Message Archive

Social Media as Time Machine

Michael Osterman — Mon, 16 Jan 2012 01:50:33 +0000

Outside of the financial services industry, very few companies actually monitor what their employees say on Twitter, Facebook, LinkedIn or any of the 1,000+ other social media sites around the world. Few companies scan short URLs for potential links to malware sites. Few have deployed systems to protect against spam delivered via social media. Few have deployed systems to capture whatever business records or other important content might be posted to social media sites.

In a way, social media use in the vast majority of organizations is like email was back around 1997—not much in the way of anti-spam, anti-malware, content filtering or archiving is in place to protect organizations from all sorts of harm. Use social media today and—at least from the perspective of how protected you’ll be against spam and malware—you can recreate your email experience from yesteryear.

Should you be concerned about? Yes:

Facebook says that about 4% of its content is spam and Twitter said that 1.5% of its tweets were spam-like in 2010 (numbers not dissimilar to email spam figures back in the mid- to late 1990s). However, Imperium estimates that 400 million Facebook are victims of social spam each day.
Last week, malware stole login credentials for 45,000 Facebook accounts—a small proportion of the approximately 800 million accounts in use today—but 45,000 nonetheless.
Imperium estimates that 40% of the social profiles in existence today are frauds.
Our own research indicates that only a small proportion of organizations are archiving their social media content, despite the fact that some of this content is potentially actionable or might be subject to legal or regulatory scrutiny at some point.

Clearly, there is a problem: lots of malware and spam floating around, millions of tweets and posts that probably should be archived, and few companies doing anything about it.

We are in the process of writing a white paper that addresses these topics, and will be launching a major study within the week on how social media is used and perceived, and what organizations are doing to protect themselves. Let us know if you’re interested in what we will be finding from the research.

Retain Emails Or Risk Fines

Stephanie Jordan — Tue, 03 Jan 2012 02:54:31 +0000

The need for organizations to retain emails will continue in 2012, regardless of business size. On the heels of December news that Citigroup agreed to a $750,000 (USD) civil fine for not retaining millions of emails, it is a sober reminder that losing email is not an option for regulated industries. While Citigroup should receive some kudos for self-reporting its loss (which occurred during an upgrade of its email archiving system between October 2008 and December 2009) the Financial Industry Regulatory Authority (FINRA) still determined the incident to be inexcusable.

I recently heard that Atos, one of Europe’s largest technology companies, plans to phase out email between colleagues over the next three years. The company’s more than 75,000 employees will be required to communicate with each other via instant messaging and a Facebook-style interface instead. This is the first I have heard of such a policy, but I doubt that 2012 will see a lot of this type of action. The company hopes this plan will increase productivity because the volume of email, which the company estimates to be up to 20 hours worth of worktime, is reportedly not translating to useful time spent. Of course email from outside the company will still be floating around. The idea is being met with both criticism and accolades.

“The goal of reducing the amount of data that is fast polluting our working environments and also encroaching into our personal lives is noble,” comments Nick Mehta, CEO of LiveOffice, a cloud-based email archiving company. “However, the idea of moving to a new communication mechanism is simply shifting the problem. The problem is that there is too much information and too much communication. This data explosion will follow you to whatever communication media you use.”

I have to agree with Mehta. Email is not going away. In fact, a new study published by Return Path, Inc. makes the point that while desktop and webmail use might be decreasing, a top (and increasing) use of smartphones is access to email. The study takes a look at the impact mobile is having on email viewing. (Note that webmail might have decreased by 11% according to the study, but it was still found to be the dominant platform (44%) for email access.)

In the study, Return Path researchers make this prediction: “Email is an important business tool, so some combination of desktop and webmail use is likely to remain dominant well into 2012. But the number of people who opt for smartphones increases each quarter, meaning email viewership on these devices will continue to grow. Add in the iPad and we predict that mobile viewership number will tick up by a measurable amount by the end of 2012.”

With email use firmly in play, the need to archive continues,no matter where it is accessed. As if to punctuate the news of Citigroup, Osterman Research and ArcMail just published a timely report called “The Critical Importance of Archiving in the Financial Services Industry.” (The paper is offered at no cost if you register with ArcMail.) It is filled with valuable takeaways for financial services firms as well as organizations in other markets, and provides three key steps that businesses can take to address compliance and retention obligations:

Every company, regardless of its size, must develop policies focused on the retention of its business records.
It is critical to deploy archiving technology that can satisfy content retention policies for email messages and their attachments, as well as potentially other types of content such as files, social media posts, instant messaging conversations and other data.
Choose an archiving system that can integrate with and satisfy other organizational requirements, such as making content available in a format that will satisfy regulators, external legal counsel and others.

Osterman notes early in the paper that “Some financial services firms do not archive their email and other electronic content because of their misperception that it is less expensive to pay the fines associated with non-compliance. That said, it is difficult to ascertain exactly how many firms fail to meet their retention obligations because few decision makers are willing to admit publicly that they are making a conscious decision to violate federal and other requirements for preservation of content. However, given the financial meltdown that began in late 2008, we can surmise with almost absolute certainty that government and industry oversight of the financial services sector in the context of data retention will become more stringent and more difficult over the next several years, and that archiving systems will play an even more important role in helping financial services firms to comply with their regulatory and legal obligations.”

The paper offers a list of current compliance requirements and steps to address compliance.

“The question facing financial services firms today is no longer whether to retain data, but how much to retain and how to go about getting the job done right,” says Rory Welch, CEO of ArcMail.

Although Welch is focusing on the financial services industry, others can benefit from best practices and adopt what makes the most sense for their industry types. With many compliance rules pertaining to data about employee and customers, most all businesses have some component of the need to retain email.

