Is this the Right time for Rights Management?

By E.K. Koh, VP of Solutions at NextLabs

It depends on whether you believe the analysts.

In the report “Information Security Predictions and Recommendations 2014”, Kuppinger Cole recommends that enterprises “Focus on strategic elements such as Information Rights Management for documents and Enterprise Key and Certificate Management (EKCM) for managing the secrets.” And, at the recent European Identity Conference, Kuppinger Cole identified Secure Information Sharing as a hot topic, by calling out Rights Management as an enabler. [Source: EIC 2014: Trends and Hot Topics, Kuppinger Cole, May 2014] more “Is this the Right time for Rights Management?”

DFARS: Where is my Unclassified Controlled Technical Data?

By Dennis Andrie, Director of Professional Services and Support at NextLabs

In our last blog post on the Defense Acquisition Regulations System (DFARS) Subpart 204.73 and associated contract clause 252.204-7012, Safeguarding of Unclassified Controlled Technical Information, we discussed actions that companies must act upon to protect Unclassified Controlled Technical Information when they contract or subcontract with the U.S. Government in order to be in compliance with government contracts. more “DFARS: Where is my Unclassified Controlled Technical Data?”

SharePoint 2014 Key Security Takeaways – Our Top 5

By Mandy Pang, Senior Product Manager

SharePoint 2014 Key Security Takeaways – Our Top 5

  1. The conference attendees were buzzed on Attributes.  Specifically, attribute-based security models for SharePoint.  Role-based models are no longer making the cut – they leave collaboration vulnerable.  Attribute-based solutions have fine-grained control.
  2. Clouds, of course was big, even bigger was the topic of protecting data in-transit to/from cloud and at rest in the cloud.  Securing Office 365 was another hot topic.  There was a great deal of discussion around the need for comprehensive end-to-end protection of intellectual property while satisfying the regulations set forth by a company’s compliance office.  If the data or IP was to be accessed by or transmitted to an employee or contractor outside of the company’s firewall, then concern was expressed on how to safeguard the data.
  3. SPC14 was global with a good portion of attendees coming from Europe.  Interestingly enough, a lot of European companies are looking to the U.S., particularly Silicon Valley, for solutions on automated information rights management.
  4. The architects, developers, and I.T. leaders with which I spoke were eager to learn about how to automate fine-grained access control for all work-product in a SharePoint environment.
  5. Extensibility was also discussed.   At SPC14 the conversations were about information rights management extensibility – starting off with one Microsoft solution such as SharePoint, then extending the same information rights management solution to Office 365 and other products.

more “SharePoint 2014 Key Security Takeaways – Our Top 5”

Cloud Security – Protecting data at rest and in transit – Information Risk Management for the Cloud

By Sudhindra Kumar, Principal Software Engineer at NextLabs

In my previous blog, we discussed about Data Governance Policies and Regulatory Compliance.

In this post, we’ll see some of the options available to protect data at rest and in transit. A few years ago, protecting data in transit was considered more important than protecting data at rest. However, with the proliferation of Internet and cloud technologies, and the subsequent issues related to data breaches have put the spotlight on protecting data at rest as well. Let us take a look at different solutions for protecting data at rest and in transit: more “Cloud Security – Protecting data at rest and in transit – Information Risk Management for the Cloud”

Can we turn off Snowden’s access after the fact?

By E.K. Koh

In my last blog, Would data-level controls have stopped Snowden, I highlighted the importance to separate system rights from data rights. But what if Snowden was using a login credential that in fact grants him rights to sensitive data? Accounts vary, but in the blog What the Snowden affair taught us , Anand alluded to the fact that Snowden gained access by stealing credentials of users with higher privilege. Unfortunately, even a system with fine grained data entitlement capabilities will not be able to stop Snowden, under his new identity, from copying sensitive data. more “Can we turn off Snowden’s access after the fact?”

Managing Export Compliance with Trade Management IT Systems

By Soujanya Madhurapantula.

Let’s start with what a trade management system is, what it does, and what are some of its shortcomings.

What is a Trade Management System

Export control can get pretty messy, especially when you consider how a typical company will be operating according to the rules of multiple jurisdictions at any given time.  Businesses that must comply with Export Control regulations like ITAR often maintain license and distribution information in a central Trade Management System (TMS).  more “Managing Export Compliance with Trade Management IT Systems”

Industry Spotlight: How does GE Oil & Gas manage operational Information Risk?

By EK Koh.

Many companies need to protect sensitive intellectual property (IP) as they collaborate globally on product designs and across multi-level supply chains. They also need to comply with cross-border export regulations even as they collaborate and share technical data with global customers, partners and employees. more “Industry Spotlight: How does GE Oil & Gas manage operational Information Risk?”