Posts from ‘Ipswitch Products and Services’
Every organization that values security is facing challenges in how it secures information shared between people, either inside the company or with people outside the company such as customers or partners.
Jeff Whitney, VP of Marketing, sat down with Enterprise Management 360 Editor David Tran to discuss trends and issues around person-to-person file sharing within business.
EM360°: What are you seeing as the key trends today impacting person-to-person file sharing within businesses?
Jeff Whitney: There are essentially three key trends in person-to-person file sharing.
First of all, taking a few steps back, it has only been a few decades ago, in a work world that’s now long forgotten, that IBM mainframes ruled the world. In the good old days, the vast majority of confidential company and customer information was locked down in those mainframe computers. People were only able to access it by wading through computer printouts, or if they were lucky, by accessing large cathode ray VCT terminals. People couldn’t get hold of that information and risk sharing it elsewhere.
But today, the work world is entirely different. Today businesses are dominated with knowledge workers who have personal computers, and each one is far more powerful than those old mainframes. These PCs are filled with confidential company and customer files.
The second trend is that, with all the information that knowledge workers have, they are sending an ever-increasing volume of information to their extended enterprise; to their suppliers, shipping vendors; and their customers and every imaginable type of data being shared including legal documents, patient records, loyalty data, package locations, insurance claims, account information, purchase orders, x-rays, test results, and investment information, just to name a few.
The third trend is, with all of this going on, IT hasn’t been able to keep up with this flow of information, and there is a plethora of easy ways that employees can use to transfer files. For instance: company email, personal email and consumer collaboration systems like Dropbox. Employees are using these non-secure systems because IT hasn’t been able to provide them with solutions that are convenient enough. They are not knowledgeable of these security risks, and all they want to do is get their work done.
EM360°: From a corporate perspective, what security risks and challenges are therefore in place that management, IT and security professionals need to be aware of?
These file-sharing techniques that employees are using can create security breaches. Even company email is often not secure as it is coming across in an unencrypted way.
You could be breaking corporate compliance obligations — if you are in financial services, in healthcare, or any number of other places who have policies or compliance regulations.
There is a true lack of visibility of Audit trails. You lock down your cash, so you know what is happening to your cash. And yet knowledge is regarded as far more important to businesses, or at least as important as cash. Yet, we are letting that knowledge flow back and forth in very non-secure manners. And the reality is who will get in trouble if that happens — is it the employee who sends it? Definitely. But equally, the senior manager is going to walk into the IT department, asking why IT hasn’t provided their workforce with solutions that can protect secure the data and provide the governance and compliance the business needs.
EM360°: So now let’s get to the survey. We see your eBook states that 84% of respondents acknowledge they send classified or confidential information as email attachments. That’s astounding. What do you see driving that behavior?
It is really driven by the fact that employees are just trying to get their job done. They are surrounded by solutions — personal email, consumer collaboration tools — that allow them to share information in a very easy to use and rapid form. They carry that over into their work lives. If they know that they could send a file very quickly using a readily available consumer tool, they are not going to wait around for a member of the IT department to help them.
I think it’s actually very appropriate to discuss the magnitude of file-sharing. You mentioned that 84% are using or sending confidential information using these kinds of tools. In that 84%, they are actually sending classified emails with email attachments, which I have reiterated before, is not secure.
Almost three quarters of those — 72% — are doing it weekly, and more than half are doing it every day. This is a major issue.
In fact it gets even worse as employees aren’t using only their work emails, but instead are using their personal email. Some 50% are using their personal emails to send over work attachments. 40% say it’s because it is faster and more convenient. 35% say it is because of file size issues. And 30% say their IT department can’t monitor or audit. They are sending over confidential company information, and for some reason, they do not want IT to monitor that. It’s wrong.
Additionally, 50% are using file sharing websites, and of those, a quarter are doing that weekly, and some of those websites are well known for data breaches and have been publicized for it over the past few months.
EM360°: Jeff, there’s a set of risks in place with most organizations today. So what can companies do to balance the needs of the employee vs. the organization?
What companies need to do is to provide secure managed file transfer capabilities for their employees that they will readily adopt. These tools need to be convenient, straight-forward, and allow fast transfer of knowledge. And for the business, it needs to provide the security and governance (control, security, compliance) that companies demand. You need to have both; it isn’t just one or the other.
IT isn’t just sitting on resources that are readily available to attack any issue. This issue has just blown up so quickly that IT has been slow to respond. Our survey shows that only 25% of IT organizations actually enforce the usage of IT-sanctioned tools. Only about 40% of organizations have visibility into the movement of their confidential data in and out of their business. And only about 15% receive confirmation of when critical data is being delivered.
As I said, IT organizations haven’t been able to catch up with this trend, and they haven’t provided the solutions that are out there to address this.
So how is Ipswitch File Transfer addressing this increasing need that you’re seeing for secure person-to-person file transfer within organizations?
Ipswitch File Transfer has a long history of providing managed file transfer capabilities for organizations, specifically for IT to manage these issues.
Our MOVEit™ Ad Hoc Transfer solution enables employees to send and receive files and messages between individuals and groups using an Outlook or a simple browser interface. MOVEit™ meets employees’ needs for convenience, ease-of-use and speed and IT’s need for governance, including control, visibility, security and compliance.
EM360°: Jeff, thank you for sharing your insights with us. The eBook Jeff mentioned is available and includes the full details of the research we have cited around the risks of person-to-person file transfer within business.
