Scott GordonAs recent events show, manufacturers’ design secrets and money have not been immune from the onslaught of high profile data breaches. U.S. fighter jet blueprints are just one example of the IP stolen in a breach of 160 South Korean firms and government agencies recently announced by government officials in Seoul. The theft from a Boeing aerospace parts manufacturer in Austria of €50 million was one of the costliest breaches so far in 2016.
In fact, collaboration across the global supply chain represents a big risk to U.S. firms. Theft of intellectual property by hackers associated with foreign governments totaled hundreds of billions of dollars in 2015, according to the FBI. One in five manufacturing firms reported a loss of intellectual property in a cyberattack in the past year, a survey of almost 4,000 IT managers in 27 countries has shown.
For manufacturers, much of that intellectual property lies in files shared with global suppliers, partners, and contractors — files that may contain highly sensitive CAD designs, blueprints, defect rates, formulas, performance information or manufacturing plans. Unfortunately, the file sharing required by collaboration is risky but necessary, and introduces major security gaps that the majority of enterprises perceive.
According to the 2015 State of File Collaboration Security report by Enterprise Management Associates, 75 percent of IT and infosec professionals at mid-tier enterprises expressed a high or very high level of concern about sensitive, regulated or confidential data leakage due to inappropriate file sharing or unauthorized access. Fully half said there were frequent instances of inappropriately shared documents or unauthorized access to files containing sensitive, confidential, or regulated information. A whopping 84 percent had a moderate or total lack of confidence in their organization’s file security monitoring, reporting and policy enforcement capabilities.
Lifecycle File Protection
Much of the collaboration problem lies in inadequate controls after files cross the firewall where internal content management, DLP and other point solutions no longer apply. You may share a file securely with a hired contractor or supplier, but what prevents that recipient from inappropriately forwarding the file, making unauthorized changes, storing the file via an insecure local or cloud file sharing service or leaving it on a laptop that gets lost or stolen? Even internally, sensitive files are often accessed or shared where they may end up in the wrong hands.
Emerging file security solutions aimed at reducing file collaboration data leakage risks address this gap with strong file encryption and usage controls that, once applied, persist for the life of the file, including after it traverses to various networks, recipients and devices.
Past information rights management (IRM) solutions were costly, often tied to specific applications or required specific infrastructure to function, and were cumbersome for IT and departmental users alike to use and manage. While these IRMs worked internally, they were especially challenging to enforce users outside the organization. The best of a class of newer solutions such as FinalCode offers greater flexibility and usability for internal and external application, while striking a balance between IT’s need for governance and the user’s need for convenience. They support conventional file sharing mechanisms, such as email and network shares, as well as new cloud and mobile based applications.
These solutions enable very granular controls over who can access files, under what conditions and what they can do with them. Users can easily apply required controls on file viewing, editing, saving, printing, and watermarking that persist for the life of the file. More so, the file owner can change the file security policy dynamically and even remotely delete files after they have been shared. These security policy controls are enforced wherever the file goes and every time the sensitive file is opened.
This new class of file collaboration security platforms also tracks and stores file activity, including applied controls, access attempts, policy violations and actual recipient usage, ensuring the organization meets regulatory compliance and, if needed, has the data for successful forensic investigations.
They are easy for IT security teams to implement and integrate with existing applications and workflows, separating file security functions from file storage, transport and content management. Department heads can preserve user productivity and workflows will not be impacted. And users are ready to do their part, as 70 percent of EMA respondents answered that end users would invoke stronger security controls if empowered.
In the C-suite, executives will most appreciate that the enterprise is achieving reduced reputation and threat of IP exfiltration risks, and improved regulatory compliance.
Collaborative File Security That’s Easy and Cost-Effective
The beauty of this approach is that if any collaborator decides to share the file to an unauthorized user, mishandles it accidently or has it stolen, these solutions can deny access and log the attempt. Departmental users can even apply time and file open limits and delete files on users’ systems long after they have been sent. These platforms can be quickly installed as needed, by department, project or enterprise-wide, and more so, can be easily used by external prospects, partners and contractors.
Many solutions are compatible with popular operating systems, applications, devices and consumer cloud services, including DropBox and Box, and multiple file formats such as Microsoft and Adobe so they don’t hamper the easy collaboration necessary to get products to market fast. Manufacturers can safely share files with partners, suppliers and contractors. Corporate management, human resources and counsel can safely distribute sensitive confidential files, ensuring they are accessed and used strictly according to company policy and regulatory constraints.
So go ahead and share those files with your collaboration partners without worrying about exposing intellectual property to the wrong user. With persistent file security solutions, you can protect sensitive information from prying eyes both internally and long after it leaves the organization.
Scott Gordon is COO at FinalCode, Inc.
