That presages the rise of a powerful new slot in the corporate hierarchy — the information compliance officer, who can outrank the CEO when it comes to setting rules for who in an organization can send what kind of data where.

In fact, Orchestria’s director of sales consulting, David Miller, says its system once blocked one company’s boss from sending a message that upbraided an underling with foul language. That further enraged the CEO, who told his compliance officer: “Don’t (expletive) block me again,” according to Miller.

Orchestria also cites a more productive example: In 2005, its software alerted Lehman Bros. that one of its bankers had improperly e-mailed 45 people some internal documents for an upcoming initial public offering Lehman was handling for VeriFone Holdings Inc. Lehman kept the recipients from being allocated shares in the IPO.

Story continues below ↓

advertisement | your ad here

Such finds are actually rare. Makers of compliance software say that less than 1 percent of what their systems spot are actually breaking any rules. And most of those violations are unintentional.

After all, insiders committed to mischief can take routes around these systems.

“If someone really wants to get stuff out of here, what’s to stop them from printing it out, folding it up and putting it in his pocket?” says Brett Powell, network engineer for Lakeland Regional Medical Center in Florida, which uses the Proofpoint e-mail system to enforce health-privacy compliance.

Because e-mail is just one part of the equation, the leading compliance products burrow deeper. They can examine documents sitting on file servers and information inside databases to determine whether some grain — a customer account number, a valuable trade secret — has landed where it shouldn’t. They can prevent files from being transferred to portable USB drives or iPods — or be set to let only certain higher-ups do it.

These steps are important because finding sensitive data in an inappropriate location is key to making sure it can’t accidentally be sent out.

“Information is like water, and it flows everywhere,” says John Amaral, chief technology officer at compliance-tech vendor Vericept Corp. “The problem is, you might know where the one genesis document is, but you don’t have any idea where all the (replications are) on thumb drives, content-management and e-mail systems. It gets created by normal, everyday business activities.”

The software often alerts compliance officers of such finds. But Joseph Ansanelli, CEO of vendor Vontu Inc., whose customers range from cosmetics house Mary Kay Inc. to uranium enricher USEC Inc., says that more and more, the software will be asked to automatically fix such messes by itself.

In that scenario, if an employee’s PC has a list of customers’ Social Security numbers sitting in plain text, the compliance software will move the file or encrypt it. Better that than running the risk a hacker will filch it.

That brings up an ironic element of these technologies. To a large degree they are being deployed to protect the privacy of patients or consumers. Yet they do so at the expense of employee privacy, putting monitoring into overdrive.

To head off such questions, Finney, the Georgia hospital administrator, went so far as to demonstrate her monitoring system to DeKalb employees “so it’s not some secret thing that IT does in a back room.” She says employees appreciated that the hospital was taking pains to secure patient info.

For now at least, the rise of compliance-watchdog software doesn’t appear to be provoking an outcry. It might be a sign of the times.

“Notions of security and compliance are, frankly, viewed differently than they were 10 years ago,” says Orchestria’s Miller. “We live in a time when compliance and security are critical disciplines, and people accept that. People’s expectations are different now. They want to be protected from themselves.”

< Prev | 1 | 2

Discuss Story On Newsvine
Rate Story:
View popularLowHigh
Email
Instant Message
Print