Paper trap

zoom

HARRISON: Throwing more people at the problem just increases that level of complexity and cost needed to solve it.

zoom

ZENNER: One of the security concerns here is obviously exposing your data to a third party company during the conversion.

Even limiting access permissions is not always a panacea, he adds: "If you are a fileserver administrator, you can give access to individuals, to groups. If you have the admin password for that server or for that domain, there's an awful lot of places, you can go through and find information where people don't expect you to do it.

"There was one example where we were looking at a fileshare location where all of the directors kept their expense reports - very sensitive information. We asked: Who had access to the information? The directors said: ‘The 12 of us and our assistants.' We showed them a report showing that there was actually something like 300 people who had read access to that particular folder. So often, people assume that the only people that can see information are the ones they've explicitly given access to - but there's a lot of implicit access as well that people aren't aware of," he states.

So it's clear that there are a number of areas where document management security can use improvement. But the good news is that most of the technology already exists. Audai Altaie, senior product manager at Canon Middle East has some ideas.

"Encryption in the form of passwords on documents can be all the way down the word level and that's what you should look for when purchasing a system. You should have a history of documents that can track the changes from the first to the last page, while your wireless should be encrypted also so that nobody can hack into your network if it's a wireless one," he proposes.

"One of the Lebanese banks purchased our scanners for one purpose only - fingerprint security. Another vertical is defence, especially here in the UAE and Saudi. Our solutions have a hard drive eraser which permanently erases the document, which drew the interest of the Ministry of defence."

Perpetrators of data leakage often include disgruntled employees, for whom document management systems have actually made life easier.

Altaie says there are protections against this kind of behavior: "One of them is detecting if a lot of data is getting transferred at the same time, alerting the IT manager that somebody is spooling a lot of data very fast and then he can question the employee."

EMC's Zenner believes the trend of employee theft is more widespread than most people realise: "Gartner made a statement that they said 84% of high-cost security incidents are the result of the insiders sending confidential material outside the company. Now, how can I prevent that as a company? With our Documentum system today, it allows you to plant certain security measures, not on repositories or data stores but on the physical document which prevent people from copying, saving or taking data to a external disk and sending it via e-mail."

But firms should not rely solely on the power of technology. Xerox's Smith says there are limits to what the technology can do: "There are clearly advances in biometric access, whether that's fingerprints or the retinal scans that are built into systems nowadays, but that ultimately protects only the entry point."

Canon's Altaie concurs: "You can have a password on a password - levels of passwords. He can log in as a user but when he needs to view a specific document, he has to have the password. But if the password is leaked, no company in the world can do anything about it."

Data leakages can and do happen, but a regional culture of secrecy prevents them being made public - leading to a general notion that firms are secure.

Symantec's Harrison lends weight to this theory: "It's not like the US where there's now a duty of disclosure for any kind of data breach. They are probably three to five years ahead of Europe in terms of legislation forcing people to do it [disclosure]. In the Middle East, it's a stage even further behind that. From a cultural perspective, nobody wants to go through and disclose something embarrassing when they don't have to," he continues.

So it's the same story with document management as it is with most security implementations. While the technology exists to protect data, most firms still place the technology and convenience aspects of having their data in a central, searchable database ahead of the very real possibility of data leakage. In part, this is because few incidents have come to light.

Until the region becomes open about the reality of such incidents, it seems enterprises will have to place their trusts in the preventative measures of vendors and the vigilance of IT managers - a combination that will have to do, for now.

Print | Email | Discuss this article

| Share |

READERS' COMMENTS

Click here to post a comment

Add your Comment All posts are sent to the administrator for review and are published only after approval. ArabianBusiness.com reserves the right to remove any comment at any time for any reason. Please keep your responses appropriate and on topic. Arabian Business would like to point out that only comments relevant to the story will be published. Any containing personal insults or inappropriate language will not be approved.
Name *
Remember me on this computer
Email *	(Your email address will not be published)
City
Country
Subject *
Comment *
Notify me of further comments
Enter the words above *
Please click post only once - your comment will not be published immediately.

MORE FROM ARABIANBUSINESS.COM