In our recent webinar “File sharing: Have employee habits put your company at risk?”, Michael Osterman of Osterman Research and David Boone of Ipswitch File Transfer spoke about the issues associated with trends in individual file sharing and the impact they have on businesses.
There is continued increased usage of rogue tools to share files and information when employees don’t have an adequate solution provided to them by their business. These tools include everything from personal email accounts (Gmail, Hotmail, Yahoo!) to cloud-based personal file sharing tools (YouSendIt, DropBox) all the way through to USB drives or what David refers to as “SneakerNet” — walking private data around the office on USB drives which can be easily misplaced or lost.
Michael and David also take a look at what information technology teams can do to deliver solutions to businesses that will address these risks, and tips on how to balance the need for end-user simplicity with the control, security and visibility required by the organization.
- Watch the on-demand webinar recording
Lastly they cover five key criteria to consider when selecting a business-class file sharing solution for your organization:
- Make sure it can handle unlimited file sizes.
- Confirm that minimal training is required to deploy it.
- Ensure it is secure. This includes utilizing encryption both in motion and at rest, and that the message itself is encrypted too.
- For successful user adoption, make sure it’s easy to use.
- Finally, make sure it’s easy to integrate into your existing environment.
For the full discussion between Michael and David as well as the question-and-answer session with the audience, we invite you to view the webinar recording. We also invite you to share this with any colleagues who you think may find it useful.
Here’s a great write-up of how Rochester General Hospital is using Ipswitch’s MOVEit solution to manage over 400,000 electronic billing transfers per year to dozens of payer systems.
Quick background on the business need: Rochester General Hospital needs to exchange patient records, insurance claims, and billing information from their electronic medical record (EMR) and accounting systems with many health providers and insurance companies.
Security and compliance are critically important: Not only do the transfers need to be reliable to facilitate timely payments, but they also needed to be highly secure and auditable to protect patient privacy and ensure compliance with HIPAA and HITECH.
Ipswitch eliminated complexity and created efficiencies:
“We needed to consolidate on a standard way to transfer files to many different payer systems…. MOVEit consolidated a number of batch files and legacy tools into a single, secure and easy to use file transfer solution,” says Dylan Taft, Systems Engineer at RGH.
“In the event of an audit, MOVEit allows us to provide chain-of-custody and non-repudiation with just a few clicks. Without MOVEit, we wouldn’t have this visibility.”
If we didn’t have MOVEit, we would have to hire one or two additional people just to review the log files every day – not to mention lost files, information arriving late, and frustrated doctors and payers.”
Do you have a great Ipswitch story of your own to tell? Email us at mystories@ipswitch.com…. We can’t wait to hear all about it!
Looking back at 2011, we saw more and more employees using consumer-grade (and often personally owned) file sharing technologies such as USB drives, smartphones, personal email accounts, and file sharing websites to move sensitive company information. We’ve learned that employees will “do what they need to do” to be productive and get their job done… And if IT doesn’t provide them with the right tools, they will find their own.
2011 was also a record-breaking year for data breaches. Coincidence? Perhaps. But there is no denying the fact that the increased use of non-sanctioned technology in the workplace has created a security loophole in many organizations. It will become increasingly important for organizations to mitigate this risk to avoid a failed security or compliance audit or worse, a data breach.
Ipswitch can help your organization meet the security, usability and visibility requirements for file sharing. For example, our Ad hoc Transfer module for MOVEit DMZ enables organization to enforce consistent policies and processes around person‐to‐person file transfers ‐ email encryption, attachment offloading, secure messaging, eDiscovery, and more. It not only gives companies unparalleled governance, but it also allows end users to send information, with anyone, in a fast, easy, secure, visible, and well managed way.
We will be talking a lot more about the topic of people person-to-person file sharing in 2012, so stay tuned….
Every day, files are exchanged between your systems, employees, and business partners on a global scale. It’s no secret that with each file transfer, your organization faces potential exposure to viruses, worms, Trojan horses and other malware – and the damaged files, corrupted applications, reduced performance and other adverse business effects that come with them.
Are your file transfers as safe as they can be? Specifically, when you receive inbound files, are you doing all you can to protect your IT infrastructure from the risk of viruses and malware?? Are your outbound data and file transfers “clean,” so you don’t expose your trading partners to any viruses that might be undetected in your systems???
Ipswitch MOVEit and MessageWay solutions offer the ability to integrate with specific antivirus solutions. Here’s a link to learn more about MOVEit DMZ’s new ability to integrate with Sophos and Symantec ICAP enabled antivirus solutions to ensure that only clean files enter your infrastructure.
For example, all files uploaded to MOVEit DMZ (including those sent using the person-to-person Ad Hoc Transfer module) are first scanned and validated to ensure that they are free of viruses, trojans, malware and other malicious threats. If an infected file is detected the following actions will immediately and automatically be taken:
• Rejects the transfer of the infected file
• Alerts end user that upload failed due to virus detection
• Logs the virus, timestamp, the scan engine, version and definition tag
• Reports the list of infected files that have been detected during a specified time period
By integrating your antivirus solution with your managed file transfer solution, you ensure that all the files you receive are scanned before they enter your network. Not only does this protect your applications, data and valuable IT assets, but it prevents you from accidentally passing on any viruses that may exist in your systems.
