The Grim Realities of Content Security

My colleague Jarrod forwarded a link to a news story of how one person deliberately destroyed seven years' worth of corporate content/data with ease. Meanwhile, I had another tab open, regarding the White House's inability/refusal to archive e-mail messages, and had just finished reading about the loss of a laptop containing the personal details of 600,000 people - quite a busy day for data destruction.Fact is, few days pass now without news about another major breach of data privacy, illegal destruction of data, or the inability to find historic data. It's a stream of data points that will doubtless boost the revenues of Records Management, eDiscovery, ECM, Search and Archiving vendors across the globe. It will happen like this: These stories (along with many others) will become part and parcel of the vendors' sales pitch in 2008 and 2009 - a steady stream of ever more disturbing and frightening cases of data nightmares. After these vendor presentations you may feel a desperate need for those vendors' products, and that only with their help can you avoid certain disaster.

But the truth is, these stories (and nearly all the others I read) point to a problem for which no software vendor or consultant can truly offer a solution: employees and bosses can be incompetent, stupid and dishonest. At the end of the day, almost all major security breaches relating to content and data are due to such poor behavior, rather than the result of artful hackers working from secret government locations in China (or for that matter the bedrooms of teenage geeks in Ohio). Yes, in all three cases above, better governance and compliancy related software might have helped. The White House really should have an email archiving system in place (and I recommend our President read my November blog entry on Backup vs Archive). Laptops containing such incredibly sensitive data should have remote locks and controls. And if the architectural firm that had seven years' worth of records destroyed had proper archiving, the data would have been much easier to recover.

So maybe the lesson then is that you should expect people to behave incompetently, dishonestly and be downright stupid on occasions, and you should have safety nets in place for when this happens. But no software can prevent these incidents from happening in the first place.My colleague Jarrod forwarded a link to a news story of how one person deliberately destroyed seven years' worth of corporate content/data with ease. Meanwhile, I had another tab open regarding the White House's inability/refusal to archive email messages and had just finished reading about the loss of a laptop containing personal details on 600,000 people - quite a busy day for data destruction.