I'm Free!

Documents cross firewalls all the time, as downloads from web sites, portals, FTP sites, email attachments, etc.

Why should a CIO worry about this?

It’s under control, right?  After all, the networks and desktops are locked down tight right?  In actual fact I’ll bet they are locked down so tight people can barely get any work done and it takes months in costly project over-runs to get anything done due to the complexity of setting up network security, Web filters, reverse proxies, etc.

Like many countries, companies are dealing with the threat or opportunity of new technologies such as social networks which enable the viral spread of information.  So which is it; threat, opportunity or both?

First; What is a Firewall?   (From Wikipedia)  http://en.wikipedia.org/wiki/Firewall_(computing)

“A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications. It is a device or set of devices that is configured to permit or deny network transmissions based upon a set of rules and other criteria.”

However from an application perspective it prevents pretty much anything from happening across the network without a lot of effort.

So, on to the Opportunity section…  We have all heard the hype about how social networks and Enterprise 2.0 will open the enterprise and help the spread of information, increase job satisfaction and enhance productivity.  pardon my “yawwwnnn…” at this point.  It has been said for pretty much any new computer application, otherwise who would spend money on it?

But… it does have some amazing effects.  Who would have  expected the net effect of social networks, mobile devices and totalitarian regimes?  I must admit the thought had crossed my mind but I didn’t expect it to happen so dramatically.  And as the Prime Minister of Canada, Harper, said: “You can’t put that toothpaste back in the tube”. ..

From our perspective, in democratic countries, that was an exciting and joyous moment.   In other totalitarian regimes it was a warning shot and rationalization for information control.

But, wait a second, aren’t companies and government agencies totalitarian?  They are not democratic, although many like to manage by collaboration and consensus, and ultimately depend on a hierarchical command and control structure.  Well, yes they are totalitarian in nature and they are obsessed with information control and security.

Having said that some organizations are showing marketing and PR savvy by utilizing a carefully guided and crafted social network presence.

The viral effect of  social networks is like Karma at the speed of light.

“Our deeds determine us as much as we determine our deeds.”

~George Eliot

Things do not spread or gather social momentum unless they are attractive to others and or serve the purpose of another.  So, companies can post the same ol’ on social networks and it will just sit there and do nothing or they can do really cool things on social networks.

In order to get content across a firewall to a social network someone needs to post it.  That is how things happen on traditional corporate portals and websites.  It goes though a committee like process, gets approved and published and then sent out for public consumption.  One small problem with that, or huge problem with that…  depending on how you see it.  It won’t work very well with social networks because it is not participatory.  The organization’s people can’t participate, make witty comments, make mistakes, say inappropriate things, or accidentally (or on purpose) “out” sensitive information.  That is what social networks are all about; the organic, fast moving, self managed, self directed communal mentality with the attention span of a gnat.

The threat?  Yes, there is a very real threat of leaking or exposing information inappropriately.  Wikileaks being the poster child for the effect of leaking information..   There is also the very real issue of exposing information assets and networks to black-hat (bad guys) hackers.    There are lots of random lone-wolf, organized crime and organized government hackers out there.  It is a sad fact that networks do need to be over-secured.

However, the greatest threat is from those persons inside the organization.  There is the classic disgruntled employee, industrial spy plant, government leaker and accident or sloppy employee with a password written on a sticky note on their monitor.

I think we would all be able to relax just a little bit if as much attention was paid to task analysis and information security across the organization as is paid to efficiency studies in supply chain.

Wha?

This is what I mean: Study the information flow in the organization to see who does what to which pieces of information.  Then define the security requirements for each piece (even subparts) of information at the task level in each work flow, even ad-hoc ones.  Then choose the right technology that will enable you to assemble and secure this information for the various outputs you require.   Then, setup pilot programs to prove it out and then apply it in the most critical areas.

So, you say you have already done this?  BS I say.  What if you were to copy a sensitive piece of information to a wikileak site or USB drive?  Can anybody read it or do you need to decrypt it?  Do you even delete the content when the retention policy says to according to internal policy and regulation?  Do you or your organization even know or defined what that is?  I doubt it.  Not many have.

Most organizations are sitting ducks.  It is time to smarten those ducks up.   Then and only then can you be sure accidents or intention breaches don’t happen and people can feel safe about sharing the information they should.  This will create a more open and nimble organization.  That is unless you just say you don’t need the analysis in the first place and just lock everything down…

Why do I bother sometimes...