One thing we know for sure about 2012, email is not going away. Despite attempts like the one being planned by Atos. Like many, Mehta believes, “Previous attempts to move off of email (IM, Google Wave, etc.) have by and large been failures. The problem is the work culture—not the communication system.” However it turns out, it will be an interesting case study to follow.

Whether it is email, IM, or social media, data retention is indeed a challenge, due in large part to the sheer volume that passes through each messaging technology and the variety available. But a constant among all of it is the need to manage the medium regardless of type and find a reliable archiving technology that works for you.

Do You Really Think You Don't Need to Monitor Outbound Content?

Michael Osterman — Thu, 08 Dec 2011 23:12:18 +0000

Electronic communications is a two-way street: With the right tools one can illuminate the world with words of wisdom and insight. Alternatively, one can demonstrate why the most powerful communication tool they should be given is a crayon.

What reminded me of this was two things:

We received an email this morning from someone who signed up to be on our survey panel 13 months ago. As we do with everyone who signs up for the panel and provides us with a corporate email address, we send an email to verify their identity. We received it and added him to the panel in November 2010. This morning, in response to a mailing, he replied “That’s nice…I don’t give a ****.”
Also today, there is an article about three staffers who worked in the office of a Washington-state US representative. These staffers, probably not intending to get fired, did just that via Twitter. Among their less-than-wise posts were “Dear taxpayers—I hope you don’t mind that I’m watching YouTube clips of Nirvana at my government job. Thanks, you’re the best”, and “I really like DC, but I could have used another day away. The silver lining is that I don’t have to see my idiot boss.”

Two really important lessons here, one for employees and one for employers:

Employees: Your electronic words exist forever on tape, in archives, in inboxes and, in the case of tweets, in the Library of Congress. They might come back to haunt you and, if they’re egregious enough, probably will as in the case of the Congressional staffers who were fired 70 minutes after their conduct was discovered.
Employers: Monitor what your employees are saying via Twitter, email, etc. A failure to do so can damage your corporate reputation, result in legal or regulatory sanctions, reduce your revenue, and leave you wishing you had deployed monitoring technology that is probably less expensive than you think.

SMBs Need Email Archiving Too, Five Common Mistakes to Avoid

Stephanie Jordan — Wed, 30 Nov 2011 18:37:08 +0000

Increasing regulation and litigation mean that email archiving is becoming essential for companies of all sizes and in all industries—not just for finance, health care, and government. Deborah Galea, COO and co-founder of Red Earth Software recently shared with me five common mistakes that SMBs make when thinking about email archiving

Mistake One: Thinking small companies do not need an email archiving solution. Civil litigation can hit any company at any time, and if you cannot provide emails during the eDiscovery process, you could get hit with major financial sanctions. It’s also important to archive emails in the event of any sort of employee dispute, such as a layoff or a firing. Protect your company and make sure to have an email retention policy in place.

Mistake Two: Putting off implementing an email archiving system to save on costs. Although there are certainly a lot of expensive email archiving systems out there, more cost effective solutions are now becoming available. Cost is really no excuse anymore for not having an email archiving solution in place.

Mistake Three: Having only one employee knowledgeable about the system. Employees come and go and you don’t want only one person, such as a lone IT manager, knowing how to update and troubleshoot the system. Make sure all employees are aware of the email retention policy and make sure more than one person is able to use it effectively.

Mistake Four: Not having a data map. It is important to know what kind of electronic data your company has, where it is located and how to access it. Any company, large and small, should have an eDiscovery data map (view sample data map) to ease eDiscovery requests and to help meet retention guidelines.

Mistake Five: Not regularly testing or updating the system. An email archiving solution is useless if it has any downtime or is out-of-date. Make sure that the system is spot-checked regularly and remember that this is not a “build it and forget it” project.

As Galea notes: “Even just a few years ago, many companies had no idea what email archiving entailed. Fast forward a few years and most companies know that they need to have an email archiving solution in place.”

Whether you are moving from knowing you need an email archiving system to actually implementing one or if you already have one, these five common mistakes are good review for us all.

YouSendIt Has Reached 30 Million Unique Users In Nearly 200 Countries

Melisa LaBancz-Bleasdale — Fri, 27 May 2011 06:06:24 +0000

YouSendIt,makers of file sharing solutions for professionals, announced that it has reached a new milestone surpassing 30 million unique users across 193 countries in the past 12 months. This includes more than 18 million users who have registered for an account and over 400,000 paid subscribers.

Over the past few years, YouSendIt has refined its expertise in the freemium business model and can now claim one of the highest free-to-paid conversion rates in the industry. The company also enjoys strong customer loyalty with a Net Promoter Score of 68 percent. According to the 2011 Net Promoter Industry Benchmarks by Satmetrix, companies with similar scores include Amazon.com and Apple.

Corporate Users Now in Over 92 Percent of Fortune 500
The company stated that growth has been particularly strong among corporate users. YouSendIt now has users in 92 percent of Fortune 500 companies. The company’s focus on business users, investment in robust cloud computing services and the delivery of new products for enterprise-wide deployment have been key to this growth.

“As file sizes continue to grow and distributed collaboration becomes a fact of life, the demand for our service has never been stronger,” said Ivan Koon, CEO, YouSendIt. “Today’s professional requires new tools for the challenges of balancing work and personal life. We’re focused on creating seamless file mobility for business content – product designs, medical images, sales contracts and creative assets. Our customers spend a lot of time collaborating with clients, colleagues and partners. We make it easy and intuitive for them to move their documents so that they can be truly free to create and collaborate.”

Volkswagen, Callaway Golf and Nixon Peabody LLP are among the companies using YouSendIt today.

