New World of Information Governance

The people won.

For many years, we used to talk about the information balancing dilemma.  On one side, organizations would like to assure themselves of complete risk elimination as it relates to how their employees handle information. Nothing good can come from employees having the ability to write something in public, right? It could easily result in a lawsuit, a damaging audit, or a security leak. The less people can share and communicate with the outside world, the better. If they have to post something on the outside, let’s make sure our Legal department checks it first!

The employees, on the other hand, want to use any tool that helps them get their job done. They are under constant pressure to do more with less and they are usually measured by objectives that rarely consider the constraints of information governance. They need to produce, perform, and deliver - and anything that prevents them from doing that is counter-productive. Not being able to freely share and communicate stands in the way of getting the job done. Filing records, assigning access privileges, classifying content assets - that’s all just a waste of time!

For years, one of the main value propositions of enterprise content management (ECM) has been helping organizations deal with this dilemma. ECM would offer productivity benefits in the form of search, well organized libraries, workflows, and collaboration while also ensuring a sufficient level of information governance with capabilities such as access control, records retention, authenticity and non-repudiation.

The success rate wasn’t that great, actually. Users typically had to be forced to use the information governance features and hence their compliance reliability was often dismal. Have you added metadata to any documents lately? Do you like filing records? Do you enjoy organizing your email into folders? Yeah, me neither…

At the same time, the restrictions imposed by security and governance requirements are usually seen as a software adoption hurdle. What do you mean I can’t invite my partners to this workspace? Why do I have to classify documents when saving them? What’s metadata, by the way? It was this constant tension between the people and the companies that left ECM in the middle.

Not anymore. Because, the people won.

It’s true. The groundswell of consumerization has swept across the enterprise and the scales have been tipped towards the users. They have clearly shown which tools they want to use - by flocking to the consumer tools and eventually bringing them into the enterprise, often while knowingly violating corporate policies and ignoring the rules of information governance. Yet denial is no longer an option for the organizations. You can’t hide behind corporate policies if nobody adheres to them. The users have won and organizations have had to change. And so does ECM.

As a result, enterprise content management is going through some profound changes. ECM depends on metadata and so far, the users were the primary source of that. Or at least they were supposed to be. But let’s face it, they won’t do it. Like it or not, that ship has sailed. In the new world of ECM, we can no longer rely on users. From now on, look to content analytics as the source of metadata.

Similarly, most information governance policies used to rely on users properly filing and classifying content assets. Yet again, they won’t do it. If you want the content classified - and you do want to have it classified, trust me - check out auto-classification technologies.

The same thing is true for security. The users will ignore it, not matter how much fear you instill in them. Sure, they will use strong passwords if you force them but when you think that they will be diligently managing access privileges for each document, forget it. If you want security,you need a system that will do it for them.

So, get ready for the new world of information governance. What you need is a content management system that to users looks just like the popular consumer tools such as Dropbox, Evernote or Google. Yet, it needs to be an ECM system that inherently and automatically takes care of user permissions, metadata generation, classification, and even workflows and business policies. That can only be accomplished by heavily leaning on content analytics, process analytics, auto-classification and other smart technologies. The race is on.

Chances are, you have an ECM system today that still relies on users doing the hard work. Or, your employees are using consumer tools without any notion of information governance, corporate data ownership, or data sovereignty. Or perhaps you don’t have an ECM system at all? Either way, you need to re-assess your requirements. If you are lucky, you already have a content management platform that allows you to add the “user-independent functionality”. If not, look for a system that will be able to evolve as the technologies mature. Because, guess what?

The people won.

Keeping the Bad Guys Out

This blog post has been written for the WIRED Innovation Insights blog where it was published on September 9, 2013. You can find the original post here.

Just as we thought the WikiLeaks problem had faded away, we got a little reminder recently through the Bradley Manning sentencing. As much as this issue is very polarizing and the public’s perception of Manning ranges from high treason to martyrdom, the fact remains that our information is not secure today.

What? The multi-billion dollar industry that produces all the security products has failed us? All those sophisticated encryption algorithms don’t protect our data? What about the firewalls, multi-factor authentication, VPN, and SSL that we have been deploying?

Sure, all those technologies are very powerful and they indeed do address some of the major information issues. Authentication ensures that the person accessing the information really is who he or she claims to be. Firewalls keep out everyone without authorization. Encryption tools such as VPN, SSL, or PGP prevent snooping on the data as it travels from system to system. All of this is great, but it has a major flaw!

The problem with most of our information security to date is that it has been designed to keep the bad actors out. When you keep the bad guys out, your information is safe. Right? Well, not exactly. As the WikiLeaks, and more recently, the Edward Snowden examples show, the critical information leaks can happen by the hand of the authorized personnel. The leaks occur by the people who have legitimate access to the information and who are not considered a security threat to the information that all these security measures are designed to protect.

This issue must be quite unsettling to any strategic CIO. They may not be telling their boss, but their data is only as secure as their employees can be trusted. On top of that, it’s not just the malicious information leaks that are a concern. Most information leaks happen through negligence, without any malicious intent. Have you ever sent an email accidentally to the wrong person? If you have (and let’s be honest, who hasn’t?), you were just lucky that the attachment didn’t contain any state secrets.

Such “authorized information leaks” become even more of an issue in the era of mobile devices and cloud based file sharing and synchronization. There is a plethora of services, such as Dropbox, Microsoft SkyDrive, and Google Drive, that make it very easy for people to share information across their accounts and devices -- corporate and privately owned. When the employees leave, they take those accounts with them -- together with all the confidential information. There may not be any malicious intend behind this but it is a worrisome information leak nevertheless.

So what can we do? Sure, we can intensify the background checks on our new hires, train employees, and test their loyalty through psychological tests but these methods are hardly practical outside the high security agencies. We can also employ some of the new breed of security solutions such as SIEM (security information and events management), which monitors the data traffic patterns and looks for anomalies to detect security breaches (albeit usually after the fact).

But we should also never underestimate the need to establish solid information governance across the organization -- a way to properly organize the information, to determine where the information should be stored and who has access to it. Information leaks are a much more frequent occurrence in a messy environment where nobody really knows what information they actually possess and where it lives.

Lastly, we should expect information security vendors to start focusing their innovation on areas beyond traditional perimeter security. Complete information security may not be a solved problem today, but let’s hope it won’t stay like that forever.

The Maslow's Hierarchy of a Strategic CIO

Not that long ago, IT departments were responsible mainly for making sure that knowledge workers got access to whatever information was available and for keeping the lights on. That latter responsibility was all consuming. PCs and enterprise systems were still going through their growing pains and varieties of system failures were all too common. The job of the chief information officer (CIO) was more about troubleshooting and firefighting than anything else. Information Technology (IT) was simply a cost center - just like travel or communication.

Well, things have changed. The systems we work with are, for the most part, reasonably reliable. We don't have to reboot our PCs twice a day just to flush out the memory leaks. 99.999% uptime is not that big of a differentiator for servers, routers, and switches anymore. Users don't call the help desk daily and access to information is not the challenge at hand. Today, we have information. We have a lot of information. In fact, we have way more information than we could ever consume.

Herein comes the change in the mission of IT departments. As organizations came to realize that information emerged as a key source of competitive advantage, they were increasingly looking at their IT departments as a key stakeholder in corporate strategy. All of the sudden, the CIOs got what they were always dreaming about. No longer the troubleshooter, no more the firefighter - the CIO is now the strategist.

What organizations need is the ability to make better decisions - using the right information. They need insight. They also need to apply information to create an impact on their business - to grow revenue, attract new customers, enter new markets, and generate innovation. And finally, they also need to drive productivity and continuously optimize their business processes.

Not to forget, enterprise information must also be secured. As it represents significant intellectual property, it has to be protected from intentional or unintentional misappropriation by internal or external actors. And let us not forget the need to address compliance and information governance requirements and to protect the company from legal exposure.

All these requirements reminded me of the Maslow's Hierarchy of Needs and so I have attempted to map the CIO needs into a similar model:

With all of this, the strategic CIOs have their hands full. They still need to keep the lights on but now, they are major stakeholders in defining corporate strategy. Combine that with all the new technology trends such as mobile devices, social software, and cloud computing and you get the picture of the magnitude of their challenge. But I guess that being strategic is way better than fighting fires all day long, right?