Business and even enterprise needs to get smart with how they look at smart phones.  Lets face it, a device is only as good to a business as how it makes them money.  So, instead of thinking of how to push advertising to the device, which is the current Internet advertising and monetization model, you need to start thinking about how you can have an immediate customer “wow” moment.  So I will give away a freebie idea.  Remember we are really talking about a handheld computer, not just something to talk or type emails or texts into…

I just had a thought I can share for any corporate sales types.  You just know that when you are out and about shopping, at the game, at the restaurant, airport, conference…. that there are potential customers walking by that would like to ask you a question about your product.  What if…  you could make your presence and professional (or personal) interests available by proximity so a busy IT manager, waiting in an airport, could say hey, can we talk for a second about your firewall capabilities for the new operating system product?…

That one was a freebie .  If you make a mil with that mobile app, think of me and “Like” my FB page…

Business is embracing new technologies at a staggering pace. Internet innovation is coming faster and faster and more new ways of communicating are being adopted. Add to the mix the fact that courts know you have them … somewhere… and you have a very perplexing problem.

There are two ways to manage the risk. What risk you ask? You just tell your IT people to go find everything related to this issue or that person, right? How difficult can that be? Well, if you have a strategy to manage each type of digital asset and can explain it to the opposing counsel and inevitably a judge, who are becoming more switched on every day, you can probably muddle through as long as you can deliver the results in a reasonable time frame. There is that “reasonable” word…

What results? They will want to see every document, email, text, tweet, FaceBook note, etc. that relates to the issue at hand. From an IT perspective this is one onerous task. To put it in perspective, last year I heard the head legal council of a F100 company say that if they get a serious lawsuit and it comes in under $20 million, they consider settling because it may cost them more to do a discovery of the data. I was shocked. And it led me to ask myself “Why, with all the IT assets at their disposal do they not know where everything is?

The answer to that comes back to my earlier statement of two alternative strategies for handling risk. The first is 1) Proactive Information Management Strategy. 2) Reactive eDiscovery strategy. If you are unprepared (and most are) you will go into #2 very quickly. (Pun intended). This is the most expensive way to handle it because IT has to make a copy of everything they have in emails, shared drives and relevant enterprise systems and then hire very expensive software and experts to sift through it. If you think that IT storage is expensive, then double it and that is still the smallest part of the cost involved. Also consider that the laptop and desktop hard drives of execs, and relevant staff are taken and copied as well and you can start to see what an impact this may have on the organization. And then just when you think you have it handled the opposing counsel is not satisfied and your company gets sanctioned and a court ordered discovery happens and your company is filled with lawyers sifting through your desks, at your expense…

So to avoid all that nasty business you act proactively. Does that mean you buy all the expensive eDiscovery software, staff up to handle it and double your storage in case you are sued? Perhaps in the sort run, but there is a much better way to handle it.

Some notable organizations have seen the light and embarked, a decade ago on an enterprise wide vision of knowledge/document/information/content/records management. If done properly you will know where all your digital assets are. Yes, those texts, done on company time are company assets… Check the fine print of your employment contract if you don’t believe me. Also the reason for the slashes and types of information is that these are all interchangeable depending on how you look at it. Sounds overly complicated? You bet, your information is as complicated as your entire company. However, the end result is that not only will you be able to easily identify information in a systematic and cost effective way, your organization will function more efficiently. What is the symptom of information not working efficiently? Listen in the hallways and are people saying “I can’t find this or that information?”. If you have not got ahead of the wave which is the huge increase of digital information in organizations you are going to have to find a way to catch up.

So the proactive strategy involves a strategy and it looks , at a high level, like this. However before the CIO starts they need executive sponsorship at either the CEO, COO and CFO level. COO seems to work best according to stats. Also a steering committee with senior stakeholders needs to be formed as well as a serious budget. If you are going to do this, do it right the first time.

1) Enterprise wide information analysis (what information goes in and out in order to produce your products or services)
2) Enterprise wide task and work flow analysis (How the information is handled during that process)
3) Enterprise wide information taxonomy (flows from 1 & 2) including legal, compliance, records, knowledge search and potential eDiscovery meta data(structured data in a database describing unstructured information like documents or images) requirements
4) Requirements and solution analysis and review (what have you got to deal with this and what do you need to accomplish it with the least cost)
5) 5 year road map and strategy
6) Going-forward “Plan, Do, Review” strategy (this needs to be ongoing since your organization will change over time)
7) Implementation done in small chunks which suit the long term and enterprise wide architecture and provide for a series of wins across the organization and get people cheering for you.

It all comes down to “reasonableness” but you have to act ahead of the wave not behind it. The information Tsunami is here.  Deal with it.