“We’ve seen a significant productivity increase in transferring electronic data related to e-discovery using YouSendIt,” said John Roman, Director of Litigation Technology Services, Nixon Peabody LLP. “It has given Nixon Peabody the peace of mind to be able to send critical data securely.”

Strategic Partnerships Bring YouSendIt to New Users
Continuing its commitment to enrich the user experience of its popular web email service, Yahoo! partnered with YouSendIt to launch the YouSendIt Attach Large Files application earlier this year. YouSendIt grew its user base by more than 1 million in 60 days through the application and continues to average more than 20,000 new registered users a day through the app.

“YouSendIt’s Attach Large Files has swiftly become one of the most popular applications in Yahoo! Mail,” said David McDowell, Senior Director of Product Management, Yahoo! Mail. “Yahoo! Mail users are able to send large files up to 100 MB per mail, which allows our 284 million users to share videos, photos and presentations directly from Yahoo! Mail.”

Following the introduction of YouSendIt Pro capabilities within the Attach Large Files app this month, YouSendIt Pro users can now enjoy all the benefits of their Pro account – including sending up to 2GB of attachments per email – within Yahoo! Mail.

Industry Recognition
Thanks to its explosive growth, YouSendIt ranked in Deloitte’s Technology Fast 500 and Inc. Magazine’s Inc. 500 in 2010. The company also received the Red Herring Global 100 Award, honoring promising new companies and entrepreneurs that change the way people live and work.

Cloud Security Acceptance Takes Step Forward as USDA Awards FISMA Certification for Microsoft and Proofpoint, Google FISMA Certification Still Pending

Stephanie Jordan — Thu, 05 May 2011 17:26:21 +0000

Recently the United States Department of Agriculture (USDA) granted Microsoft’s Business Productivity Online Suite—Federal (BPOS-F) the authorization to operate (ATO) under the Federal Information Security Management Act of 2002, more widely known as FISMA. This congressional legislation requires every agency within the United States Federal government to ensure the security and protection of Federal information and information systems. As part of the compliance to the law, each Federal agency must adhere to standards and guidelines that meet minimum security requirements and controls. Each agency has the freedom to select its software and hardware solutions, but there is a certification and accreditation process that must be obtained.

In mid-April there was a scuffle between not yet FISMA-accredited Microsoft and rival Google, as Microsoft called foul for Google Apps for Government being marketed as FISMA certified. It’s actually Google Apps Premier that is FISMA certified. The full expectation is that Google Apps for Government will gain certification, as it’s a modified version of Premier. However, Google assumed its own certification status, which is unfair misrepresentation of its Apps for Government.

About a week later, Microsoft’s BPOS-Federal received FISMA certification and accreditation—the USDA issued an ATO on April 19. BPOS-Federal, which includes Exchange Online, SharePoint Online, and Office Communications Online, is one of several messaging and collaboration solutions hosted by Microsoft Online Services.

“As cloud computing continues to gain traction across government, it’s the responsibility of cloud providers to deliver the same levels of security that agencies have come to expect from on-premise solutions,” notes Susie Adams, chief technology officer for Microsoft Federal. Adams believes the USDA validated its cloud security offer when it granted the ATO to Microsoft. Indeed the cloud does seem to be gaining converts in the original debate questioning if on-premises was more secure.

In her blog, Adams acknowledges the shift, stating: “Meeting the demands of a new computing environment poses security concerns, but the solutions are grounded in the same best practices we’ve been employing on behalf of government agencies for over 25 years.”

It is a complex process to achieve FISMA certification and involves third-party assessments of a wide variety of security features and policies. Yong-Gon Chon, CTO of SecureInfo Corporation, the third-party involved for Microsoft, gave an interesting account of what goes into a FISMA certification. He notes, “Our assessment was rigorous and required Microsoft to demonstrate effective implementation of approximately 160 different management, operational and technical controls to a team of subject matter experts with a combined total of 99 years of industry experience. Our testing included an extensive review of their policies and procedures, interviews with their key personnel involved in delivering and supporting BPOS-F, examination of security related configuration settings, vulnerability scans of all components included within the environment (operating systems, databases, and web applications) and penetration testing.”

In conjunction with Microsoft’s BPOS-Federal FISMA certification, Proofpoint’s Enterprise Archive solution was also granted an ATO by the USDA, which will use the solution for compliant email archiving. According to Proofpoint, Enterprise Archive is the first cloud-based archiving solution to be given the ATO by a Cabinet-level agency and—with its 120,000 Microsoft users spread throughout 21 departments—is the largest U.S. Federal government implementation of cloud-based enterprise email archiving technology to date.

“Many Federal agencies are looking to cloud-based services to help them meet the dual challenges of tightening budgets and more severe and frequent security breaches,” says Andres Kohn, vice president or archiving and eDiscovery solutions for Proofpoint. “By achieving FISMA certification for our email archiving solution in conjunction with Microsoft BPOS-Federal, Proofpoint is opening the door for more rapid adoption of cloud-based email solutions throughout the U.S. Federal community.”

Microsoft plans to pursue FISMA certification and accreditation for Office 365, its next generation cloud productivity suite, after it launches. Google is expecting FISMA certification and accreditation for Google Apps for Government “imminently.”

