Information Governance: How to Prevent Uncontrolled or Unforeseen Spending

Transcription

1 Information Governance: How to Prevent Uncontrolled or Unforeseen Spending Investing in smarter information management is the key to governing internal Big Data at a small cost Governance Wild West More information to manage means bigger challenges. CIOs, legal and compliance officers, and lines-of-business leaders must discard the disorganized practice of independent management of business data silos, and strategically focus on information growth, especially for unstructured data, notes Gartner, Inc. in Use These Unstructured Data Management Best Practices to Manage Based on the Time Value of Data, Sheila Childs, Alan Dayley, November INTRODUCTION Organizations today are faced with a myriad of challenges, risks and threats related to the data they are storing. Such costly vulnerabilities are magnified for organizations that are heavily regulated or litigation-prone, particularly when looming audits and investigations so often require large amounts of electronically stored information to be extracted, analyzed and reviewed. Although it has become critical for many organizations to proactively invest in Information governance products, available technologies have not always been practical or affordable. 1

2 MODERN-DAY CHALLENGES As today s Information Age continues to evolve at the speed of thought, a proactive focus on information governance is not just for organizations saddled with compliance and ediscovery. Across a variety of industries, more and more CIOs are looking for ways to reduce their storage footprint. Organizations are even starting to create dedicated information governance Director and Chief Data/Digital Office positions to address what is becoming a substantial commitment. Without a doubt, the financial impact of storing and protecting large volumes of data is increasingly becoming a top-level concern and bottom-line priority. At the same time, internal legal departments are shifting their stances on data retention strategies. For the past decade, the prevailing approach to data retention has been to keep everything forever. General Counsels are now realizing that hoarding data beyond its usefulness and required retention period is not only a storage cost issue, but also a major risk and cost issue. With the high cost to review data in an ediscovery process, along with the unknown risks lurking in old data, in-house legal teams have become more motivated to revise old policies in support of regular storage housekeeping. In 2012, the RAND Institute for Civil Justice published findings on their research to understand litigant expenditures in ediscovery. They reported that the total cost to review a gigabyte of data in an ediscovery process was $18,000. On the high end, one company had to pay $358,000 for each gigabyte of data reviewed. This is just one example of how organizations can suffer uncontrolled spending from their data. The referenced RAND document can be found here: 08.html#abstract Yet another challenge is that those in charge of security and compliance also have an interest in tightening up policies and practices around data within an organization. These stakeholders are concerned with what types of data the organization is storing and who has access to what. Although there is rarely a good handle on understanding stored data to this extent, it is a gap that more and more organizations are equipping themselves to take on. But not at any cost. CHANGING DYNAMICS OF THE INFORMATION STORAGE LANDSCAPE The technology landscape for business is seeing fundamental shifts. With the increased reliance on cloud storage and the average user accessing multiple devices, the information storage landscape is 2

3 expanding exponentially to keep up with demand. The average organization must now contend with large volumes of diverse data that is being dispersed across on-premise and cloud-based repositories. These shifts are resulting in the following changing dynamics within today s organizations:» IT teams are managing larger and larger portions of data on-premise and in the cloud;» More and more, organizations are dialing down their use of legacy information silos like 1 st and 2 nd generation archiving approaches and opting to manage the data in-place;» Users expect easier collaboration across multiple devices. To prevent data from proliferating outside an organization s control, IT is adopting enterprise file synchronization/sharing solutions; Dark Data Defined: The information assets generated through regular business activities that organizations retain, but mostly overlook to manage or use for other purposes.» In-house legal teams want to reduce ediscovery spending and realize the best way to achieve this is by removing junk data and by being more precise about the data that gets preserved and ultimately extracted from the live environment, thus requiring confrontation of dark data;» As the traditional focus on securing the perimeter fades, security and compliance teams are forced outside the perimeter and now have to think about data proliferation/spillage, leastprivileged access, awareness of sensitive data, and adoption of metadata-based access controls; and,» In order to have policies that work, information governance stakeholders and policy experts are looking to maintain a better awareness and insights into their organization s overall data assets. Information management requirements have indeed changed. Organizations are progressively revisiting their overall information management strategy as well as the viability of their legacy technology investments as they settle into this new data landscape. IT, legal and security teams need to make sure this new landscape is supported without a loss of visibility or control over the data; otherwise, the organization is severely at risk. To be successful, the tools and approaches used to analyze, control and protect data must be applied in a manner that is well-aligned with the new data landscape. This requires a focus on finding smarter solutions that are less complex, less costly and far more responsive to modern-day, internal Big Data storage needs. 3

