Deploying an Information Sharing Solution that Promotes Cross-Enterprise Collaboration without Compromise

Transcription

1 Deploying an Information Sharing Solution that Promotes Cross-Enterprise Collaboration without Compromise October 2010 V I J A Y T A K A N T I V I C E P R E S I D E N T, S E C U R I T Y & C O L L A B O R A T I O N S O L U T I O N S

2 Cross-Enterprise Information Sharing the Challenge Outsourced manufacturing, coupled with partner-intensive programs and product development, is making secure information sharing increasingly complex. At the same time, competitive pressures are making better, faster, and cheaper execution a must. The result is the creation of global supply chain teams whose growing constituencies of partners, customers, and other third-parties must efficiently work together across corporate boundaries to achieve the desired business objectives. The cross-enterprise collaborative approach has enormous upside. Trading partner team members can focus on and leverage their specific areas of expertise, paving the way for optimal performance with respect to quality and cost considerations. Division of labor amongst the parties also encourages parallel development, tightening the critical path and thereby minimizing the overall schedule. Unfortunately, the approach also poses significant challenges for businesses. As the number of constituents rises, so does the urgency and importance of secure, timely information sharing. Companies are aware that in-person interactions are often impractical, costly, and time-consuming, and that hardcopy documentation exchange expends valuable resources and introduces delays. So, they look to electronic collaboration (e-collaboration) solutions be they unsecure or more sophisticated information exchange tools for relief. In fact, even as far back as 2007, a survey by Forrester Research, Enterprise and SMB Software, found that nearly 50 percent of businesses in North America and Europe viewed implementation of a collaboration strategy as a top priority. About Exostar Exostar powers secure business-to-business information sharing, collaboration and business process integration throughout the value chain. Exostar supports the complex trading needs of many of the world's largest companies in aerospace and defense, life sciences and other industries. Exostar s cloud-based identity assurance products and business applications reduce risk, improve agility and strengthen trading partner relationships and profitability for over 70,000 companies worldwide, including BAE Systems, The Boeing Company, Lockheed Martin Corp., Raytheon Co., and Rolls-Royce. For more information, please visit. Overcoming the Challenge The key to the successful definition and execution of a cross-enterprise collaborative strategy is security. The risks and impacts associated with unauthorized exchange of business intelligence can undermine the effectiveness of the global supply chain. With comprehensive security functionality, risks can be mitigated and businesses can realize significant benefits, including: Intellectual Property Protection Keep sensitive corporate information from falling into the hands of individuals and partners who don t have a need-to-know. Compliance Ensure that regulations (government- or industry-issued) and standards, as well as internal controls and corporate policies, are adhered to throughout the program or project lifecycle. Audit and Remediation Track the activities of all team members and their personnel to identify unwarranted actions and prevent them from recurring. Comprehensive security means not only controlling access to the collaborative community, but also protecting information once access has been granted. The following capabilities are essential components of any solution if it is to address the risks of cross-enterprise information sharing: An identity management framework that is based on a federation model, to enable strong assurance of electronic identities of people who access the information. Enablement of all trading partners, complete with all appropriate training, 1