The Role of Online Backup, Synchronization and Archiving

Michael Osterman — Wed, 06 Apr 2011 04:37:42 +0000

Backup, content synchronization and archiving are all important best practices for any organization, but—as I was discussing yesterday with a new client via email—there is very little overlap between each of them:

Backups are vitally important to protect the content of email servers, application servers, desktop computers, laptops and other systems in the event of a hard disk crash, an application upgrade or a patch that goes awry, or a malware attack that deletes data. Backups are also a key part of a disaster recovery program that moves data off-site in order to protect it from burglary, natural disasters, fires, hacking or other catastrophic events. Backups are important whether you’re a SOHO user or in the largest enterprise.
Synchronization is important because it allows users to have access to data in near real time, wherever they are. Enterprise-level content replication capabilities have been available for many years in offerings like Lotus Notes/Domino, where content is replicated across multiple servers. More recent synchronization offerings, such as Dropbox and SugarSync, have made synchronization services available for small business and individual users.
Archiving is a key best practice because it focuses on data retention from a strategic perspective. A backup system copies raw, unindexed content to backup media for purposes of restoring a server or other computing platform for tactical purposes. An archiving capability, on the other hand, indexes content, places it into archival storage where it cannot be modified after the fact, and then provides tools to search through this content for purposes of e-discovery, regulatory compliance and other purposes.

While an archiving system actually does backup content, often on a near real-time basis, it cannot normally be considered a backup system. Similarly, while a backup system can be considered a rudimentary archive, it does not serve the same purpose. A synchronization system, while copying data to other platforms, is not really a backup or an archiving system.

Call Mom When You Need e-Discovery

Michael Osterman — Thu, 24 Mar 2011 20:47:52 +0000

A teacher in Kent, Washington has been suspended for allegedly having inappropriate relations with a student. The affair was discovered after the student bragged to an uncle about the relationship, and after the student’s mother found a large number of text messages between her son and the teacher on the student’s mobile phone.

In a totally unrelated case, a blogger/reporter decided to conduct an experiment to see if text messages sent by Seattle City Council members are preserved in accordance with Washington State’s public disclosure law. The reporter was told by a City official that the Council member in question “did not retain copies of text messages sent or received for [the] time period” requested.

The lesson here is clear: if you need to perform e-discovery on text messages, hire a mom, not a government official.

Social Media Compliance

Stephanie Jordan — Mon, 28 Feb 2011 06:00:00 +0000

The popularity of social media and the demands it places on IT organizations can be looked at from a variety of angles: bandwidth, productivity, security, etc. But don’t forget to also think about how it affects compliance obligations. What are the requirements from a regulatory standpoint?

Last month marked the one-year anniversary of FINRA (Financial Industry Regulatory Authority) issuing rule 10-06 regarding social media and Web 2.0 communication for regulated companies. Even if FINRA rules do not apply to your organization, good practices can still be learned from them.

Just about everyone is witnessing consumer communications applications being brought into organizations by end-users. For heavily regulated organizations this is especially concerning because of compliance regulations. The use of social media sites and blogs for business was not directly covered by earlier rules, and as a result firms pro-actively approached FINRA staff asking for guidance. The response last year (known as Regulatory Notice 10-06) shows how the FINRA rules governing communications with the public apply to social media sites that are sponsored by a firm or its registered representatives.

Rule 10-06, among other things, confirms that firms are required to retain records of communications related to business made through social media sites. Archiving (and security) vendors either have or are working on technology that will integrate social media into archiving solutions. One such vendor is Smarsh. “We’re seeing a significant and growing number of customers adopt our social media compliance solutions, but there are still many companies that prohibit social media to avoid the perceived complexities of compliance,” observes Stephen Marsh, CEO and founder of Smarsh. “By attempting to prohibit social media, firms are both ignoring its tremendous business benefits and facing increased risk by failing to recognize that their employees are likely using these tools in some form.”

According to the Marsh, regulatory enforcement is expected to increase over the next year. Sweep letters issued from the SEC (The Securities and Exchange Commission) suggest further scrutiny of social media, and FINRA is increasingly requesting information about social media usage and oversight during examinations.

Another vendor also expanding its solutions to encompass social media compliance is FaceTime Communications, who recently announced it’s taken a new corporate name: Actiance specifically meant to reflect its “focus on ‘active compliance’ for next generation communications in the enterprise.”

Actiance launched new capabilities in 2010, adding support for Facebook, LinkedIn, Twitter and multiple UC and collaboration applications. “Our business has always been about providing active compliance and security, from our heritage in the world of instant messaging to our support of Unified Communications and social networking,” says Kailash Ambwani, CEO of Actiance. “As the Internet has changed and the communications profile of the enterprise has evolved, so has our platform.”

History has shown us that other types of industries benefit from the best practices of heavily regulated industries. It might be worth a read of the FINRA 10-06 guideline, just to be educated on their approach and expectations.

David Mario Smith of Gartner Research has stated that he believes that “by 2014, social networking services will replace email as the primary vehicle for interpersonal communications for 20 percent of business users.” Smith also predicted that new employees will enter the workforce with a predisposition to communicate via social networks, and that he expects most companies will build out internal social networks and/or allow business use of personal social network accounts.

He made that prediction prior to Facebook’s Social Inbox announcement. We have said this before: email is not going away, but make no mistake, social media is definitely requiring us to take a look at all the messaging pieces that require managing, securing and yes, compliance too.

What to Focus on in 2011: Web Security, Outbound Controls, Social Media Security, and Next Generation Threats

Stephanie Jordan — Thu, 03 Feb 2011 14:06:16 +0000

Although economists and other experts believe we are seeing light at the end of the recession tunnel, and IDC analysts expect IT spending to resume in 2011, we nevertheless still need to be very careful with our resources this year. If we are to be wise in the outlook for 2011, what should we be focusing on? This is the question that was put to several messaging insiders and the responses are as varied as the messaging field itself. How best to prepare for the road just up ahead? While it depends on a number of variables and there is no one-size-fits-all answer, presented here are a few thoughts on what to expect or what to think about this year in messaging. (Also see the related story “What to Focus on in 2011: The Road Ahead” for more views from messaging insiders.)

