2

Where do organizations store their sensitive documents?

How do they protect them?

What are the pros and cons for each method? (If there are multiple common ones)

EDIT: I am more referring to applications that organizations use to save their sensitive documents such as HR/Finance/IP... or some method in which they are protecting it.

Roy Reznik
  • 123
  • 3

3 Answers3

2

You are talking about a Document Management System. Typically these systems allow users to save documents and delegate read/write access on a user or group level. They also allow for auditing of when users access documents. Some may also restrict editing and copying or even printing of a document (in addition to auditing all such actions).

There is simple to complicated. Some use a basic NAS with AD Group Policies. Others add a layer of encryption (Full Disk encryption, TrueCrypt, something else).

Finally you have the 'Enterprisey' systems. These have workflow and publishing management, complex ACLs and options on securing the documents and logging all activity.

Xeros sells a system called DocuShare (http://docushare.xerox.com/ though now marketed more as CMS) which I know several UN Organizations use. There is also KnowledgeTree (https://www.knowledgetree.com/)

These are just two of many. YMMV depending on actual business needs. Hope this helped.

CogitoErgoSum
  • 325
  • 1
  • 8
  • Thank you, I always got the feeling that these management systems are big, clumsy and not secure enough for sensitive organization data and I was wondering if organizations actually felt safe when storing their most sensitive data there. I always thought they might have an additional "safe" for the most sensitive data. but from what you're saying I get the feeling that ECM + Encryption is enough for them. – Roy Reznik Jun 28 '12 at 06:55
  • It most probably is. That being said in regards to DMS for securty is only as good as the weakest link aka human users. Once a user gets a document and spreads it that's it. Look at the Intel leaks of the US military to wikileaks. The amount of money they are pouring into document management is absurd. Most companies cannot afford it nor need it but even they got compromised...Some of it comes down to being rational and intelligent. Good luck! – CogitoErgoSum Jun 29 '12 at 06:06
1

What kind of organization and what kind of documents are you protecting? What kind of solution are thinking of in terms of scalability, easyness to use/understand/enforce ?

If you are referring to access control models, the Bell-LaPadula model focuses on confidentiality and access to classified information by ensuring:

  • no read up: from a given security level, one may not read at a higher level
  • no write down: from a given security level, one must not write at a lower security level

Another thing related are MACs (Mandatory Access Controls) If you would be interested in integrity of information, the Biba model is for that (no read down, no write up).

Or maybe you could just encrypt them:)

liviu
  • 153
  • 2
  • 7
  • Thanks. I was more referring to - are there any specific applications that people use? I know Cyber-Ark's Vault, but I'm guessing most of the companies don't have it. so where do they store their information? on file-system? maybe other applications? and regarding encryption - How do they encrypt it? in rest? in motion? who are the biggest players in this field? – Roy Reznik Jun 27 '12 at 17:06
0

I work at a large bank, we indeed do use Cyber-Ark, mostly for holding passwords though. We have an Entrust based PKI, and mostly use in-house applications which integrate with the PKI and some HSMs for protecting data. Some older applications use obfuscated symmetric keys generated by HSMs.

This is from the perspective of a developer, no idea where financial or HR information is stored.

Petey B
  • 607
  • 1
  • 6
  • 8