3 to create a community that operates efficiently. End-to-end data encryption, to protect information not only when it is at rest, but also when it is in transit between parties. Companies have recognized that employers (managers with authority) are in the best position to vouch for the identities of their employees and to define the information access and sharing privileges they should be granted. Identity federation is the set of tools, policies, and trust mechanisms that allow information owners to share documents and data with their partners, provided those partners assume responsibility for verifying the identities of their employees. In this scenario, any change in employee status can be rapidly conveyed to the information owner, mitigating risk and minimizing the cost associated with maintaining trading partner identities. As new trading partners or individuals are added to the cross-enterprise community, they must be on-boarded before they can participate in program or project execution. While identity federation and on-boarding limit unauthorized access to the collaborative workspace, additional measures must be taken to protect the confidentiality of sensitive information. Encryption at rest and in motion delivers the confidentiality and integrity needed for documents and data stored in repositories or being transmitted between team members ensuring that intellectual property is protected. Ultimately, what s needed in today s global supply chain environment is a solution that delivers the advantages of cross-enterprise information sharing, while simultaneously ensuring comprehensive security requirements essential to unlocking those benefits are in place. Information Sharing Solution Alternatives About the Author Vijay Takanti is Vice President of Security and Collaboration Solutions at Exostar. In this role, he is responsible for the strategy and product road map, design, development and customer delivery of this suite of cloud-based service offerings. Since joining Exostar in 2004, Vijay has been the linchpin in the growth of this increasingly important business area for supply chain management. Vijay s career spans nearly 25 years, with an emphasis on electronic data processing, application design and development, and information security solutions. He also is recognized as an authority on the emerging and evolving technologies related to electronic signatures and digital identity management. Vijay can be reached at Vijay.Takanti@exostar.com. The very factors that spur the development of cross-enterprise teams outsourced manufacturing, distributed operations, growth through acquisitions and a global trading partner base also tend to drive companies toward independent technology solution deployments that are targeted at individual business unit requirements. In some cases, companies haven t yet made the move to e-collaboration systems to address the information sharing challenge. These companies continue to lean on more traditional forms of information distribution by shipping documents out to all of their partners, whether on paper, DVD storage, or other media. Unfortunately, these alternatives continue to expose their adopters to data leakage, document versioning, and document access control and compliance risks. Other firms have elected to extend existing internally-focused information sharing solutions to support their external partners. This option has led to scenarios of partner companies accessing information that has nothing to do with their current project activities a substantial breach of intellectual property. Re-designing and then re-configuring legacy systems to support information exchange outside of enterprise boundaries is neither easy nor inexpensive. At the end of the day, this alternative often leads to deployment of new externally-facing copies of these legacy internal systems, creating unnecessary complexity and endangering the ability to distinguish between internal and external processes and data controls. Today s e-collaboration offerings are designed to address these shortcomings, enabling participants to work together using electronic technologies such as the Internet, video conferencing, and wireless devices. Many companies are opting for commercial off-the-shelf e-collaboration tools specifically created to facilitate 2

4 information exchange. But beware, because all e-collaboration solutions are not up to the task. It s important to remember that companies that are deploying cross-enterprise information sharing solutions also must account for two primary requirements in addition to collaboration: 1. They must be able to control who is accessing their data to address the risk of data loss or compromise. 2. They need an efficient, scalable solution so they can control the total cost of ownership and support their communities as they continue to expand. The ideal answer for these companies is a single technology solution that can meet the multitude of requirements stemming from various business unit stakeholders, while also ensuring separation and control of data. Selecting an e- collaboration solution with the information sharing intelligence and security functionality that supports identity and access management standards, data protection, and regulatory compliance, while still promoting process efficiency, is the objective. A list of the highest priority success criteria to guide making the right choice follows in Table 1. Function Assurance of Identity Authorization Framework Process Enablement Compliance Enablement Data Protection Flexibility Success Criteria Solutions should include robust identity management capabilities that promote adherence to industry standards and government regulations. For example, FIPS 201 and NIST are important standards for aerospace and defense companies. Solutions should provide configurable access controls that allow the data owners or administrators to designate access privileges for each individual in all organizations in the community. Solutions should be selected that are flexible enough to allow for the enablement/automation of specific business processes across multiple partners. Solutions should deliver transaction monitoring so that compliance reporting can be provided with minimal overhead. Policy enablement within the solution will help to minimize the risk of non-compliance. Solutions should offer data protection capabilities that match the varying risk profiles associated with the sharing of data. For instance, company announcements and news likely can be made available to everyone, while intellectual property and government regulated data almost certainly should be protected with user access controls and data encryption. Securing the data throughout its life in the system is integral to meeting overall data protection standards. The risk of outside attacks gaining access to system infrastructure can be further mitigated by at rest data encryption. Solutions should provide a reasonable level of configurability to ensure that the requirements of multiple stakeholders are addressed within a single system deployment. Table 1- Information Sharing Solution Success Criteria 3