Social Media and Web Security

When Facebook emerged several years ago it was a common strategy to simply block the site. Today, the site is mainstream, and while it may or may not be right for marketing your company, you can bet a lot of your employees are on it. “One of the most popular questions from businesses around Web security is how to control Facebook specifically,” observes Paul Judge, chief research officer for Barracuda Networks, Inc. Judge notes that the types of questions are evolving. “A year ago people would ask: ‘Can you block Facebook?’ Now, we get more complex questions, such as: ‘Can you allow Facebook, but block chat? Can you allow Facebook, but block access to FarmVille during business hours?’ Just this week a customer asked about allowing access to fan pages, but not personal people pages.”

Judge goes on to say that responding to administrators and management that ask for more complete ways to control Facebook and how to create specific policies around Facebook that allow people to use it in limited ways has resulted in changes in their product line. “We have been adding a lot of functionality in the last six months,” he says noting that others in the Web security space have been doing the same. “We have seen Web security go from ‘control my users’ back five or six years ago attempting to keep people from going to porn sites and sports sites. Then it morphed to threat protection, AJAX protection, JavaScript protection and now we are once again seeing requests about control, but it is around the social networks.”

Getting granular with Facebook is probably the better approach, over trying to shut down the application. With the popularity of Facebook, many companies are using the application as part of their marketing efforts and as such people within the organization need access. “It has been all too easy for security folks to take a rigid stance on a lot of things that are blocked at the corporate level and just denied,” says Tim Helming, director of product management for WatchGuard Technologies, Inc. “However, it is getting to be where ‘no’ isn’t always the right answer. With something like Facebook, for example, most companies don’t want their employees wasting a lot of time at work just looking up Facebook and sending photos to their friends.” Helming says companies need to be able to control who can use it or during what hours or even getting more granular than that, doing things like controlling who can post to Facebook or use the games versus using the more basic functions. “That is going to become very important to organizations. These apps that were never designed for businesses are going to become a new reality, we are never going to go back to complete allow or deny.”

While the marketing advantages some companies have achieved with social media are very real, so are the possible threats. “We have spent a fair amount of time tracking malicious activity on social networks—especially Facebook and Twitter,” says Judge. “In the last year to year and a half, we have spent time analyzing behavior on Twitter network and also looking at how many accounts are legitimate and how attackers are evolving in how they try to use the network. We have recently done similar studies on Facebook.” Barracuda plans to announce the findings of these studies in February when it releases its 2010 Security Report.

Search Engine Malware

Another place to watch for next generation malware this year is search engines. According to Judge, Barracuda Labs is trying to quantify how much search engine malware is happening, and in particular study the types of topics that attackers are targeting most. Why target malware towards Google, Bing, Yahoo! and others? Barracuda Labs 2010 Midyear Security Report states that search volumes have reached new highs with 88 billion per month on Google sites, 24 billion per month on Twitter, 9 billion per month on Yahoo! sites and 4 billion per month on Microsoft sites. As the report notes, that is a lot of eyeballs. Judge reports everyday hundreds of pieces of malware are found by simply searching for popular terms and that search engine ranking and optimization contribute to the effectiveness for attackers.

Archiving

When money is tight even the things you might like to implement may not happen. One of the observations towards the end of last year, as the recession started to loosen its hold, and as we move into this year is a spike in the demand for archiving. “We saw a rapid increase in the number of customers that were purchasing message archiving solutions,” reports Steven Pao, vice president of product management with Barracuda Networks, Inc. “It’s been a largely predictable growing business for us, but we saw an initiation on the part of end customers beyond what we were pushing as a vendor. When we asked what was driving this, we’re told by customers that they had been deferring it.” Pao also suspects that enough time has elapsed where “poor email administrators have had to manually go through and hunt for messages” in response to Federal Rules of Civil Procedure (FRCP) and other similar mandates for document management and retrieval.

Mobile Devices

All experts agree that the prevalence and popularity of mobile devices will continue this year. The recommendation is to ensure that the device is as secure as if the user were in the office. “We have a number of customers coming to us asking how do I protect the iPads that I just launched to my marketing group, or my BlackBerry devices, so we have spent our time as it relates to mobile to get to the same level of security that you would have at your desk,” says Judge.

Securing devices is essential, agrees Julian Lovelock, senior director of product marketing for ActivIdentity Corporation that has primarily government, enterprise, healthcare, banking and high technology customers. “Wind the clock back 10 years, all those emails that the average government employee got came to their desktop. Today a good proportion of them, from the President down, are now coming in through BlackBerry, so securing mobile devices, as communication devices with all the same areas around encryption and signing is an area that we work heavily on.

The device itself is growing into a security tool in its own right. Companies are finding the use of the mobile phone as a replacement to a credential you might otherwise carry—to get into the building, or to securely access the network when out of the office, etc. “I’m still communicating through a desktop whether it’s a Skype session, email or IM chat, but rather than use my smartcard to secure that communication, the credentials are managed through my mobile device, and I am using my mobile device to actually secure the communication from the desktop,” explains Lovelock.

In many ways the mobile device is perhaps more secure from loss than a token. “If we lose a token, we might not notice for a couple of days, if we lose our phone, we notice that within 20 minutes,” states Lovelock “Because it’s a device of more importance to you, you notice it quicker.” Lovelock also points out that a phone is a device that is always connected. “I can remotely deactivate a phone in terms of it being used for security purposes, but I cannot remotely deactivate a token or a smartcard or other authentication methods. This is another reason why the mobile phone is actually more secure.”