4 OF STRATEGIC IMPORTANCE: KNOW YOUR DATA Most organizations don't implement data content/information governance initiatives because they think it will be hard to understand the data. notes Gartner, Inc. in Best Practices for Storage Administrators: Staying Relevant in an Information-Centric Data Center, Sheila Childs, Alan Dayley, March Despite investing in search, classification, archiving and ediscovery software, organizations continue to experience data management and governance challenges. At the root of the problem: organizations lack a comprehensive, actionable understanding of their information. In other words, they do not have an always-on intelligence over what they are storing, an understanding of who has access to what, and an awareness of the status of their most important or sensitive data. As a result, policies are not adequately defined; information is over-retained and becomes cluttered. This has the result of more money than is necessary being spent on storage, ediscovery and security. In order for information governance to be successful in an organization, IT, security and information governance leaders need to easily and quickly understand the holistic picture of unstructured data for a variety of circumstances both for regular operations as well as unplanned circumstances like audits or litigation. Most enterprises do not have a comprehensive, actionable understanding of the unstructured data held in data stores such as Windows and Unix file shares, and therefore cannot ensure adequate security. This is becoming a particularly serious problem because auditors are increasingly shifting their focus to the security of such data, in part because the security posture of relational databases has improved. notes Gartner, Inc. in Don t Make the Mistake of Assuming Your Unstructured Data is Secure, Jeffrey Wheatman, June The lack of an actionable understanding of stored data is not just true for file systems, but it is also true for other mega-repositories of enterprise data such as: Microsoft SharePoint, Exchange Server mailboxes and public folders, Microsoft Office 365, enterprise file sharing and virtual storage repositories. What s common amongst them all is this: they are primary storage repositories of valuable, sensitive, dark and junk information in the form of unstructured data. Managing the critical, sensitive and valuable data apart from all the rest is a challenge. Organizations that are successful with their information governance will have figured out how to uniformly manage and govern these data sources in an intelligent and defensible manner so that the value and risk data can be handled more prudently something that won t be achieved using tools from last decade s data management strategies. 4

5 UNDERSTANDING THE COMPETENCY GAP As we consider the concept of an organization maintaining an actionable understanding of its data, the following nexus of forces should be considered: Constraints of existing information management building blocks Budget sensitivity and availability of resources The new data landscape Internal and external pressures that demand better information governance IT, legal and security teams typically maintain little awareness of their unstructured data s volume, composition, risk and business value. This includes having a lack of actionable intelligence over things like: data access and ownership, storage, content and metadata. Storage teams should proactively create views into metadata and content, and work with all business units to create policies and plans for the data based on this information. notes Gartner, Inc. in Best Practices for Storage Administrators: Staying Relevant in an Information-Centric Data Center, Sheila Childs, Alan Dayley, March While enterprise search, classification, archiving and ediscovery products are great building blocks that can help an organization identify, tag, preserve and review data, they do not individually or collectively 5

6 provide an efficient, holistic and ongoing picture of the data situation and activity inside key applications. What is needed is a modern-day, intelligent solution one that provides ongoing access to a clear and accurate bigger picture and bridges the gaps between the various priorities of information governance, downstream life cycle management, risk management, as well as budgetary planning and control. RISE OF THE INFORMATION SERVER How does an organization effectively achieve an actionable understanding of hundreds of terabytes or petabytes of data? With data stored in a variety of places, in a multitude of different applications, and sometimes mixed between on-premise and the cloud, it might at first seem far-fetched to expect a unified understanding and control panel for large, distributed enterprise data repositories. Fortunately, there is a next-generation solution entering the market that combines intelligence and controls to deliver an ongoing, actionable understanding over an ever-increasing amount of internal enterprise data and it can do so in comprehensive, non-invasive and inexpensive ways. Leveraging concepts from Big Data, an information server becomes the fabric by which an organization efficiently and defensibly understands and governs data. Like many existing technologies, an information server performs a routine crawl of unstructured data stores. Whereas traditional information management products crawl for one specific action to be performed, the information server crawls efficiently to maintain an interactive, actionable inventory of all data that is then leveraged for ad hoc analysis, audit and a powerful rules engine that drives precision automation of various information governance tasks like preservation, alerts and defensible deletion, to name a few. This solution is distinctly different from traditional enterprise information management products because it efficiently interacts with data at its source in a completely transparent manner instead of moving or taking ownership of the data. A more intelligent information server completely avoids vendor lock-in and is purely agentless. Perhaps most importantly, given the new data landscape, an intelligent information server is complementary to the existing investment in the native applications and repositories of the data because it federates through approved APIs and leverages existing functionality for things like keyword search. Data can reside where users need to interact with it and organizations get the visibility and control that is needed data does not have to be moved, re-indexed and exposed through an otherwise cumbersome and risky client mechanism. 6

