printer friendly version

Unified approach needed for secure content management

Information security has gained traction in business over the last five years as management becomes aware of the vulnerability of corporate systems, and the media publicise violations with huge headlines.

One aspect of information security that is often misunderstood is content management. This embraces document imaging, output management, document management, workflow, business process management, collaboration, Web content management, e-mail management, digital rights management and rich media management.

The management of unstructured enterprise information is vitally important, and the reasons are well known:

* The majority of company information resides in an unstructured format. This is 80-90% of all information in the company (depending on which research you read), but regardless of the actual percentage, the proportion is very significant. Included in this must be the wads of paper scattered around desks, filing cabinets, warehouses and off-site storage facilities. If this much information is in 'content' format, then obviously proper management of it is imperative.

* Growth in some of these areas, particularly Web content and e-mail, is staggering. Again the stats vary, but you do not need to be a statistician to see the growth. Just look at your day-to-day bombardment of information. Management of this increasing volume of information, coupled with the need to keep costs down, is a high priority in most organisations.

* Legislation and corporate governance, with the reputational and financial damage of non-compliance, are again key issues. Enough has been said in the press about this for most CEOs to be aware of the dangers of non-compliance.

Supply chain interaction

Along with good governance comes the demand for higher levels of supply chain interaction. Customer satisfaction and business partner collaboration have created pressure for more content to be made available through more different channels and on different media. It is this requirement that has led to much of the pressure on e-mail and Web content as well as the need for increased levels of content security. We are stuck between the jaws of openness and availability on the one hand, and the need to secure information against threats of hackers, viruses, identity theft and industrial espionage.

This might sound like a new discipline, but it really all boils down to good governance. We need to protect our corporate information (in whatever format it resides), from anyone who does not have the necessary access privileges, and ensure that we keep the necessary information to satisfy legal and business requirements.

All of this must be done within the confines of keeping costs down. Our e-mail and Internet policies must form part of this broader philosophy.

Given that secure content management needs to fit in with a broader content management strategy, some of the specific issues are:

* Employee demand for Internet and e-mail access will continue to raise volumes and create possible points of security breaches.

* The number and variety of threats will continue to increase.

* The costs associated with covering all bases will escalate.

With the increase in virus activity, and also the increase in e-mail usage, a typical attack could enter the business's various content stores in the following way. Virus infected e-mail is received by an employee. The employee workstation then infects the mail server. Client PCs accessing the corporate Internet/intranet could also infect the Web server.

Additional clients then are infected while browsing the Web server.

A recent IDC report suggests that the Internet (rather than e-mail) will increasingly be used as a means of virus distribution. One of the biggest challenges arises through disparate systems designed to cater for each security loophole. For example, Web page protection, e-mail policies and filters and document management systems, all have security built in. Unless an integrated approach to content security is taken, the risk exists that loopholes will exist between systems.

In addition, the traditional document management custodian is in a different role to that of website and e-mail administrator. As a result, each implements their own security measures and systems, costs increase, and opportunities for security gaps increase.

To counter these challenges, secure content management must consider at least the following:

* A unified approach to content security across all platforms.

* E-mail filtering.

* Web access control, with specific emphasis on downloadable applications.

* Antivirus protection.

* Content filtering.

* Regular reporting and action.

The unified approach highlighted above needs to take into account policies and procedures for all types of content - not just the Web and e-mail. Ideally, there should be a security custodian who sets these policies and procedures. Reporting, logging and subsequent action need to occur daily and be given high priority. These policies will increasingly need to regulate what information is allowed to enter the network, with rigid and enforceable standards for any content allowed onto the repository.

Paul Mullon

Share this article:

Further reading: