Social Enterprise

Jul 8 2009   3:39PM GMT

Professor McAfee on Enterprise 2.0 and compliance: Slight risk

Posted by: Alexander Howard
Andrew McAfee, Web 2.0, Social Enterprise, Enterprise 2.0, Chief information officer, Social software, #e2conf, E20, compliance

This year, I approached the annual Enterprise 2.0 Conference in Boston with a specific question: Can an organization in a regulated industry adopt enterprise social software and remain compliant?

I received a range of answers, depending upon whether I talked to vendors, end users, analysts or CIOs. Later today, I’ll be publishing a feature that examines precisely this issue.

After reading C.G. Lynch’s Q&A on what’s next for enterprise 2.0 with Professor Andrew McAfee, who coined the term, I saw I’d need to ask him the same question.

When asked about whether CIOs should worry about “implementing Web 2.0 tools in the enterprise because of security and compliance,” Professor McAfee said he didn’t have any horror stories to relate – and that he asks for them, whenever he talks to big business. His “quick and dirty explanation” for that is:

”People know how to do their jobs. By this point, none of these tools are a week old, so the rules for using them aren’t unclear. We know the stuff that will get us fired if we talk about it. If you work in an investment bank, for example, you have it drummed into you, before any enterprise 2.0 tools even showed up, what you can and can’t talk about, and to whom.”

I asked McAfee a similar question: “Where do you see the intersection between enterprise 2.0 and regulatory compliance?” His answer:

I do not think these tools substantially alter the compliance risk profile of organizations. Employees today are acutely aware of compliance issues, and I don’t see that they’ll be tempted to disobey policy or break the law simply because 2.0 tools become available.

There may be some slight risk of inadvertent noncompliance, but the fact that contributions to 2.0 environments are so visible means that any such breaches are likely to be detected quickly.

When it comes to enterprise 2.0, I agree heartily with Thomas Jefferson, who wrote, “I know of no safe repository of the ultimate power of society but people. And if we think them not enlightened enough, the remedy is not to take the power from them, but to inform them by education.”

After reporting on the story for a week, it’s clear to me that CIOs, privacy and security professionals need better tools to monitor, log and filter communication with external social networking platforms. Data loss prevention (DLP) will be a line item in enterprise security budgets, driven by the need to reduce new risks posed by social messaging.

Even if political gaffes on social networking sites don’t cease — like Battle Creek Mayor Mark Behnke accidentally tweeting Social Security numbers or continued Congressional missteps on Twitter — compliance concerns about the use of enterprise 2.0 platforms are likely to increase with continued data leaks, from whatever vector they take.

Insider threats are a significant concern, given increased economic pressures stemming from the recession. As Forrester senior analyst Andrew Jacquith observed earlier this year, “as auditors have gained more experience assessing compliance with Sarbanes-Oxley and other statutes, they have become increasingly aware of the perils of excessive entitlements. Greater awareness has led to tougher audits. Now enterprises must be prepared to explain who got access to what application features, and why.”

What Professor McAfee’s answer reveals to me, primarily, is that the people aspect of compliance is a crucial consideration. The technology matters but, in the end, your security and ability to meet regulatory requirements rests on the mind-set and education of those entrusted with the sensitive data of an enterprise or its customers. Thanks to the good professor for his answer.

Jun 25 2009   6:51PM GMT

Add Twitter security to the top information security threats

Posted by: Alexander Howard
Twitter, Facebook, LinkedIn, RSA Conference, identity theft, Social Enterprise, Social network, malware, Information security

Last week’s 140 Characters Conference presented dozens of examples of how people are using Twitter creatively, effectively and disruptively. What didn’t get as much attention are the security risks and compliance challenges Twitter presents as the wildly popular microblogging platform continues to see adoption by enterprise users.

I talked with Erin Jacobs, chief security officer for UCB Inc., about Twitter security. If you haven’t found her on Twitter yet, she tweets as @SecBarbie. She sent her list of top information security threats about Twitter to us via email, which we published below.

