Dirty Documents!
Dirty Documents!
June 27th, 2006:Are your electronic documents giving away more than you bargained for? Greg McNevin goes digging for delinquent data...
The printed document used to be the ultimate "lock-down", what you saw was what you got. However, now that more and more documents are spending their entire lives as bytes of data, the risk of security breeches in the form of unauthorised editing and accidental or malicious distribution of sensitive information has never been greater.
Because of this, document integrity technology has never been more important to businesses that are document intensive, highly regulated or have documents that contain confidential information or intellectual property.
If you do intensive revisions that must be tracked, or regularly exchange documents between different people inside and outside of your organisation you are opening up space for embarrassing or damaging information leaks to occur.
Your intellectual property, financial security and even reputation is vulnerable because the advances in technology that are helping us to work smarter and faster are also giving some people scope to be vindictive, to be dishonest, or simply to be human and make mistakes.
By 2006 Gartner Research says that there will be around 1.8 trillion business documents being worked on and distributed inside and outside organisations annually. How many of these contain information that could be damaging in the wrong hands? If it is important, you better lock it down before it sinks your ship. The question is, do you have the appropriate cleaning tools availible?
Poisoned Chalice?
As software has evolved and changed, many new features have appeared to help us with our day to day tasks. In the case of Microsoft Word for example, just ask any university student how temporary files and autosaving have prevented much heartache and kept blood pressure down following a computer crash.
It can be quite sobering and not a little bit alarming to start up a document integrity program and have it dig out a stack of security issues in your organisation’s frequently used and distributed documents. High-profile document security leaks are making news more and more often these days. Here’s a recent timeline:
Feb 06: Chinese public relations company Consultancy issues a press release on behalf of Semiconductor Manufacturing International Corp (SMIC) to invite journalists to an announcement of its fourth quarter earnings. The figures are found 12 hours early inside the press release by using "Track Changes" in Microsoft Word.
Dec 05: US Pharmaceutical company Merck is exposed deleting incriminating information regarding the safety of its Vioxx drug and its links to heart attacks by the new England Journal of Medicine after the Journal used "Track Changes" on a Merck document submitted for publication.
Dec 05: The real author of the US White House policy document "Our National Strategy for Victory in Iraq" is revealed to be Duke University political scientist Dr Peter D. Feaver rather than White House officials after Adobe PDF metadata is examined.
Nov 05: Australia’s Westpac Bank has its end of year profits potentially exposed before submission to the Australian Stock Exchange after 27 brokers and analysts from 16 firms receive an email containing a spreadsheet with hidden figures that could easily be revealed. Westpac halts trading and announces its results earlier than expected due to the mistake.
Oct 05: "Track Changes" in Microsoft Word reveals controversial details regarding the assassination of the Lebanese Prime Minister in a United Nations report. Damaging accusations against the President of Syria arise as a result.
May 05: By cutting and pasting censored text, classified information surrounding the accidental shooting of an Italian secret service agent in Iraq including the name of the US soldier involved is discovered in a PDF report posted on the Pentagon’s website.
April 05: A risk assessment at one of the US’s largest IT organisations reveals confidential planning documents are being sent to a competitor via web mail by an employee trying to secure a new job.
Feb 05: A Florida Palm Bach County Health Department worker accidentally emails a document containing the personal details of over 6,500 patients with AIDS and HIV to all 800 members of the health department. Luckily, they are authorised to see the information.
These automatic functions however, have problematic side effects as they create an audit trail. If you alter a document and save it, it takes note of when it was changed and who made the saved changes. This is Metadata, and it can often reveal much more than you would like.
For example, do you use track changes in Microsoft Word?
"Metadata is data about data and is there for a reason. If your document crashes it allows you to bring it up again, however it can also mean that your document contains hidden data if you forget to turn off track changes." says Samia Rauf, Workshare Director for APAC.
"Even if you PDF a document, the information stays there. If you can re-engineer it back, it's all still there."
Convenience Brings Complacency?
All these snappy new features are making us more accountable, but at the same time they are also making us more vulnerable.Serious issues stemming from 'dirty documents' are appearing almost daily, and document security related disasters are being splashed across the papers with much greater frequency than comfort permits. For example, in 2005 a spreadsheet leak of 'hidden' financials data from Westpac Bank caused the Australian Stock Exchange (ASX) to suspend Westpac's trading for a day.
This increasing frequency of accidental breeches is shifting the emphasis on security from external threats such as viruses and hacking to internal risks like malicious staff or inadequate content management policies.
"The focus on security is shifting. Things like antivirus and spam, it's a done deal. Everybody knows you have to do it. You don't insure your house and leave the windows wide open." says Rauf. "So the shift is moving from outside in threats to inside out security. Rather than worry about what's coming in maliciously, let's worry about what's going out and protect ourselves."
Because document integrity is an ongoing issue, Workshare has developed a five point plan to help businesses manage document integrity risks. It suggests organisations:
1) Understand the level of threat from within your organisation
Whether malicious or accidental, the majority of security breeches happen from within an organisation. Risks surround:
• Content that should not be distributed widely.
• Technical issues such as track changes, metadata and file paths.
• Final accuracy after many reviews.
• Complete auditable history against regulations such as the US-based Sarbanes-Oxley and the Australian Privacy Act 1988.
2) Conduct a risk assessment
A proper assessment should evaluate all the risks from step one as well as those stemming from employee awareness. Look at:
• Who has access to what information.
• How documents are transmitted.
• Whether documents can be altered during their lifecycle.
• If you have the ability to restrict access or what data is distributed.
• If you have an effective document security policy.
• Can you audit document history and prove what has been done and why.
• Where accountability in your organisation lies.
3) Develop risk mitigation policies based on document integrity classifications
Workshare recommends setting up different levels of importance surrounding critical information.
• Highly Confidential: Where unauthorised disclosure could cause the organisation severe financial, legal or reputation damage. Eg: Negotiations surrounding a takeover bid.
• Confidential: Disclosure may cause similar damage on a smaller scale. Eg: Employee payroll details.
• Internal Use Only: Information restricted to internal company use only due to its technical or business sensitivity.
• Unrestricted: Data that should be monitored, but can be shared.
• Sender Privilage and Recipient trust: Information that can be distributed by some staff but not others. Eg: The CEO can share information to other staff but they cannot edit or redistribute it.
4) Configure and deploy document integrity safeguards
Effective policies must be put in place to enforce compliance and document security. For example, a company may want all documents sent outside of the organisation to have certain metadata removed or it may want to restrict employees from distributing specific information over email completely.
5) Regularly audit risk mitigation results
It's one thing to have safe policies in place, it is another to ensure they are followed though. To ensure that document security measures are properly enforced, a company should regularly audit the security of information, the effectiveness of security policies and staff awareness and acceptance of the security policy and surrounding technology.
Once you have a piece of software like Workshare's Protect in place, it can be quite disturbing to see how much invisible data is unknowingly sent out with documents that appear to be clean. iDM has been running Protect for a few weeks now and almost every document we scanned had some form of hidden data included. Most of this was low-risk with information such as save times, revision number, total editing time and author details. However, we did run across a number of very interesting track-changes oversights in received documents, hidden speaker notes in Microsoft PowerPoint presentations and potential security risks with passwords stored in documents.
What you see is not always what you get these days, and paper trails are easier to follow than ever before. With so many documents going in and out of your organisation everyday, how confident are you about your electronic housekeeping?