February 22nd, 2012
At TITUS, we provide classification tools for users of Microsoft Office and Microsoft SharePoint. Our tools for Microsoft Office allow users to assign classifications to documents, spreadsheets and presentations as they are being created, while our SharePoint products allow administrators to set policy to classify and label documents as they are added to libraries within SharePoint.
In order to easily demonstrate some of our product functionality to customers, we decided to build a demonstration cloud classification service. The beauty of the cloud is that it can be accessed from anywhere, at any time – an ideal platform for people who want to quickly and easily try classification.
Read the rest of this entry »
Posted in Uncategorized | No Comments »
February 10th, 2012
One VERY SHORT year ago, TITUS made our debut – a coming out party of sorts – at RSA. And what a debut it was! We had excitement, we had NASCAR racing, we gave away PS3s, and we had HUGE crowds of people at our booth wanting to learn more about how to involve their end users in securing sensitive information… what a week!
So, what’s the first thought that went through our collective minds when planning this year’s event… “How the heck are we going to top that excitement this year!?” But, we put those collective minds to work, and, well, I think we’ve found a way!
Read the rest of this entry »
Posted in Classification, Cloud Data Security | No Comments »
January 4th, 2012
It’s a common scenario: a large organization invests millions of dollars in a DLP solution, only to leave it in “watch mode” because the rate of false positives is too high to enable full blocking. The result is a DLP investment that becomes a white elephant: a promising technology that does not pay off in actually preventing data loss.
The problem often begins with an over-reliance on automated scanning to prevent data loss. The DLP system is expected to automatically identify all sensitive content, which requires IT administrators to translate business processes and policies into automated rules for every data loss scenario. This is an impossible task, which usually results in overly restrictive rules that block non-sensitive data (false positives) or overly permissive rules that mistakenly release sensitive data (false negatives).
The impact of false positives can be just as detrimental to the business as the data loss caused by false negatives. False positives disrupt business agility and productivity, and can impact collaboration, innovation, and business growth. As well, false positives can actually lead to increased data loss, with users looking for alternative, less secure methods to get around restrictions and carry out their business tasks.
The best way to address this problem is for organizations to identify their information appropriately. The sensitivity of each piece of information must be identified, or ‘classified’. Information classification is crucial for proper handling, and for the ultimate security of an enterprise’s information. Classification provides context to unstructured data such as email and business documents, making it possible for DLP solutions to know how to protect your organization’s sensitive information. Read the rest of this entry »
Posted in Classification, DLP, Email Security, Protective Marking | No Comments »
December 28th, 2011
As 2011 draws to a close, I thought it would be interesting to provide a list of the most popular data security articles on this blog. Here are the topics and articles that were most popular with our readers:
1) Data Classification
More and more commercial organizations have started to see data classification as the foundation of their information protection strategy. We wrote several articles about this trend, including an article that described how to implement a data classification policy in 5 simple steps, and an article that recommended best practices for defining a data classification scheme. Readers were also interested in how to use classification software to bulk classify, mark, and label large numbers of files.
2) Mobile Security
Mobile security has become a hot topic, especially with the trend toward consumerization of mobile devices. Read the rest of this entry »
Posted in Classification, Cloud Data Security, Compliance, Controlled Unclassified Information (CUI), DLP, Email Security, ITAR / Export Control, Military Classification, Outlook Web Access Security, Prevent Wikileaks, Web Mail | No Comments »
December 5th, 2011
Most organizations have an established corporate information handling policy to protect sensitive and confidential information. This policy is typically expressed with a classification scheme that describes the handling procedure based on the sensitivity of the material in question. The challenge, however, has been implementing and enforcing this policy; in other words, ensuring that sensitive information is adequately protected on a consistent basis.
To address this challenge, organizations often make large investments in technologies such as data loss prevention (DLP) and information rights management (IRM) solutions. Unfortunately, these technologies are often implemented without classification as a first step, and therefore lack context about the information they are protecting. This results in inconsistent and inaccurate data protection, which increases the organization’s risk exposure, may reduce business velocity, and can make a large infrastructure investment a white elephant.
The solution to this challenge is to make classification the foundation of your information protection policy. Fortunately, implementing a classification policy is actually quite simple. In our new white paper entitled “5 Easy Steps for Implementing a Classification Policy”, we discuss how you can implement – and enforce – a classification policy that will increase user security awareness, enhance DLP and IRM solutions, and protect your organization against data loss. Read the rest of this entry »
Posted in Classification, Compliance, Email Security, ITAR / Export Control, Military Classification, Protective Marking | No Comments »
November 8th, 2011
On November 4, 2011, the National Archives and Records Administration (NARA) released the first-ever registry for Controlled Unclassified Information(CUI) for records that are not classified as top secret or secret, but require some protection. The release of this registry meets one of the first targets of President Obama’s Executive Order on Controlled Unclassified Information.
