Companies estimate that more than one in five outgoing e-mails (22.8%) contains content that poses a legal, financial or regulatory risk. Over a third of companies (34.7%) reported their business was impacted by the exposure of sensitive or embarrassing information in the last year. More than one in five (21.1%) were impacted by improper exposure or theft of customer information, while 15% were impacted by improper exposure or theft of intellectual property.
In today`s hi-tech, fast-moving society electronic mail has become so frequently used and accepted that organisations and employees worldwide have started taking it for granted. However, the importance of electronic mail now means that its status has been established to be comparable with legally binding documents in many jurisdictions.
In its annual study of outbound e-mail and content security issues, messaging security company Proofpoint - part of the Condyn Security Framework, found that e-mail and other outbound messaging streams (including webmail and blog postings) continue to grow as a source of risk and potential liability for companies. The study found that 38% of companies with 1 000 or more employees hire staff to read or analyse outbound e-mail. 44% of companies with more than 20 000 workers employ staff for this purpose. Companies appear to have good reason to worry - more than one in three investigated an e-mail leak of confidential or proprietary information and 36.4% investigated a violation of privacy or data protection regulations in the past year.
Based upon its highly successful `inbound` filtering capability, the result of its patent-pending MLX machine learning engines, Proofpoint has introduced modules which provide an automated mechanism for identifying outbound content violations.
The Proofpoint Digital Asset Security (DAS) module is designed to detect confidential information in outbound e-mail. DAS can be trained to ignore common elements such as e-mail disclaimers, signature blocks and other footers. This helps reduce false positives. Examples of data that would violate a policy are stored as a `fingerprint`. This means the Proofpoint server cannot be hacked to retrieve sensitive data by extracting the training examples.
DAS can also prevent different types of documents from being sent outside the organisation. A rules capability allows a diverse set of options to identify noncompliant content. Once the content is identified, the rules define what should be done with it.
Proofpoint`s survey, conducted by Forrester Consulting for Proofpoint, also found that nearly one in three companies (31.6%) had terminated an employee for violating e-mail policies in the past 12 months. More than half (52.4%) of companies have disciplined an employee for violating e-mail policies in the past year.
More than one in four companies (25.2%) were ordered by a court or regulatory body to produce employee e-mail in the last year. This court order to produce employee e-mail at present raises a huge concern for senior management within any organisation; however, this is where the Forensic Compliance solution from Cryoserver, another part of the Condyn Security Framework, has seen huge success.
"The shear number of regulations that apply to all organisations, across many different areas of business, is bewildering and occasionally downright contradictory, making life potentially very awkward for employees," says Stuart Winter, Sales Director of Condyn. "The fact that many e-mail messages may contain mixed types of information, including confidential business details, IP, contractual or customer information and the purely personal, simply adds to the confusion.
"Typically, each separate class of data would have a different retention and compliance requirement, making it almost impossible for a stated archiving policy to be effective.
"The Cryoserver solution takes a different approach to the traditional storage management and e-mail archiving solutions available on the market," says Winter. "Based on the premise that neither archiving nor document management alone provide sufficient protection, Cryoserver is an appliance-based tool that seeks to provide organisations with a `Forensic Compliance System`.
"Everything in, everything out, and everything around the organisation is forensically archived. It cannot be tampered with, changed, forged, amended, or altered in any way. It provides a true record of all communication through the e-mail stream."
In operation, the Cryoserver system is capable of trapping all e-mail that is sent to, from or around an organisation, effectively creating an audit copy of all electronic mail. Each and every mail message may be stored, in an encrypted, compressed manner with the data digitally signed, including any attachments. This prevents a message being deleted within a specified retention period, 10 years, for example.
Cryoserver comes complete with sophisticated indexing and reporting capabilities, making it quick and simple to search through the stored archive to retrieve information based on a wide range of search criteria. While each mail user may search through their own stored mail, only privileged users can search across all of the system. It is important to note that each instance of such a search is audited with nominated "Data Guardians" notified of the details of the search, who carried out the inquiry and the reasons for it.
"This forensic audit trail of Cryoserver means a company can prove a negative - we didn`t receive it, as easily as a positive - it was sent," said Paul Grossman, CEO of Cryoserver. "And by the end of 2006, Cryoserver will add this same power not only to mail, but instant messages, Web communications, SMS and the meta data of voice, providing the most comprehensive picture of exactly what went on at any moment in time.
"As a building block within the Condyn Security Framework, we believe Cryoserver will deliver significant advantage to users in the South Africa and Africa market," he said.
With Proofpoint in place to protect the organisations outbound e-mail stream and Cryoserver in place to fully audit each e-mail sent into, out of and around the organisation, Oliver March, an IT Security Specialist with Condyn, highlights: "IT staff can rest assured that all electronic mail can once again be taken for granted. Companies no longer have to worry about suffering significant financial consequences and reputation damage from e-mail abuse."
Share
Condyn has been focused on delivering and supporting best of breed security solutions within the African market, for over 10 years, and has a long, well established proven relationship with both partners and customers. At the beginning of 2006 it announced the `Condyn Security Framework`, an integrated security suite of products aimed at providing comprehensive defence for the demanding needs of organisations, both large and small. This framework, delivered as scaleable modules through high quality partners, includes solutions to protect companies from all inbound and outbound messaging threats, secure digital assets and comply with regulatory compliance, forensically archiving all data, controlling Web access, delivering of secure mobile e-mail to all handsets and devices, encryption and `lock down` pf all portable devices, servers and files, vulnerability testing and asset management, as well as powerful management reporting, extensive policy flexibility and workflow, delivered as software and `black box` appliances, and through partners as managed services.