Join our partners, Brite Computers, for a great webinar on locking down your important documents and other critical information with Persistent Document Security.

Do you wonder how many sensitive documents leave your organization via DropBox, Gmail, USB Device, or Corporate Email and have the potential to fall into the wrong hands?  With all the data breaches and loss of sensitive information in the news lately, you have to wonder if you are next.  It might be embarrassing, but it could also get you into a lawsuit.

Join Brite on Wednesday, April 18, 2012, for 1 hour to learn about Fasoo’s Digital Rights Management platform; the next generation of data loss prevention techniques that are reshaping the data and network security industry.

Click here for more information.  Register Now. 

eDocument Sciences and Fasoo.com joined forces with partners Brite Computers, Ricoh and Toshiba this year in a booth at the RSA Conference 2012 in San Francisco.  At times the place was wall to wall humanity with customers interested in everything from analyzing real time threats to the latest in cryptography.

The customer interest in document security this year was phenomenal.  The booth was mobbed and I had a lot of conversations with people about securing documents in the cloud and on mobile devices.  You could see how much of an issue this will be by seeing how many people were working on documents on their smart phones and tablets.

A lot of people were concerned about protecting their intellectual property (IP) from walking out the door.  With the ubiquity of file sharing services like Box, Dropbox, and SugarSync, it’s important to know where your sensitive information is.  Gone are the days when everyone puts documents into the official document management system.

Fasoo had a new booth this year which gave everyone an opportunity to give hourly presentations on a huge LCD screen.  There were two really cool touch screens in the booth where people could run videos and some flash applications showing the four areas that Fasoo focuses its technology:

• Information Governance
• Secure Collaboration
• Mobile Security
• Output Security

A lot of attendees were asking about securing documents on iPads and phones.  With Bluetooth keyboards and a lot of new docking stations, many people are just carrying these smaller devices as their computers.  They were concerned about people reading confidential documents on their mobile devices and what would happen if the device was lost or stolen.  Also, how could they control access to the documents once they were moving around through email.  I was showing a demo of the Fasoo Mobile Gateway on my iPad where I opened a secure Microsoft Word document from Dropbox.  The interface is very easy to use and with a few taps and a login, I could access secure content.  I emailed it to a colleague and he opened it on his iPad in a few seconds.

A big topic in the sessions and hallways was about all the hacking done on behalf of causes.  Groups like LulzSec and Anonymous are practicing what many refer to as Hactivism.  They are becoming the new whistleblowers and protesters in the online world.  One of the good things that’s come out of this mischief is its brought poor information security to light.  When a hacker with a few free tools can easily break into a website or database and steal confidential documents, passwords and credit card numbers, companies have a lot to answer for.  Many of these attacks were on unpatched and outdated software systems.  It’s like someone left their front door open and then was surprised when their television was stolen.

One of the great things about RSA is the chance to kick back a little and join friends and colleagues in some down time.  After a long day on the show floor, it’s great to relax with a good meal.  Fasoo held a thank you dinner for its partners at McCormick & Kuleto’s in Ghirardelli Square.  Some of the pictures below will give you a good idea of the great food.  The Guittard Chocolate Ganache Tart was unbelievable.

Check out more photos at Flickr.

Dave Anastasi, CEO of eDocument Sciences, had a debut article in a new blog called Doc & Data Security Steward for The Imaging Channel, an online and printed resource for the print and imaging industry that brings together the leading market information, business concepts, strategies, and people in managed print.

In this blog, Dave is looking at more than just data and document security from a technical viewpoint.  Implementing technology is important, but if these tools aren’t aligned with the people and processes inside an organization, nothing will work.

I can have the most sophisticated alarm system in the world, but if I forget to turn it on or close my front door, it’s useless.  It’s the same in businesses.  Teaching people that they must address all of these elements to develop and maintain a secure environment is very important.  Security is only as good as the people using it.

Most of the article is below, but click on the following link to read the article in its entirety.

Doc & Data Security Steward: An Introduction

TIC: What is your background? What makes you a “Doc & Data Security Steward?”

Anastasi: Throughout my career, I have been involved in many businesses and industries – having an undergraduate degree in Marketing and masters in International Management as well as cutting my teeth in the advertising business. My focus has always been to look from the customer’s perspective and then through the eyes of the distribution channel. Also, having been a public company CEO and sitting on multiple company and private organizations boards, I have had the benefit of seeing data and document security issues from many different angles and perspectives.

