Recently in Electronically Stored Information (ESI) Category

"It's compliance Jim, but not as we know it"

on August 31, 2010 12:34 PM | Permalink | Comments (0)

From Robin Smith, Technical Manager, EMEA, FaceTime Communications

I recently read an article posted on The Register, based out of the UK, about the great advances the current version of Microsoft's Unified Communications platform (OCS) has made, when compared with previous incarnations. I'm in full agreement and look forward to the next release, currently called CS14, details can be found here. Given that a large number of our customers have either industry or legal compliance requirements they must comply with, I did feel one of the final comments needed a little more qualification than space in the article allowed for:

"...if compliance is a concern, you have IM archiving"

The moment I read that, I was catapulted back to the late 1980s and ever since haven't been able to get the incredibly annoying "Star Trekkin" by "The Firm" out of my head. Click here or search YouTube for "The Firm - Star Trekking" if you have no idea what I'm talking about - your ears won't thank you. Why? Well, compliance is in the eye of the person with a fine and possible jail sentence hanging over their head and as Spock's line in the song goes:

"it's life Jim, but not as we know it."

There are in fact a few different ways you can store OCS IMs both natively with Microsoft products and using third-party solutions. But, as those who write on bits of paper or print things out so they don't forget or lose them and then can't find the bit of paper when they actually need it can attest to, just because you've archived something doesn't mean:

you can ever find it again, even though you know it's in that pile somewhere
it will be complete, maybe the dog ate half of it
that it will come back looking the same, maybe you spilled coffee on it or you printed out several pages and they've been mixed up so the order is wrong
that someone else can look through the pile and find the piece of paper
different things of difference genres or sizes will fit or stay in the pile properly

To achieve all of the above, you need special controls around how you capture, store, search and recover data.

You need to be able to show that what has been recovered is the same as what was originally stored and that it is a true representation of the original data. You should also make sure that in the case of a multi-party chat where someone wasn't part of the whole conversation that the view of their data is different to that of the other participants'. Let alone the ease of use issues around eDiscovery; making it possible for someone (often non-technical) to search the archive and recover what they need without having to become an expert in SQL scripting. So if we can achieve that, are we compliant? Maybe, maybe not.

What about usage policy? Can my Traders and Research teams talk to each other? Do I want Billy in the call centre using my OCS system to ask all the eligible young ladies in the department out on dates?

What about content security? If I'm allowing file transfers, shouldn't they be stored along with the IM conversation transcripts? Shouldn't you be virus checking file transfers, making sure that staff aren't using inappropriate language over IM, especially with business partners through my OCS edge server.

My point is that for some people compliance isn't just about storing what happened, it's about making sure certain things can't happen in the first place and being able to retrieve it in a fashion that meets regulatory requirements.

"There's Klingons on the starboard bow"

The list goes on...and we haven't even thought about what else is happening on the corporate network. What about Skype, Yahoo, GoogleTalk , Windows Live Messenger and Blackberry PIN / SMS to name but a few?

Of course the OCS Archive server wasn't designed to be an enterprise platform covering so many different flavours of IM - but it is rare to see just one flavour of Instant Messaging on a corporate network. From a management perspective alone it makes sense to have a consistent policy around all authorised channels and block everything else.

...and finally, there's the whole issue surrounding Social Networking. "We block it", I hear you say. Well, that's all well and good, but last time someone told me that I searched Twitter and found no less than 5 accounts tweeting on behalf of the company. I then searched Facebook and found a network, groups and employees.

Couple this with the huge pressure many companies are under to enable sites like Facebook, LinkedIn & Twitter for legitimate business purposes along with the reach it gives sales and marketing for the company's brand and you can see why there's such a lot of noise in the corporate space surrounding Social Networking.

Ask FINRA (Financial Industry Regulatory Authority) or the UK's FSA (Financial Services Authority), both have issued specific guidelines regarding social networking posts, saying that they need to be treated as forms of electronic messaging. This means that they effectively need to be subject to the same controls mentioned above.

So. Yes, you can indeed store your OCS IM conversations in the OCS Archive server. Does it give you IM compliance? Not as we know it, Captain.

Robin J Smith is FaceTime's Technical Manager for EMEA, an occasional Star Trek viewer and is currently looking for suggestions on how to get the above song out of his head. You can follow him on Facebook, LinkedIn or Twitter.

New Research: Tracking security incidents against a growing use of collaborative Internet applications

Frank Cabri

on October 27, 2008 12:08 AM | Permalink | Comments (0)

For the fourth consecutive year, FaceTime has commissioned a survey of IT managers and end users to track the use of Internet-based applications - things like IM, Skype, P2P, social networking and other Web 2.0 apps. We also surveyed employee attitudes toward use of those applications and their impact on IT and the organization in terms of security, data leakage and compliance.

As in prior years, the research was conducted among a large sample of corporate IT managers and end users across all size organizations in North America, UK and Europe. The research study includes compiled data from more than 500 IT managers and end users. The results are quite revealing.