Multi-Platforms

In companies of all sizes IT organizations are struggling with the sheer variety of devices coming into the workplace. This year the expectation is that the diversity will continue, especially as employees bring in more media tablets. “iPad is making serious inroads into businesses,” states Helming. “For so many years tablets have been trying to push their way into organizations and up until lately, we have said ‘no thanks’ but now everybody wanted an iPad for Christmas and they are popping up everywhere.”

Helming goes on to say that all Apple products, not just the iPads but OS X in general have been widely adopted in businesses. “I would urge IT folks to take Apple security seriously. Apple OS has the most vulnerability, according to some of the security research I have seen. There has been this assumption—whether it has been tacit or explicit—that Apple is more secure than Windows or that it was less prone to attack. Boy, that is just not the case right now. It is so important to have good anti-virus and intrusion prevention at the gateway and also on the device itself. Taking Apple security seriously is paramount.” He also sees Android “growing like mad.”

One of the benefits of the multiple platform mobile device trend might be that malware writers may not show as much interest in targeting a specific maker. “We will see some big headlines that will get a lot of airplay,” predicts Lovelock. “In reality, with the proliferation of mobile platforms, we will not see malware on mobile phones because as a fraudster, there is no one single point to compromise that can get 90 percent of the users. Fraudsters will go to where the easiest targets are. If I can write a virus that will compromise 90 percent of the machines, I am going to focus on that. The cost/benefit analysis for investing time in writing a virus to compromise Android doesn’t look that appealing, because it only gets a relatively small proportion of the market. Yes, we will see some compromises. Yes, they will be high-profile because they make good headlines, but whether they actually represent substantial percent of the fraud in 2011, I doubt it.”

That’s not to say security is not needed. With so many new device types, not to mention traditional hardware in use today, security is still a major concern. What is the best way to secure a variety of platforms? “One thing that IT can do is ensure that the perimeter is equipped with the latest and greatest generations of security appliances and software,” says Helming. “Also, make sure access points within the organization are under IT control and you sweep for rogue access points. Be sure that those iPads and iPhones are associating to access points that IT controls and runs. Given the reality of so many non-corporate issued devices floating around, those are a few common sense kind of measures that IT can take to help get a handle on security.”

If there is a very limited budget for messaging security, Judge recommends that resources be put towards Web security and making sure that the laptops or mobile devices that leave the office are secured. “We are still seeing glaring holes,” he explains. “Many organizations have something in place for email, and many organizations have some appliance-based solution at the gateway for Web security, but as soon as someone picks up their laptop and goes across the street to Starbucks or goes to a conference; they are out there unprotected. They come back and bring an infection back into the office. So many of the infections we see happen like this. With a limited budget, I’d at least consider what you’re doing about it.”

The Cloud

The popularity of the cloud for business is expected to continue as more companies move to cloud-based email infrastructures. “There are tremendous business benefits to be gained. The cloud is not so much powerful because it is all Internet enabled and all the technical aspects of it, but rather it has proven to be one of the easiest delivery mechanisms on which to do outsourcing and to gain the economies of scale associated with that,” believes Pao. “Email happens to be an application that doesn’t really differ that much as you go from business to business.”

The cloud is also appealing because it isn’t necessarily an all or nothing proposition. Many offer hybrid solutions that allow the use of the cloud, as well as keeping some parts on premises. “Inbound filtering can be done in the cloud, outbound is still best done on-premises,” says Pao. “Just because you decide you want to move your email off premise or outsource the management of email, it doesn’t mean you don’t continue to want granular control of your email policy and it doesn’t mean that you don’t still want to continue to provide the same level of security protection that you always did.”

User Behavior Changing

Perhaps one of the most important pointers for messaging in 2011 is not so much about technology as with the people using it. Lovelock thinks a trend worth watching is the active engagement of the user in security-related decisions. “We have already seen some of that in what Facebook has been forced to do,” he says. “Users have to think about their profiles online, and how much they want to share with people and define a security profile that says this group of people can access this much information and that group of people can access that information. This is a trend that is likely to continue.”

This concept of users being in control is also seen in the way the various devices are coming into the workplace. Users are deciding what mobile phone they want to use or iPad or apps. This might be a carry over to how we as consumers have increasingly become in control of how we want to communicate and using which channel (email, Facebook, SMS, etc.). In a recent whitepaper, “Preparing for Message Convergence: Prescriptive Advice for the CMO and Senior Management,” Dave Lewis, chief marketing officer for Message Systems explores this shift. “Technology is changing the way we communicate. It is changing the nature of how we communicate. We are not only emailing, we use SMS, IM, social and all those forms of communication are being accessed simultaneously. We are on the move constantly; we are not tethered to our desks anymore. The point is, we communicate through multiple channels and we often shift from one channel to the next.”

The user being in control plays a significant part in Lewis’ argument. As an example, he points to Facebook’s introduction of the unified inbox as one more step in this direction. “It’s not just a social inbox, it gives Facebook members an element of control that they have not had in the past to block the messages that they do not want to receive, and block the messengers they do not want to hear from. That form of blocking is making the consumer the final arbiter of what reaches them and that changes the nature of the game, relative to how enterprises interact with ISPs and telcos. If the consumer is the final arbiter of what they receive, they are making the decision not just on email but also across channels. The risk of not meeting the customers’ expectations is that you could lose your connections to the customer.”

Lewis doesn’t think many companies are acting on the preferences, needs and wants of customers, nor are they communicating via the right channel. “Our view is there are significant risks to those enterprises that do not rise to the occasion. Those that do, there are some real advantages.”

Asked if this is only a business-to-consumer issue, Lewis replies, “I don’t think it matters a whole lot. If you think about how technology is affecting us, the line isn’t between B2B or B2C. It is not really between customers and employees. We are all part of this sea change that is taking place. It’s not just a customer issue; it is an employee issue too. As you look forward, the types of employees that you will be taking into the workforce are using communications this way. These changes and the way that we are communicating are touching us all. It is applies to everyone.”

