Archive for the ‘Data Loss Prevention’ Category

Tech Predictions 2009: A more sensible approach to de-risking data loss

December 17, 2008 Leave a comment

This is one that should have happened a while back, given that all the technology pieces are in place and readily available, but fear not, 2009 will be the year for comprehensive information rights management. Yes, I said it.

The technologies that can be used to provide persistent protection for enterprise content have existed for several years as a product, or suite of products, known as Enterprise Digital Rights Management (ERM), or more recently Information Rights Management (IRM). Unfortunately, the take-up of these products has not been as robust as might reasonably be expected for such a useful enterprise capability. It quickly became clear that these types of defensive technologies, which do not generate immediate / obvious revenue, are relatively expendable in pursuit of the bottom line. Perhaps, as a consequence, the industry recently underwent consolidation, (mostly through acquisition by larger players), into a handful of information lifecycle management solution providers that offer Enterprise DRM / Information Rights Management solutions among their arsenal of products and capabilities. Key players now include: Adobe, Microsoft, Oracle (via acquisition of Stellent / SealedMedia), EMC (via acquisition of Documentum & Authentica) and Liquid Machines. 

So what has changed, and why should 2009 be any different?

  1. Well for one thing, the frequent reports of data loss incidents mean that the corporate world has had to start looking at ways to prevent future mishaps. However, even current initiatives like wholesale corporate data encryption and data loss prevention strategies are not totally fool proof; therefore many organisations are still likely to need a more effective approach towards managing and securing information, especially one that will work even after data is lost or misplaced.
  2. Secondly, there are signs that ERM vendors are waking up to the key role they have to play in creating the ecosystem of solutions required to tackle data loss issues head-on. For example, some vendors have begun integrating their ERM products with existing Data Loss Prevention systems in order to provide effective control of information, both within and outside the enterprise security perimeter, (i.e. in the Jericho philosophy of deperimeterised security).
  3. Finally, although ERM is a direct offshoot of media Digital Rights Management (DRM), and provides similar capabilities for content control, it is unlikely to face the same fate as the latter, (see more on this from my DRM blog), for the simple reason that they serve very different markets / needs. A recent study of the ERM market shows a steady increase in awareness and adoption by organisations in various sectors like finance, healthcare and IT consulting among others

.In light of the above, I believe it that we shall start to see more examples of holistic security and information management as a major step towards mitigating the risk of data loss. The solutions, like the problems they solve, are not restricted to one product, channel or strategy; therefore it would most likely be achieved via a combination of components that include: ERM / IRM solutions; DLP systems; enhanced Information Security Policies; and the traditional corporate security and perimeter defence mechanisms.


Note: Originally posted on Capgemini’s Technology blog.  You can see the original post, including comments, at:


No More Data Loss?

April 22, 2008 Leave a comment

Signs abound that the previously quiet realm of enterprise DRM is now making the must have list for enterprise security system vendors. This promises the potential for enterprises to gain full control of corporate information and data even outside the traditional security environment.

Like anything else in life it often takes a calamity to jumpstart what should have been an obvious requirement in the first instance. After last year’s data loss debacle, many public and private services organisations have had to take a fresh look at how to mitigate the risk associated with data loss. The upshot of this is the recognition of a need for information control even outside traditional corporate security perimeters, a problem that is neatly solved by enterprise DRM solutions as shown in the diagram below.

Although most organisations already have some form of perimeter security mechanisms (e.g. firewalls, data encryption and authentication), many have not bothered too much with the question of what happens if and when information leaves the premises on USB memory sticks or CDRs – a method frequently used by their own employees. However, it all looks set to change now as traditional enterprise security vendors are looking at including this level of control into their offerings.

Diagram showing Traditional Enterprise Security vs. Additional Enterprise DRM

Diagram showing Traditional Enterprise Security vs. Additional Enterprise DRM

(Source: The World Beyond Digital Rights Management, BCS 2007)

According to an article on DRMwatch, some enterprise content management vendors already recognised the need to control information in this way and acquired relevant companies and products into their portfolios. However, it has taken slightly longer for enterprise security solution vendors, who might be considered a more natural fit, to start integrating this capability into their solutions in order to create a holistic offering that delivers both internal and external control over enterprise data. The hope is that public and private sector organisations will jump on board and buy / implement these solutions with some alacrity, but enterprise customers just like ordinary consumers sometimes do the unexpected. We await further developments with eager anticipation.


Note: This post was previously published on my BCS DRM Blog, where you can find the original post, and reader comments, in the archives.

Missing data: An opportunity for Enterprise DRM?

December 13, 2007 Leave a comment

The recent spate of missing computer discs containing personal details of very many individuals, (first by the HMRC and, more recently, by the DVLA), has crystallised the need for better protection schemes around personal data. This could be a golden opportunity for Enterprise DRM solutions, but how…?

The story so far: Last month saw wide coverage of the fact that two HMRC computer discs, containing some 25 Million user details had been lost in the post; and this month, according to BBC News article, the DVLA also admitted the loss of computer discs, with over 6000 driver details, sent via postal courier services. The common theme seems to be around the transportation of computer records on physical media. In this day and age you might wonder why the data was not simply transferred over some sort of secure network, but that would be too easy. In any case, regardless of transportation method or format, the protection scheme used for such valuable personal information should be both effective and comprehensive enough to prevent unauthorised access / use of protected information. This is where Enterprise DRM solutions could excel for the following reasons:

  1. Enterprise DRM provides persistent protection for content both within, and outside, traditional corporate security boundaries (i.e. even on missing computer discs)
  2. It prevents unauthorised access to protected data, and can make it extremely difficult to use or manipulate content without proper authorisation based on positive user identification
  3. It also has facilities to track and stop further access to, and use of, protected content even ‘in the wild’ so to speak.

Essentially, a properly implemented Enterprise DRM solution would play a significant role in mitigating the risk around misuse of protected data in any future scenarios involving missing discs. However, it can be argued that one obvious weakness would be the complicity of an authorised user in accessing the data, but even that can be easily traced with the built-in forensic capabilities found in some of these solutions. In conclusion therefore, I suspect that these two incidents will help bring home the message that the future of DRM does not lie solely in consumer oriented content or media industries, but that it may also be used to enhance existing security for sensitive content in the enterprise space as well. What do you think?