The order stated that “Within 1 year of the date of this order, the Executive Agent shall establish and maintain a public CUI registry reflecting authorized CUI categories and subcategories”. Although much work remains, the new registry “is certainly an important milestone,” according to John Fitzpatrick, the office’s director. Looking back at the origin of this registry, one of the key reasons to move forward with this initiative was that executive branch performance “suffers immensely from interagency inconsistency” in the CUI arena. And no wonder– there were 117 different markings. The results were inconsistent marking and safeguarding of documents, which led to unclear or unnecessarily restrictive dissemination policies, and created impediments to authorized information sharing.
The new CUI registry provides a common definition, standardizes processes and procedures and breaks CUI down into 15 subject categories, such as law enforcement, immigration and privacy, followed by 85 subcategories (“privacy-contract use,” privacy-financial,” and so on.) It also justifies each with a reference to a specific law, regulation or government-wide policy. The next major steps Read the rest of this entry »
Posted in Compliance, Controlled Unclassified Information (CUI) | No Comments »
November 2nd, 2011
In my previous blog post, 5 Easy Steps for Implementing a Classification Policy, I discussed the importance of starting with a simple set of classification labels. In this post, I will expand on the topic of classification schemes, especially as they apply to commercial organizations.
At TITUS, we recommend that organizations try to keep the number of classification options down to four or fewer. We find that the simpler your classification scheme, the easier it will be for users to decide which category to use. Later, as your users become used to classifying content, you can add additional categories.
Many organizations use three categories:
1) A category such as “Public” to indicate non-sensitive information
2) An “Internal” category for information that should stay within the organization
3) A category such as “Confidential” or “Restricted” for information that is particularly sensitive
Surprisingly, the “Public” category is often what causes the most debate in commercial organizations. Read the rest of this entry »
Posted in Classification, Compliance, Controlled Unclassified Information (CUI), ITAR / Export Control, Secure Email Gateway | No Comments »
October 20th, 2011
I recently met an insurance executive at a friends’ wedding, who worked for a large insurance firm. He and I ended up connecting because we had some things in common. Turns out, he also enjoyed free drinks from an open bar, much like I do. But that wasn’t a surprise. What was a surprise came when I told him that I worked for TITUS. I told him that we make software for businesses which helps prevent data loss, promote security awareness and comply with regulations. When I told him this, he was very intrigued. He offered that the folks in the insurance industry have been talking a lot lately about data loss incidents, from 2 different perspectives:
Read the rest of this entry »
Posted in Uncategorized | No Comments »
October 13th, 2011
On October 7, 2011 President Obama issued an Executive Order (Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information) “in order to ensure the responsible sharing and safeguarding of classified national security information (classified information) on computer networks”. This is as a result of the Wikileaks incident of last year. One of the major focus areas of the Executive order is to reduce the possible threat of insiders leaking classified information out of the government.
Read the rest of this entry »
Posted in Classification, Information Spillage, Prevent Wikileaks | No Comments »
October 13th, 2011
On November 4, 2010, U.S. President Barack Obama signed a new Executive Order to establish a uniform policy for the government treatment of “Controlled Unclassified Information” (CUI). This framework standardizes practices around the sharing of Controlled Unclassified Information, with the goal of improving the sharing of information within the executive departments of the U.S. Federal Government.
Government agencies must complete a number of deliverables as part of the CUI implementation plan. In May 2011, agencies were required to submit a catalogue of proposed Controlled Unclassified Information categories to the National Archives and Records Administration (NARA). The next step is for agencies to develop a CUI compliance plan, which is due by December 6, 2011.
TITUS has partnered with PKH Enterprises to help agencies develop their CUI compliance plan. In a joint white paper with Patricia Hammar, executive secretary of the CUI Presidential Task Force, we provide expert advice, templates, and best practices from governments that have implemented similar initiatives. The white paper, called “Protect Your CUI Data: 5 Steps to Implementing Your Controlled Unclassified Information Plan”, includes the following content: Read the rest of this entry »
Posted in Classification, Compliance, Controlled Unclassified Information (CUI), Email Security | No Comments »