5 In addition to functionality, one critical element that must be factored into the solution selection process is the licensing and service delivery approach. Some products are available through a traditional licensed software model, while others are offered via a cloud-based platform. In the traditional on-premise deployment, companies face significant hurdles with regard to: Federating between trading partners to give access to the e-collaboration solution and the information it allows to be exchanged; Controlling in-house deployments for consistent configuration amongst peer solutions; and Keeping costs from escalating as siloed deployments surface with increased frequency. Unlike licensed software implementations, the cloud-based methodology offers the strong potential for the unification of distributed solution instances, setting the stage for centralization, consistency, and flexibility. Sharing through the Cloud With cloud-based platforms, many of the thorniest problems facing crossenterprise trading partner teams attempting to collaborate in a geographically distributed environment can be mitigated by offloading responsibility to the firm hosting the solution. For example, company and user on-boarding services can be executed by experienced personnel of the hosting firm to efficiently and seamlessly incorporate new users from all constituencies, regardless of volume. Similarly, the hosting firm can oversee external trading partner identity management functionality, ensuring that once users are properly authenticated, they can access only the documents and data to which they are entitled. Access permissions are assigned by qualified administrators of the participating organizations, allowing the roles and projects to be managed in line with changing business requirements. What the Industry is Saying Many of our projects are collaborative. We need a cost effective and secure platform to share information amongst colleagues, partners, customers and suppliers around the globe and to meet export control requirements. In recent years, we have involved 8000 people across 34 countries in our collaborative projects using Exostar s ForumPass service offering. With ForumPass, there is no complicated infrastructure to invest in, and in most cases, no training necessary, so team members can collaborate in a secure environment from almost anywhere that they can gain Internet access. - Richard Harris, Director of Information Management & Infrastructure Programmes at Rolls-Royce The cloud-based model offers a number of other advantages over its licensed counterpart. Companies no longer have to incur the capital investment of product purchase, only to be followed by additional monetary and time investments in solution implementation and integration. With the hosted service offerings, companies only buy what they need, when they need it, and the firm hosting the solution can fulfill all required implementation and configuration tasks. Likewise, the maintenance and support burden is shifted to the solution s host, as is onboarding for the user community. One of the more significant benefits of adopting the cloud-based approach is performance. Hosting companies are responsible for solution availability, response time, physical and virtual security, and scalability, among other metrics that often are guaranteed through published service level agreements. To deliver on the promise and to keep pace with escalating user demands, the solution s host also takes on the time and cost associated with functional and performance upgrades. By opting for the cloud over traditional licensed software solutions, companies can minimize their capital expenditures and time-to-deployment, while simultaneously focusing their IT resources where they are most needed. Collaboration without Compromise in any Environment 4

6 Regardless of the stage at which companies find themselves in deploying an information sharing strategy, or the number and location of trading partners that comprise the cross-enterprise program, project, or product development team, effective collaboration amongst all parties is essential to success. Without it, delivery schedules, cost, and quality are all at risk. That said, unrestrained and unconstrained information sharing presents a greater risk, with documents, data, corporate knowledge, and other forms of intellectual property subject to loss and unauthorized exposure. Government regulations, corporate policies, and independent industry standards collectively fuel the security requirements that counteract the risks of sensitive information falling into the wrong hands, but only if compliance with these tenets is achieved. Today s cloud-based e-collaboration solutions offer the potential to finally enable businesses to readily exchange sensitive information with trading partners around the globe no matter the size of the partner or the partner community with peace of mind. The key is to pick the right solution one that meets the information sharing success criteria described in Table 1 and highlighted again in Table 2: Function Assurance of Identity Authorization Framework Process Enablement Compliance Enablement Data Protection Flexibility Solution Success Table 2 - Information Sharing Solution Success Criteria Summary With the right solution, information is protected, policy mandates are met, and all transactions amongst participants are audited for complete traceability. Most importantly, the cross-enterprise collaboration that has become an integral component of business operations can occur with compliance and without the threat of compromise. About Exostar s ForumPass ForumPass is a cloud-based service offering that ensures secure project collaboration amongst participants operating within or across corporate boundaries. It is designed with a federated environment that offers controlled, single sign-on access with three levels of increasingly stringent security profiles to ensure all documents and data are protected from unauthorized intrusion. The solution promotes immediate and ongoing productivity with its QuickStart package and workflow templates. ForumPass users benefit from a unique MyWorkspace feature that further enhances productivity by consolidating information across all of their projects on a single display. And ForumPass has been designed to control and segment information so cross-enterprise collaboration can be achieved through a single software instance hosted at Exostar s facilities to deliver unparalleled value. ForumPass enables greater control over project-oriented work throughout the supply chain, facilitating better management of costs, deadlines, expectations and results. Exostar, LLC Dulles Technology Dr., Suite 200 Herndon, VA USA Phone: Fax: