Commentary--Hardly a week goes by without a report of confidential information leaking from a supposedly secure document. Breaches affecting both the public and private sectors are constantly making the news.
Consider some recent headlines:
. A "nonpartisan" Social Security document had edits from a (Republican) White House staffer before submittal. Democrats and unions cry foul.
. A mutual fund firm inadvertently disclosed confidential shareholder information in a PDF-formatted public filing. Shareholders are filing data privacy lawsuits.
. The Pentagon revealed classified information in a PDF (Portable Document Format) about an Italian secret service agent's death in Iraq. Italy disagreed and is threatening to leave Iraq.
. A document with a list of HIV patients was attached to a public health department e-mail. HIPAA enforcers are investigating the breach in personal data privacy and security.
All of these incidents underscore the common theme that electronic documents and their file formats are not secure. This insecurity comes in many forms: lack of restrictions on e-mail or printing; exposing attributes, such as track changes or server names; revealing privacy data, such as identities or financial records; converting formats between PDF and Office when attributes are both kept and lost.
And the risks are escalating. Documents that are revised, e-mailed and posted are both numerous and growing. Gartner and IDC Research estimate that more than 1.8 trillion business documents and 2.4 trillion e-mails are created annually. Estimates from various sources say 25 percent to 35 percent of all e-mails contain document attachments, meaning 500 billion documents will leave the organization perimeters each year.
According to an international study by research company Vanson Bourne, up to 75 percent of all corporate documents may contain legally sensitive information. However, less than 10 percent of the users are aware of the potential risks and liabilities of inadvertent disclosure of information through documents containing rogue information (hidden in document metadata). This is what I refer to as the Document Risk gap.
IT security has combated outside attacks for more than 10 years using antivirus software for PCs and networks and antispam and anti-spyware software for e-mail. Our security emphasis must now look inside-out. A recent projection by the Computer Security Institute and the FBI found that an insider attack against a large company would cause an average of $2.7 million in damages, compared with an average outsider attack that would cost an average of $57,000.
The widespread distribution of documents via e-mail, Web sites and portals is an excellent medium for communicating and collaborating with audiences in public and private sectors. Organizations must come to realize that a file format doesn't remove risky information leaks. It only masks them. File formats lull users and IT professionals into a false sense of security and unfairly puts individual reputations at risk. The only true way to stop this plague of document leaks is to govern with centralized policies that are transparent to people.
The only way to stop the document security leaks is to protect documents independent of file format. Modern security software exists today that does this by providing transparent, perimeter-level protection against inadvertent and malicious content exposures. Some of this software even alerts people before they make catastrophic mistakes, educating them about common practices that may lead to risky business.
The Pentagon leak put extreme strain on an already tenuous political situation as the U.S. continues to fight global sentiment in an attempt to hold together its military alliances. In addition, the U.S. and its taxpayers may see budget deficits escalate from both direct and indirect costs resulting from these kinds of leaks. And the White House leak may further delay "bipartisan" legislation at a time when the U.S. public ratings on the president and Congress are at historical lows.
Business documents are the lingua franca of commerce. Every day, sensitive information is leaked without our knowledge, and it is incumbent on us to act now, or answer to the consequences later. Business leaders must realize that while they won't necessarily make the headlines each time a document leaks sensitive data, they could lose a key partner, customer or lawsuit--or worse, their public image.