It used to be that a company could pretty much tell where its corporate data was located. It sat on corporate file servers, perhaps as email attachments on a corporate email server, and on well-controlled corporate desktops and laptops. A company could disable USB ports if they had reason to be especially paranoid and email systems could block attachments if necessary. Data could be locked down and kept safe from all but the most determined hacker if there were a few precautions in place.
Or so everyone thought. In reality, none of this was true. For over 20 years, files left the building in personal email accounts. Content was copied into the body of emails in order to fool attachment scanning systems. Eventually, consumer online file sharing software started to become more common and end-users used them – and still use them – to get around corporate restrictions.
The situation has become even more complex with the proliferation of social networks and mobile devices. Data is effectively unfettered. Content can be downloaded, moved to a mobile device, put on a hard disk on a random computer, shared on a social network, moved from one country to another without detection, and generally pushed out of the corporate comfort zone.
Traditionally, the way to avoid problems with data being shared insecurely has been to just say no. No to sharing, no to emailing files, no to making those files available on a mobile device. Restrictions like these push individual users to go outside the corporate systems and use consumer services.
Knowledge workers share files and other content not because they want to but because they need to. To be productive and effective in their jobs, modern knowledge workers need to quickly, easily, and continuously share information with their co-workers, customers, and business partners. New technologies such as online file sharing services, enterprise social networks, and enterprise content management systems have risen to facilitate this necessary sharing. Issues such as data residency laws, intellectual property protection, compliance with regulatory requirements and privacy laws are important to corporations but will take a back seat to immediate individual needs.
Assuming that data wants to be free, how does a responsible company give its employees the data sharing capabilities they need without compromising security and privacy? One way is to stop trying to lock down data centrally and allow the data to carry its security with it. Instead of the security perimeter being the corporate systems, place the safety boundary around the content itself.
Information rights management (IRM) is a way to do this. IRM encrypts the data and carries the permissions to unlock it with the content. The ability to view, edit, copy & paste, and print data, travels with the file independent of the transport mechanism. No matter how the content is shared – via email, file sync and share, on a social network, or on a USB drive – IRM insures that only those with the right to use the content are able to do so.
By wrapping the permissions around the content, data can be shared without worry. While rights management often seems like a dirty word – conjuring images of losing your music when your computer fails – it makes sense in a corporate context. The purpose of IRM is to allow knowledge workers to safely share data not to inhibit content from being shared. IRM is an enabling technology that allows data to be free but not dangerous.
Sponsored by Intralinks (NYSE: IL). All opinions are those of Neuralytix and its analysts.