7 As more and more data resides in the cloud, and collaboration applications become more scalable along with the addition of their own in-place archiving and legal hold features, an intelligent information server highly complements the future direction of an organization s information storage landscape. MORE INTELLIGENCE LEADS TO BETTER GOVERNANCE In addition to an actionable understanding of live data, an intelligent information server enables better management and governance actions to be executed in a precise and defensible manner. Standing policies can be automated across data stores with efficient tracking and measurement. It s that simple: with a smarter information server capability, an organization can successfully implement smarter information governance. Following are some of the common use case areas where an intelligent information server offers greater value and more powerful capabilities:» Storage management: 1) Fast identification of excess or stale data, 2) Rules-based data migrations between on-premise and cloud-based data stores, and 3) Storage reduction through defensible deletion;» ediscovery: 1) Early data assessment, 2) Custodian data maps, 3) Federated search, 4) Dynamic, automated preservation and collection;» Security: 1) Identity and access governance (entitlements analysis and permissions management), 2) Audit of data classifications and dynamic access control policies, 3) Tracking of sensitive data assets or locations. Gartner considers FA [File Analysis] to be a high-impact technology, and estimates that it will take two to five years before it reaches mainstream adoption. Adoption rates will differ according to use cases. FA for storage management purposes, namely for migrations or technology refreshes, may evolve more quickly as organizations view massive amounts of data stored on file shares as cumbersome to move in totality. notes Gartner, Inc. in Innovation Insight: File Analysis Innovation Delivers an Understanding of Unstructured Dark Data, Alan Dayley, March KEY CONSIDERATIONS The following is a list of key requirements to consider when looking at an intelligent information server technology one that is specifically designed to achieve an actionable understanding of unstructured data: 7

8 » Big Data foundation Regardless if there is great variety in the data or if the data is widely dispersed (i.e. across multiple servers, data centers or a combination of on-premise and in the cloud applications), the intelligent information server should be able to scale horizontally and vertically while maintaining a central point for insights and policy controls.» Agentless The approach for all interactions with target data sources should not require you to install any software on production systems. Many governance technologies are designed exclusively for an agent-based approach. Agents are really only necessary if your needs stem from extreme security or compliance requirements, in which case a Data Leak Protection product is likely more appropriate (real-time content analysis and activity blocking).» Federated search The intelligent information server should not require full-text indexing of your data when it is already indexed by the source application. Instead, the existing full-text index should be leveraged and the results merged with results from other search providers, along with intersection of additional metadata-based filter criteria.» Flexible metadata The intelligent information server should be able to easily leverage any item-level metadata for insights, tracking and rules-based automation. As well, it should be able to leverage identity attributes from Active Directory for interrogating unstructured data and for rules.» Defensible The intelligent information server should facilitate the documentation of compliance for sensitive actions such as defensible deletion or ediscovery collection through an audit trail, along with areas to easily capture decision logic and activities.» Multiple actions The solution should have interactive and actionable intelligence. The following should also be available: a comprehensive rules engine with an optional built-in workflow as well as transparent rules automation capabilities for actions like migration, alerts, deletion, collection, production, etc. CONCLUSION Organizations that are motivated to reduce risks, threats and uncontrolled costs associated with their data recognize the need for better data visibility and intelligence. They are taking an interest in finding more effective information governance solutions because doing so will benefit multiple key areas, including:» Tangible savings from a defensible reduction in storage costs i.e. identification of junk or legacy data and either disposing of it or moving it to cheaper (possibly cloud) storage;» Improved governance from setting better policies;» Improved security from visibility and intelligence on important and sensitive data assets; 8

9 » Improved compliance from an ability to routinely self-audit data classifications, storage, item and location-level entitlements and permissions with little effort;» Reduced risk and spending compared with earlier ediscovery tools that lack capabilities for identifying, preserving and collecting data from the active environment; and,» Improved business productivity from a reduction of data clutter. Today s bleeding edge reality is that a next-generation solution a more intelligent information server is now on the market, it s affordable and it works. About Acaveo Acaveo develops transformational information governance software that delivers constant insight and precision controls for large, diverse volumes of live, unstructured data dispersed across servers, data centers and the cloud. Acaveo s simple yet powerful controls empower IT, Legal and Compliance teams to easily analyze their data, defensibly reduce their storage footprint, streamline ediscovery and govern enterprise data in the wild to improve compliance and reduce spending. Contact Acaveo today for a personalized demo or free trial access to Smart Information Server. Acaveo Inc. World Exchange Plaza 45 O Connor St., Suite 1150 Ottawa, ON K1P 1A4 Canada Tel Fax sales@acaveo.com website : 9 Copyright 2013, Acaveo All rights reserved. Acaveo and Smart Information Server are trademarks of Acaveo Inc. All other brand or product names are trademarks or registered trademarks of their respective holders.