Everything starts with knowing your customer’s industry, business, goals, risks and business landscape. Document and data security requires a commitment to understanding who they’re serving, what their business is and the environment that they’re operating in. However it is most important to approach data and document security not just trying to find a way to make them more secure or compliant. More importantly, it’s about making your customers more efficient, more successful and profitable. It’s not just about supplying technology it is about improving scalability and ultimately measurable value.

With my time in document and enterprise content management, I understand the channel dealer network very well – the hardware portion as well as the intersection with services and software. Neopost was basically the same kind of business model as the copier, scanner, printing and managed services markets. Actually, almost 20 years ago, I started the first managed services partnership between Xerox Business Services and Neopost combining copying, printing and mailing services.

Ultimately though, it is my experience as a customer that led to the conclusion that document and data security is rapidly becoming one of the most strategic concerns of any type of organization. As I’ve sat in board audit and compliance, merger and acquisition, strategy and other meetings one of my deepest concerns was, how do we protect our most important asset: our information? I spent many a sleepless night worrying about breaches, both malicious and unintended. With that, I was both at risk in my job and personally as an officer and board member and ultimately the company value and brands reputation were at serious risk.

In time, it became apparent that the best approach to consistently dealing with this fragmented, complex and ever-growing issue was focusing on the culture, people, process and technology of an organization, also it’s extended network including partners and customers and creating a “Control Conscience Corporate Culture.”

Finally, due to the nature of the businesses I was in, I learned how to make money for my organization and our channel and strategic partners by using it as a tool to improve our customers overall business and financial results.

TIC: Why is security such a concern today?

Anastasi: It’s important to understand data security has been a concern for a long time. For example: organizations (and even home’s) have spent billions of dollars on network security, virus and malware protection for many years. Those have been billion-dollar industries for a long time. So people have always understood that they needed security, but it has been historically focused on protecting unauthorized access to networks and devices.

What’s really changed is that today, there’s this convergence. Everything is moving so quickly; technology is moving rapidly and converging. Documents are converted from hard copy to electronic files, expanded workstations and devices (desktops, laptops, pads, PDA’s along with networked intelligent copiers, printers and scanners) and locations where data can be moved and stored including the rapid emergence of cloud and applications.

In this industry historically copiers, printers and scanners were not networked, had minimal if no memory, unsophisticated keyboards and limited simple applications. Before they were networked and had expanded capabilities weren’t as significant a data security risk. The paradigm has shifted; today they are not just copiers, printers and scanners but workstations with computer capabilities. In reality they are computers that copy, scan, print.

It’s now one of those things that regulators, boards, executives, auditors, lawyers, insurers and most importantly those trying to breach critical information realize, and all these people have to think more seriously about securing their devices and data. Unauthorized access is an issue, but protecting critical content or data is really the goal.

So organizations have already have spent billions of dollars on security – realizing the importance of protecting data – but now the real question really is are traditional methods sufficient in today’s and tomorrow’s environments?

TIC: How does security relate to managed services/managed print services? Can providers turn these security concerns into opportunities? If so, how?

Anastasi: Providers’ awareness that they are part of the process is essential because they are managing print, documents and data, so they’re right in the middle. They are touching, moving and accessing important data, so they could become point of the breach, which could cause liability for them. They need to make sure they have proper protection in their environment when they are doing managed print services. The bad news is, if they don’t take security seriously, they could be negligent and accountable.

The good news is, because they are in the middle, it provides an opportunity for them to create their own document/data practice, expanding their business opportunities by providing services, solutions and technology to their customers in a way to help them manage their data security.

It is a massive and fast growing market that will never go away, it’s only going to get bigger. So, if providers are looking for market opportunities, why not look where they already are, both reducing their risk and expanding their business opportunity in an area that compliments what you are already offering. The great news it is an existing market on the leading edge not the bleeding edge.

And people today are aware and understand how important security is. In many cases, it’s a requirement for companies to pay attention to it, 46 states have deployed breach notification laws requiring organizations to respond quickly and effectively to data breaches or they face expanded damages due to negligence. So if providers become good at it, there are going to be massive dollars and opportunities, and if they become the go-to provider, think about the potential.

TIC: What kind of information will readers find on the Doc & Data Security Steward blog?