ForeverSave Prevents Lost Work on the Mac

Ben Gross — Mon, 31 Jan 2011 21:10:17 +0000

It’s happened to all of us. You are busy writing, entering data, or working on a slide deck and all of a sudden something freezes and then the application crashes. If either we recently saved the document all is well, otherwise the inevitable explicative follows. It is 2011 and there is no excuse for not having autosave, but there are still a depressing number of applications that do not automatically save documents. Blaming the user who lost work to an application or operating system crash is blaming the victim. People are far better served by applications that automatically name, save, and version their files without requiring manual intervention. This way users can easily undo or revert to an older version after application crashes, machine hangs, and power outages, no swearing like a sailor necessary.

Tool Force Software’s ForeverSave ($15) largely solves this problem for Mac OS X applications. ForeverSave allows you to configure the application to automatically save documents from many applications including Apple’s iWork, Microsoft Office, and most Adobe products. The configuration process is quick and straightforward. You simply select the applications that you want to enable autosave. There are options to save after a fixed time interval or when switching to another application.

ForeverSave can also automatically create backup copies of your documents. You can set the maximum number of backup copies and a maximum size for the backups overall. One advantage of multiple backup copies is that it is that you can quickly preview old versions of the document with QuickLook. Restoring an old version is a one click operation. One interesting feature is database sharing. This allows you to share all the historical versions of a document, which is useful to show a colleague how a project evolved over time.

If you use any of Apple’s iWork applications including Keynote, Pages, and Numbers, then you absolutely want to use ForeverSave. The applications in iWork are well designed and I use them often, but unfortunately, as of the most recent version iWork ‘09, Apple has not seen fit to include an autosave feature. Each of the applications crash periodically, It also means that you have lost any work form the last time you remembered to manually save. If you have not named and saved the document at all yet, then everything is gone.

When an iWork applications crashes, all remnants of unsaved work is gone. After a recent crash with Keynote, I decided to experiment to see if I could find any traces on my file system. I scanned my temp files and the swap files and found nothing other than the images in the document. This is a terrible oversight and I expect better from some of Apple’s high-profile applications. Judging from the many complaints I found on the Apple discussion boards and elsewhere online, I’m not remotely alone.

Overall I highly recommend ForeverSave, the price is well worth the insurance against lost work. I experience two annoyances when using the application. First, saving is a blocking operation in the iWork applications, so if you have a large document such as a Keynote slide deck with many slides it will force you to wait each time it saves the document. This is technically the fault of iWork and not ForeverSave, but it is still a detractor. The second annoyance is that ForeverSave requires you to name the document the first time. This typically comes up when I start to work on a document and right when I get into a flow, then the save window pops up asking me to name the file the first time so it can save. I would rather the application not interrupt me and simply pick a reasonable name and let me rename it later.

ForeverSave is $15 and has a 30-day trial. ForeverSave Lite is a stripped down version that offers autosaving only, without backups, versions, QuickLook, or database sharing.

The Critical Need for Email Continuity

Michael Osterman — Tue, 07 Dec 2010 11:34:52 +0000

We are just about to publish a white paper on email continuity, the focus of which is on the high cost of email downtime and the critical need to maintain continuity of email as close to 24×7 as possible.

Email downtime carries with it a number of consequences that can vary widely in their short- and long-term impacts on an organization. For example:

If we assume that email users are just 28% less productive during an email downtime incident (the proportion of their day spent using email), a very conservative figure of 30 minutes of unplanned downtime each month for users whose fully burdened salary is $65,000 per year will result in an annual productivity cost of downtime totaling $52.50 per user per year—an organization of 500 users will, therefore, suffer productivity loss of $26,250 each year.
However, productivity costs can be substantially greater if email is unavailable for extended periods, as can occur during power outages or storms. This might result in productivity loss of 100% if employees go home for the day, resulting in significantly greater productivity losses than in the example above.
Of particular note in the context of downtime are mobile users who typically are more sensitive to email interruptions. This sensitivity to downtime—and the economic consequences that accompany it—are driven by the fact that mobile users often have no viable alternative means of communication if they cannot communicate via email, they are often more pressed for time while traveling, and they have shorter windows in which to communicate (e.g., while on a layover at an airport).
During outages of the corporate email system, users will look for alternate means to send time-sensitive or other critical content, including personal Webmail systems. Use of these personal systems means that corporate data is sent without first being processed by the archiving, content filtering, security, encryption or other corporate systems that might be in place, putting the organization at risk on a number of levels. This cost is particularly difficult to quantify, since it can result in consequences as diverse as leakage of sensitive corporate data all the way to charges of spoliation of evidence in a lawsuit.

There are a number of other difficult-to-quantify consequences from email downtime, as well, including loss of corporate reputation when prospects, customers and business partners receive a bounceback when sending email—a prospective customer who sends an email only to have it bounce back might never follow up later. An email outage might prevent a timely response to a proposal, order or answer to a client inquiry and could lead to a significant loss of revenue in the long run. Unplanned downtime incidents require IT staff to stop doing other work and instead focus on the email emergency at hand, thereby delaying other work.