Use of consumer oriented Internet applications has reached 97% of organizations, up from 85% in 2007 and, on average, companies report 9.3 applications in use by its employees on the enterprise network
73% of IT managers report at least one security incident as a result of Internet application usage; Viruses, Trojans and worms (59%) are most common, followed by spyware (57%) for a close second
37% of companies report an instance of non-compliance; 27% report accidental data leakage
IT managers report an average of 34 incidents per month, and the largest companies project $125K monthly to remediate Internet usage related security, compliance and data leakage issues
51% of end users access social media sites at least once per day and 79% of employees use social media (Facebook, LinkedIn, You Tube) at work for business reasons
Sixty-eight percent of IT managers have archiving and retrieval methods for corporate email. About half that many--31 percent--store IM communications. One in four has copies of audio conferences (25%), while slightly fewer (20%) archive corporate Web conferences
If requested by corporate attorneys to reproduce IM communications--in the event of a lawsuit, for example--51 percent of IT managers could not do it. Thirty-eight percent because they have no such capabilities and 13 percent could do it but not in any practical time frame
Unified Communications suites exist at about 29 percent of IT respondent organizations. Ten percent have deployed pilots to a limited number of users, while 19 percent have deployed UC for the majority of their endusers

We'll be delving into various aspects of this exhaustive survey in the coming weeks, to break down just what this data is telling us about what's happening on corporate networks and what it means to both IT managers and end users.

It's 10 pm, do you know where your ESI is?

Jim Obrien

on September 15, 2008 4:13 PM | Permalink | Comments (0)

... or even what it is?

Back in the old days, TV networks would run public service spots before the nightly news saying: "It's 10 pm, do you know where your children are?" The fact that the spots ran for twenty years in cities like New York points out that it is easy to lose track of stuff, even important stuff. Which brings me to ESI--Electronically Stored Information. Not that it is as important as your kids, but in the discovery phase of a big lawsuit, it might seem that way. And, like kids, ESI can be surprisingly easy to lose track of.

ESI is the catch-all term for the digitally stored files of litigants in a federal case. During the pre-trial discovery phase of a lawsuit, all ESI is subject to discovery, meaning it all has to be checked for relevant information that the other side has requested to help it prove its case. Only the relevant files need to be actually given to the opposing party, but all ESI has to be checked to make sure all the relevant files have been located and handed over. It sounds simple enough, but it is hard if you are not prepared in advance and a lot can go wrong.

When the e-discovery rules changed in late 2006, there was a lot of commotion about it, and a lot was written about the need for companies to have their ESI organized and well maintained in order to be able to respond to the tight discovery timelines set by the new rules. I don't think that message has really sunk in though. And now that the rules are no longer "new," and the commotion has died down, it is easy for companies to lose track of whether they have really prepared to meet the current e-discovery challenges. Yes, the e-discovery market is growing nicely, but more spending is not assurance that the companies really understand all the risks or even the problems they are trying to solve.

As the resident lawyer at FaceTime, I am occasionally asked to talk about e-discovery issues with customers, or on a panel. Sometimes I can tell that a person I'm speaking with just doesn't want to have to deal with instant messaging in e-discovery, even when IM is used for business purposes in their company. To them, the most obvious way not to deal with it is to make it go away, or more precisely, to take the position that IM logs are not business records and therefore will not be saved.

No saved IM records, no IM ESI, problem solved.

There are undoubtedly circumstances where this is a sound policy, but what I've seen is that such a position is most often taken without enough attention to the reality of how easily IM logs are stored in hard-to-find places, and how difficult it is to effectively enforce a "no IM records" policy when employees use IM for business purposes and may need to refer to those logs the way they refer back to e-mail. The company falls into the trap of mistaking its ESI policy, what the company wants its ESI to be, with the reality of what its ESI actually is -- i.e., what is actually saved, either inadvertently or surreptitiously against policy.

The resulting danger is that the ESI is there, but the company doesn't know it exists until too late. My recommendation is usually that if IM is used for business, then it will generate business records that should be maintained and be treated on par with e-mail records for e-discovery purposes.

If the IM-savvy, and sometimes IM-dependent, companies that FaceTime deals with are still coming to terms with IM logs in regard to e-discovery, then I have to believe that companies in general have not moved much beyond e-mail archiving, if they have a proactive e-discovery solution at all. To me, that's like being happy that one of your kids is watching TV with you at 10 pm. and forgetting about the one you haven't seen since yesterday.

« Compliance | Main Index | Archives | Employee Behavior »

Sun	Mon	Tue	Wed	Thu	Fri	Sat
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30	31

Recently in Electronically Stored Information (ESI) Category

"It's compliance Jim, but not as we know it"

New Research: Tracking security incidents against a growing use of collaborative Internet applications

It's 10 pm, do you know where your ESI is?

August 2010: Monthly Archives

Categories

Monthly Archives

August 2010

About this Archive

Twitter Updates

Search

Blog Roll

Comment/Trackback Policy