Anastasi: Throughout the years, I attended many conferences, and heard only about technology. I listened to auditors many who were primarily focused on financial people, processes and technology, and lawyers talking about my risk and litigation but not about prevention. There was no answer in one place, primarily because it’s so fragmented. We recognized a need for somebody to help facilitate a collaborative approach.

Our focus is to draw not only from my experience, but also from all the domain expertise out there that I know and work with, we will have a variety of expert guests join me in some of the blogs. The focus will be on culture, people, process and technology because all are critical. We will show that there’s opportunity to build a document/data security practice and to sell additional services like assessment services, technology, tools, training and technology that improves security and adds value.

Most importantly, I’d like to teach readers how to protect themselves because it starts there. From there, we’ll get into how to build a strategy and package an approach showing measurable ROI. We’ll introduce key verbiage and teach readers how to speak the language – not just sell the tools. We will talk about developing training and marketing strategies and tools. Then finally, I plan to help providers expand their offering and help their customers develop a “Control Conscience Corporate Culture” making then more competitive, scalable and valuable as an organization.

Photo credit DaveBleasdale

Join eDocument Sciences on January 12, 2012 at 2:00pm EST for a joint webinar with DocuSign on “Using e-Signatures to streamline your business processes and enhance your data security”. 

Signing documents with paper and pen can cost you time and money.  You do most of your communicating electronically on your laptop, smartphone or tablet, so why not do the same when you need to sign something.  Join us for an informative look at how electronic signatures can make your life easier and more secure, by completing transactions in minutes while eliminating errors and guaranteeing the identity of signers, authorizing access to information or for approval processes.

>> Click here to sign up for the Webinar

The December 2011 issue of ENX Magazine features an article titled “Document, Data Security: Internal Controls, Data Governance, and Measuring & Managing Risk” written by Dave Anastasi, CEO of eDocument Sciences.  This is the second in a series of articles where Dave looks at how data and document security are paramount concerns for all organizations of any size. 

Below is the article in its entirety.

In my first article (November) of the Document, Data Security: “Turning Risks Into Opportunities” series, the initial goal was to bring high level awareness to the threats and opportunities that you and your customers face when it comes to protecting their and your most valuable asset, information.

Having looked at the high level risks and market opportunities in the first article, this month’s article will focus on three key areas (listed below) that individual organizations and their leaders (Public, Private, Government, Educational, and Non-Profit) are all responsible for with the objective of one important outcome; focusing on People, Processes and Technology ultimately creating a Control Conscience Corporate Culture™ (4 C’s). Also, then looking at creating a strategy that is highly effective, scalable and sustainable consistently creating strong value (financial, services and solutions) for its shareholders and/or constituents. Anything that impedes an organization from doing so negatively impacts the value that it provides.

1. Internal Controls

2. Data Governance

3. Measuring and Managing Risk

So why is all of this so important? Simply put, it is about value! An organizations value is built on its ability to provide services and/or solutions to its customers/constituents. If it is a for profit organization then it also must create an acceptable financial return to its shareholders whether that be public or private. You can ask how does this impact my business and why should I spend any time or resources worrying about this? The reality is that you are already in the middle of it every day through handling documents, selling equipment that prints, copies, scans and stores data, selling software or solutions (that impact business processes, document or file transfer or data storage) managing print services or other environments, accessing equipment to service it. So the real question is how are you going to let it impact you and your customers and your financial results?

There are four outside entities that have strong influence on how organizations go about providing that return: Government/Regulatory, Auditors/Accountants, Law Firms and Insurance Providers (ironically they are also subject to these same issues and requirements so they are potential customers as well).

Historically, the focus of these outside entities has been on the financial reporting and systems of organizations. With the advancement of technology, regulatory changes (i.e. Sarbanes Oxley, Regulation Fair Disclosure, HIPAA, Breach Notification, Data Privacy, etc.) global expansion and cultural changes, the number of data breaches, leaks and identity thefts occurring and being identified has expanded exponentially. These issues are creating significant negative financial, customer relations and brand impacts on organizations. With that, the effect of these data events on earnings for organizations and ultimately their value as a public or private organization can be catastrophic.

There are important phrases that need to be recognized as major red flags. Fortunately, by recognizing a few key phrases, readers will be alerted to some very important information that will help avoid operational, legal and financial mistakes as well as allow you to talk with your customers at all levels of the organization. Focus on making the buying decisions strategic, not operational.

