Osterman Research

I spent some time at EMC World last week in Las Vegas.  As always, it was time well spent in informative sessions and in individual meetings – and, gauging by the difficulty of traversing the hallways between sessions and after keynotes, the show was very well attended.

Although my bent in visiting a show like this is normally geared more toward security, archiving, encryption and other topics related to what Osterman Research does, two of the major themes I took from the conference were the growing importance of Big Data in the context of improving security; as well as the need to view backup, archiving and disaster recovery along a continuum of data and information protection instead of individual point solutions.

With regard to the issue of Big Data and security, I believe that EMC and many others are correct in viewing Big Data as an important way to significantly improve the security of systems, networks, messaging and virtually every application on which we rely to get work done.  The issue of Big Data in a security context is a simple one: analyzing vast amounts of data from email, social media posts, transactions, various applications, location-generating systems and other data sources with the goal of determining when systems have been breached or are about to be.  The goal is less about preventing the ingress of bad guys and malicious content and more about analyzing the sometimes extremely subtle anomalies that occur when they do.  This is not to say that intrusion prevention or blocking content is irrelevant or futile, but rather that Big Data can be useful in keeping bad guys out, but more useful once they’re inside.

A good analogy that one speaker used – and that I am extending here – is that of the human body: your skin and other systems were designed to prevent intrusions of bacteria, viruses and other nasty stuff and it keeps most of this unwanted content out quite well.  However, when the inevitable intrusion occurs through a cut or some other breakdown of this intrusion prevention system, the immune system detects the sometimes very subtle anomaly and immediately goes to work in identifying, finding, encapsulating and destroying the intruding content.  In a sense, Big Data can act as the information source the enables the immune system in a corporate network or a cloud-based system, for example.

The second major theme – viewing backup, archiving and disaster recovery holistically – is an issue that I think will get more play simply because it make so much sense.  Many decision makers tend to view these systems as point solutions with fundamentally different goals and often use different vendors to implement each capability.  While there’s nothing at all wrong with that approach, it might more sense in some environments to view these solutions along the continuum of data protection, information protection and business protection.  Yes, backups are designed to protect snapshots of data to restore servers; archiving systems are designed to protect information for purposes of e-discovery, regulatory compliance or end-user self-service; and disaster recovery systems are designed to protect data and information from disruptions large and small.  However, all of these solutions are designed to protect an organization and its data along a continuum of sorts, and so it makes sense to manage them as parts of a whole instead of islands unto themselves.

A good friend in Washington recently posted this on Facebook:

“I follow on Instagram almost all of my 6th grade youth group girls and I am continually amazed at how many of them have public profiles and post screen shots of their personal information. I wonder how many parents actually know what pictures they’re posting and if they really care…”

This is troubling on a couple of levels. First, many social media users tend to overshare their personal information and so are more susceptible to online fraud like email phishing. They’re opening themselves to a potentially higher likelihood of home burglary when they post near real-time photos of themselves on vacation or otherwise away from home. Young people, in particular, might be opening themselves to the worst kind of child abuse—a British newspaper did a search on Twitter and within two minutes found 20 users who expressed interest in “under-age images and child abuse”; within two hours they found 200.

Young people are typically the worst offenders because they care less about the privacy of their personal information. Lest you think I’m just some old guy making sweeping generalizations about young people, a new survey from the USC Annenberg Center for the Digital Future and Bovitz, Inc. found that while 77% of those 35 years of age or older agreed with the statement, “No one should ever be allowed to have access to my personal data or Web behavior,” only 70% of younger people agreed. I anticipate that as people grow up in an age of continual connectedness via social media, the proportion that care about personal privacy will continue to shrink.

However, employers need to be concerned about this, as well, since these are the people that will be your employees in the years to come. We hear on a regular basis how businesses must adapt their communication practices to young people entering the workforce—they need to make social media easily accessible, permit the use of personally owned smartphones and tablets, and generally migrate away from an email-centric mode of communication and collaboration. While that’s true, business decision makers also need to be concerned about the very real potential for oversharing employees to overshare corporate content. While much of this might be accidental, an employee with a predispostion toward oversharing personally is likely to do so with corporate information, as well.

It’s important to note that by oversharing, I’m not talking about sending things like trade secrets, confidential financial reports, or other really sensitive information through social media or other channels. While that can and does happen, quite often the oversharing can be more subtle. For example, an employee of a consumer products company who continually posts about business travel to Minneapolis or Atlanta or Issaquah might be giving clues about an upcoming retail deal with Target or Home Depot or Costco—information that could be valuable to competitors, but that was shared with no intention of revealing confidential information.

What should businesses do? First and foremost, establish policies focused on how devices and applications should be used—lots of organizations don’t have these policies, and they should. Second, implement a data leak prevention solution that will monitor all of the channels over which employees communicate, including email, social media, instant messaging, etc. The goal of the DLP solution should be to monitor communications and take appropriate action, which might include encrypting some content, blocking some messages, reminding senders about corporate policies before the send actually occurs, or routing some messages to a supervisor or compliance officer for further review.

Entering a new age of communication and collaboration with employees who might be less concerned about privacy means that decision makers need to be proactive in order to mitigate risk to the extent they can.