Unified approach needed for secure content management

February 2005 Cyber Security

Information security has gained traction in business over the last five years as management becomes aware of the vulnerability of corporate systems, and the media publicise violations with huge headlines.

One aspect of information security that is often misunderstood is content management. This embraces document imaging, output management, document management, workflow, business process management, collaboration, Web content management, e-mail management, digital rights management and rich media management.

The management of unstructured enterprise information is vitally important, and the reasons are well known:

* The majority of company information resides in an unstructured format. This is 80-90% of all information in the company (depending on which research you read), but regardless of the actual percentage, the proportion is very significant. Included in this must be the wads of paper scattered around desks, filing cabinets, warehouses and off-site storage facilities. If this much information is in 'content' format, then obviously proper management of it is imperative.

* Growth in some of these areas, particularly Web content and e-mail, is staggering. Again the stats vary, but you do not need to be a statistician to see the growth. Just look at your day-to-day bombardment of information. Management of this increasing volume of information, coupled with the need to keep costs down, is a high priority in most organisations.

* Legislation and corporate governance, with the reputational and financial damage of non-compliance, are again key issues. Enough has been said in the press about this for most CEOs to be aware of the dangers of non-compliance.

Supply chain interaction

Along with good governance comes the demand for higher levels of supply chain interaction. Customer satisfaction and business partner collaboration have created pressure for more content to be made available through more different channels and on different media. It is this requirement that has led to much of the pressure on e-mail and Web content as well as the need for increased levels of content security. We are stuck between the jaws of openness and availability on the one hand, and the need to secure information against threats of hackers, viruses, identity theft and industrial espionage.

This might sound like a new discipline, but it really all boils down to good governance. We need to protect our corporate information (in whatever format it resides), from anyone who does not have the necessary access privileges, and ensure that we keep the necessary information to satisfy legal and business requirements.

All of this must be done within the confines of keeping costs down. Our e-mail and Internet policies must form part of this broader philosophy.

Given that secure content management needs to fit in with a broader content management strategy, some of the specific issues are:

* Employee demand for Internet and e-mail access will continue to raise volumes and create possible points of security breaches.

* The number and variety of threats will continue to increase.

* The costs associated with covering all bases will escalate.

With the increase in virus activity, and also the increase in e-mail usage, a typical attack could enter the business's various content stores in the following way. Virus infected e-mail is received by an employee. The employee workstation then infects the mail server. Client PCs accessing the corporate Internet/intranet could also infect the Web server.

Additional clients then are infected while browsing the Web server.

A recent IDC report suggests that the Internet (rather than e-mail) will increasingly be used as a means of virus distribution. One of the biggest challenges arises through disparate systems designed to cater for each security loophole. For example, Web page protection, e-mail policies and filters and document management systems, all have security built in. Unless an integrated approach to content security is taken, the risk exists that loopholes will exist between systems.

In addition, the traditional document management custodian is in a different role to that of website and e-mail administrator. As a result, each implements their own security measures and systems, costs increase, and opportunities for security gaps increase.

To counter these challenges, secure content management must consider at least the following:

* A unified approach to content security across all platforms.

* E-mail filtering.

* Web access control, with specific emphasis on downloadable applications.

* Antivirus protection.

* Content filtering.

* Regular reporting and action.

The unified approach highlighted above needs to take into account policies and procedures for all types of content - not just the Web and e-mail. Ideally, there should be a security custodian who sets these policies and procedures. Reporting, logging and subsequent action need to occur daily and be given high priority. These policies will increasingly need to regulate what information is allowed to enter the network, with rigid and enforceable standards for any content allowed onto the repository.

Paul Mullon
Paul Mullon

For more information contact Paul Mullon, Metrofile, 011 458 6300, paulm@metrofile.co.za

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Exploiting the global pandemic
Issue 7 2020 , Cyber Security
Cyber criminals targeting remote work to gain access to enterprise networks and critical data reports FortiGuard Labs.

Integrated security is key to Huawei Mobile Services
Issue 7 2020 , Cyber Security
To ensure sufficient mobile device security, the technology giant incorporates security into its chip, device and cloud capabilities.

Cybersecurity becomes key enabler of sustainable business growth
Issue 7 2020 , Cyber Security
The adoption of rushed digital transformation strategies has left many facing unintended complexities and challenges.

Challenges healthcare is facing
Issue 6 2020 , Cyber Security
The healthcare industry has been forever changed by digital transformation, but cybercriminals are targeting the healthcare sector now more than ever.

Secure IoT devices and networks
Issue 6 2020, Technews Publishing , Cyber Security
Check Point Software’s IoT Protect solution secures IoT devices and networks against the most advanced cyber-attacks.

SentinelOne Protects the AA
Issue 6 2020 , Cyber Security
National provider of 24-hour motorist assistance stays on the road thanks to accelerated, AI-powered threat prevention, detection and response.

Protecting database information
Issue 6 2020 , Cyber Security
SearchInform has officially released Database Monitor, a solution for the protection of information stored in databases.

Work from home securely
Issue 5 2020 , Cyber Security
First Consulting provides enterprise-level IT security to working-from-home employees at more than 40 South African organisations.

Agility, meticulous alignment and testing
Issue 5 2020 , Cyber Security
Data loss can put the nails in the coffin for unprepared businesses. Investing in cyber resilience is key to succeed in the age of digital transformation.

Cybersecurity comment: A holistic approach to threat vulnerability
Issue 5 2020 , Cyber Security
Any organisation, whether large or small, public or private, should follow an established framework in order to protect itself against cyber threats.