Three of these key phrases are listed below, it is very important to understand failing to protect important data can trigger any one or combination of these events:

• Material Adverse Effect – is a significant event that may negatively affect an organizations (profit or non-profit) stock price, value or operations. A material adverse effect usually signals a severe decline in profitability and/or the possibility that the company’s operations and/or financial position may be seriously compromised.
• Material Weakness – a material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis.
• Significant Deficiency – a significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

So where does an organization start to build a Control Conscience Corporate Culture™ (4 C’s)? It must start with Tone at the Top (a phrase well known to auditors, accountants, boards, executives, attorneys as it is directly referenced in Sarbanes Oxley) – it refers to how an organization’s leadership creates an ethical (or unethical) atmosphere in the workplace. Board and management’s tone has a trickle-down effect on employees and partners. If boards and top managers uphold ethics and integrity so will employees and partners. But if boards and upper management appear unconcerned with ethics and focuses solely on the bottom line, employees and partners will be more prone to lack of discipline, feel that ethical conduct isn’t a priority and even go as far as committing fraud. In short, people will follow the examples of their leaders and managers.

From there, the organization must develop a strategy that exceeds a Standard of Care (a legal term well know again by auditors, accountants, boards, executives and attorneys) – the watchfulness, attention, caution and prudence that a reasonable person in the circumstances would exercise. If a person’s actions do not meet this standard of care, then his/her acts fail to meet the duty of care which all people (supposedly) have toward others. Failure to meet the standard is negligence, and any damages resulting therefrom may be claimed in a lawsuit by the injured party. One challenge is that the “standard” is often a subjective issue upon which reasonable people can differ and certainly leaving that up to a jury can be very expensive.

Next, the focus needs to be put on identifying key components of Internal Controls, Data Governance and Measuring and Managing Risk with an emphasis on safeguarding the organization’s assets and resources, the most important being its information.

Internal Controls – Under the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control-Integrated Framework, widely-used in the United States and globally, internal control is broadly defined as a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: a) Effectiveness and efficiency of operations; b) Reliability of financial reporting; and c) Compliance with laws and regulations.

• COSO defines internal control as having five components:
• Control Environment-sets the tone for the organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control.
• Risk Assessment-the identification and analysis of relevant risks to the achievement of objectives, forming a basis for how the risks should be managed.
• Information and Communication-systems or processes that support the identification, capture, and exchange of information in a form and time frame that enables people to carry out their responsibilities.
• Control Activities-the policies and procedures that help ensure management directives are carried out.
• Monitoring-processes used to assess the quality of internal control performance over time.

Data Governance – The Data Governance Institute’s definition in its simplest terms, “Data Governance is the exercise of decision making and authority for data-related matters.” In more detail; “it is a system of decision rights and accountabilities for information-related processes, executed according to agreed-upon models which describe who can take what actions with what information, and when, under what circumstances, using what methods.”

• When you reference governance, be sensitive to depending on context, “Data Governance” could refer to:
• Organizational structure
• Guidelines, business rules, policies and standards
• How they “decide how to decide”
• Accountability
• Methods and metrics for people and information systems as they perform information-related processes.

Measuring & Managing Risk – What works and what doesn’t work? Over twenty years ago Morgan Henrion wrote about the 10 Golden Rules of Risk Analysis:

1. Do your homework with literature, experts and users.
2. Let the problem drive the analysis.
3. Make the analysis as simple as possible, but not simpler.
4. Identify all significant assumptions.
5. Be explicit about decision criteria and policy strategies.
6. Be explicit about uncertainties.
7. Perform systematic sensitivity and uncertainty analysis.
8. Iteratively refine the problem statement and analysis.
9. Document clearly and completely.
10. Expose to peer review.

Going forward, I will start to outline how to approach a data and document security review with the intent to develop internal threat analysis plans as well as identifying key policies and procedures. However, remember it all begins with people and culture. The more you can create employee awareness, recruiting and succession plans, employee responsibility policies and data security training the better chance you have of developing the desired culture. Followed with process and technology gap analysis and solutions and you have the opportunity to be the subject matter expert for your customers, expanding your relationship to a strategic level and the ability to develop a very lucrative document, data security practice that compliments and extends your core business.