---

Information leakage
Corporate networks try to protect themselves from email, IM and other means of sending information outside of the network. There are new services for updating Twitter popping up daily, so it is impossible at this time to completely block the ability to access Twitter. Network security professionals are constantly racing to fill in the holes to ensure that information cannot be leaked. Information leaks could include:

• Identity information from inside organizations.
  • Identity theft
  • Credit card fraud
  • Account numbers
• Business IP leakage.
  • Business plans
  • Code leakage
  • Copyright infringement
• Facility information.
  • Business operating hours could be used in targeted physical theft attacks.
  • Personnel locations or schedules.

Malware/viruses/Oh-MY!
Since Twitter communicates over port 80 and 443, there really isn’t much to protect users from inadvertently bringing malicious code into the network. Bit.ly and other URL shorteners can easily send users to different addresses than the user expects.

Improper use of Twitter
Direct messages are not secure email. Education about potential vulnerabilities is essential for executives and top-level management to understand that they must keep business off of Twitter. Issues around human resources and online harassment are also a consideration.

---

After Erin wrote in, I used Twtpoll to ask my followers on Twitter the same question, using her list and adding a few other options.

You can vote on what your primary Twitter security concern is on Twtpoll. The results, as of today, are embedded below:

As you’ll see, insecure third-party apps leading to stolen accounts is (currently) the top answer – it’s an issue of natural concern to Twitter users. Coming in second, however, was Erin’s concern over data leaks of confidential or proprietary information. Information security threats are at the top of on any CISO’s list; add Twitter security to the list.
Each of these information security threats are valid for other social networking platforms or services as well, like LinkedIn and, in particular, Facebook. Issues around Twitter security and social media in general were frequently discussed at this past week’s Enterprise 2.0 Conference in Boston and, at the RSA Conference earlier this year, where Web application security was at the top of the information security threats list.

Jun 23 2009   7:16PM GMT

Booz Allen wins Open Enterprise Award for collaborative environment

Posted by: Alexander Howard
Booz Allen Hamilton, Human resources, Social Enterprise, PeopleSoft, business, European Union, Intranet, open enterprise, collaborative environment, Enterprise 2.0, E20

Booz Allen Hamilton won the Open Enterprise Award for 2009 at the Enterprise 2.0 Conference in Boston today for their innovative internal collaborative environment. The Open Enterprise research project, led by Stowe Boyd and Oliver Marks, conferred the award to a company that was “truly transforming their organization at its core through deep, enterprise-wide adoption.” Walton Smith, a senior associate at the Virginia-based consulting firm, presented “hello.bah.com” to the crowd.

Smith described how Hello was built around people, focusing on connecting associates to each other and activity streams to profiles. According to Smith, more than 40% of the firm has added content to the system, rapidly forming connections with one another. Booz Allen Hamilton used agile development to create their Enterprise 2.0 platform, a methodology that now allows the team to roll out a new function every two weeks. Smith said that “functionality is driven by the users.” One upcoming feature, for instance, will allow users to rank and rate the quality of content entered into the system.

One initial roadblock that Smith noted was human resources, which viewed itself as the “official source” of data. In fact, the new intranet actually allowed employees to clean up bad data entered by HR into PeopleSoft on the back end.

When asked about security and compliance concerns – critical to a consulting firm that deals with government data or works with corporations with sensitive intellectual property – Smith noted several aspects of the system that are designed to prevent data leaks. First, only Booz Allen employees are allowed on Hello – not contractors. Second, data that comes under regulatory compliance actually resides in SharePoint, which Booz Allen uses for document-based collaboration for restricted content. Users can link to content from blogs, Confluence wikis or other pages but are confronted with an access control layer. Within the restricted environment, familiar compliance tools used in knowledge management are employed, like access management, monitoring and logging.

Smith is aware of the possibilities for a data breach, noting that “our weakest link is our people – we spend a lot of time making sure they know which tools to use.” He’s also cognizant of potential regional compliance issues, such as European Union laws that require that employees must opt-in to share information like pictures or work history with others.

The creators of Hello also had thought through employee departures. Smith allowed that departures weren’t “so much of an issue, given the economy,” but that there is a process in place. When someone moves on, a banner is added to the top of his or her profile page indicating the departure. That person won’t show up on the dropdown menu, which only includes actives employees for searchers, but the profile page itself, including connections and intellectual property created for Booz Allen, remains.