Page 181
Confidential Stream Messaging......Page 183
Notes......Page 186
PART V Rolling It Out: Project and Program Issues......Page 189
Determine What Will Fly in Your Organization......Page 191
Strategic Business Drivers for Project Justification......Page 192
Benefits of Electronic Records Management......Page 195
Presenting the Business Case......Page 198
Notes......Page 199
CHAPTER 14 Securing Executive Sponsorship......Page 201
Executive Sponsor Role......Page 202
Project Manager: Key Tasks......Page 203
Evolving Role of the Executive Sponsor......Page 205
Notes......Page 207
Business Driver Approach......Page 209
Classification......Page 210
Document Survey Methodology......Page 211
Interviewing Staff in the Target Area......Page 212
Setting Up Interviews......Page 213
Necessary Information......Page 214
Prioritizing: Document and Records Value Assessment......Page 215
Second Phase of Implementation......Page 216
Notes......Page 217
Evaluation and Selection Process: RFI, RFP, or RFQ?......Page 219
Request for Information......Page 220
Request for Proposal......Page 221
Negotiated Procurement......Page 223
Evaluating Software Providers: Key Criteria......Page 224
Company Viability......Page 225
Support......Page 226
Access to Senior Management......Page 227
Total Cost of Ownership......Page 228
Negotiating Contracts: Ensuring the Decision......Page 229
More Contract Caveats......Page 232
How to Pick a Consulting Firm: Evaluation Criteria......Page 233
Monitoring and Accountability......Page 237
Why Continuous Improvement Is Needed......Page 238
Notes......Page 240
Conclusion......Page 241
Note......Page 242
Note......Page 243
National Archives and Records Administration (NARA)......Page 245
Sarbanes-Oxley Act (SOX)......Page 246
CFR Title 21, Part 11—Pharmaceuticals......Page 247
APPENDIX C Listing of Technology and Service Providers......Page 249
Glossary......Page 263
About the Author......Page 269
Index......Page 271