Some Observations and Thoughts from ARMA

Michael Osterman — Tue, 09 Nov 2010 18:11:09 +0000

I attended the American Records Management Association (ARMA) Conference and Expo in San Francisco this week—as always, an interesting show with lots of interesting content. Here are some of my thoughts and observations relative to email archiving and electronic content management, two key focus areas for Osterman Research:

There were several traditional email and content archiving vendors exhibiting on the show floor including EMC, IBM, CommVault, Iron Mountain, Symantec, Autonomy and Daegis (formerly Unify and AXS-One), among others. While it’s not surprising to see email and content archiving vendors at a show focused on records management, my discussions with some of them indicated that they were expanding their traditional focus beyond IT and legal and more towards records management as a whole.
Iron Mountain sponsored an interesting lunch session on the future of records information management. The guest speaker, well-known author Geoffrey Moore, presented an interesting view of the future of records management. The gist of his point is that records management is evolving more into collaboration management, and that defining content that should and should not be preserved will become more difficult over time.
Lots of focus on SharePoint for records management and a lot of exhibitors supporting the iPad.
Not surprisingly, the mood at this year’s ARMA seemed quite optimistic as we seem to be pulling slowly out of recession: lots of show floor traffic, happy exhibitors, growing interest in e-discovery and a general increase in the sophistication of the records management practice.
I was also struck (probably too strong a word) by the seeming convergence of records management and IT. At the excellent MER conference in Chicago a couple of years ago, there was a gulf that seemed to separate records management and IT in how they want to manage information, particularly in the context of archiving—I got much less of that vibe at the ARMA conference, indicating that the disciplines are converging and that companies are focusing more holistically on the practice of retaining and producing electronic content.

All in all, the ARMA conference should be on the short list for those interested in the archiving, information management, content management and related markets.

Getting Started with Social Media Management

Stephanie Jordan — Thu, 28 Oct 2010 06:48:34 +0000

This week Osterman Research, FaceTime Communications, and Smarsh conducted the webinar, The Case for Social Media Management and Archiving. The session did a good job of explaining why organizations should be managing the use of social media. This is a topic of growing interest, as more and more legal cases are determining that social networking content is discoverable. In the financial services industry, FINRA Regulatory Notice 10-06 declares that financial services firms must retain relevant social networking posts, just like they retain email and instant messaging.

During the webinar, a discussion point was how an organization that does not manage the use of social media begins its efforts to do so. Studying and understanding how and why social networking is being used is a good first step. Norv Leong, product marketing manager of FaceTime, advocates starting with the policy. He notes that more and more courts are extending the law of electronic devices to include just about everything, including social media content. “You have to make sure that all your employees know about the policy. It does no good to have a policy, if no one knows about it,” he says. Leong adds that just as important is enforcing the policy and to give it “some teeth, otherwise it will be rendered meaningless. Embracing social media, establishing a policy, disseminating it, and enforcing the policy, is the best way to start.”

Sam Kolbert-Hyle, VP business development of Smarsh, agrees with Leong, adding: “I would stress a reasonably designed policy. Especially if you are a FINRA or FCC regulated firm or you are a government agency, or someone who is thinking about the risks and compliance benefits of archiving and retaining social media. Having a reasonably designed policy is really paramount. It has to be designed in a way that takes into consideration your micro corporate culture or environment, as well as some of trends in the macro market place.”

With the popularity of social media climbing, there are more tools ready to help manage it, including technology for monitoring and controlling, and ready-made policies. “If you need a little guidance in coming up with your own policy, increasingly it is easier and easier to access social media policies online,” states Leong.

The main point both speakers stressed is the policy is only as good as the training and sharing of that policy with employees. The policy needs to be disseminated across the entire organization. Ensuring that employees are aware of the policy is a critical step in getting started with managing social media. Once you have the policy, then you can look for the right technology to support the policy objectives and help monitor content as deemed necessary.

If you missed the live event, look for the re-broadcast.

Eye on Messaging is written by Stephanie Jordan, editor in chief of Messaging News. If you have story ideas or news to share, email her: sjordan [at] messagingnews [dot] com

Office of the State Attorney for Florida’s 15th Judicial Circuit and Iron Mountain / CommVault -- Real World Solutions for Email Archiving and Compliance

Stephanie Jordan — Thu, 28 Oct 2010 03:35:16 +0000

The Challenge

The Office of the State Attorney for Florida’s 15th Judicial Circuit, in and for Palm Beach County, is the state’s second largest county and third most populous with more than 1.3 million residents. In serving this community, the office handles more than 100,000 felony and misdemeanor cases yearly while relying heavily on the latest technologies to facilitate information sharing and collaboration among more than 100 prosecutors, nearly 200 support staff and 27 law enforcement agencies.

The Solution

According State Attorney for Florida’s 15th Judicial Circuit, Michael McAuliffe, “Our relationship with investigative law enforcement is the lynchpin of our success. This latest move to embrace cloud storage using CommVault and Iron Mountain technology is a great example of how technology can raise the bar in information sharing and process efficiency while lowering operational costs.”

The Customer Rave

“I have a great interest in vetting new technologies that can save money because we are funded with taxpayers’ dollars,” states McAuliffe. “We performed a careful cost/benefit analysis, which helped us project cost savings of 44 percent by moving backup data to the cloud.”

What It Does

Using CommVault Simpana software and its integrated cloud storage connector, the State Attorney’s Office says it moves backup and archive data securely, reliably and transparently into Iron Mountain’s cloud archiving platform. From a single console, the IT team can manage and retrieve archives stored on the scalable platform.

The addition of Simpana software’s embedded deduplication also enables the organization to reduce redundant data by up to 90 percent; this decrease in storage footprint allows the team to use CommVault software to drive efficiencies and better leverage existing infrastructure, thereby avoiding a $60,000 (USD) capital expenditure for SAN upgrades.

Last Word

“The integration between these CommVault and Iron Mountain platforms appears seamless, which I anticipate will lead to straightforward and cost-effective storage that ensures the delivery of accurate and timely information from my office to officers on the street,” predicts McAuliffe.