Document Protection for CFOs: Top Three Misconceptions that Jeopardize Corporate Security

WHITEPAPER Document Protection for CFOs: Top Three Misconceptions that Jeopardize Corporate Security Executive Summary » Critical corporate processes involve highly confidential, important documents that need to be safely accessed by a network of external partners, regulatory agencies, vendors and investors. Poor security measures based on a “traditional” view of data security have lead to high- profile, significant security breaches. The changing business climate demands more than simply improving the existing IT-based security structures: What’s needed is a shift in the way business users think about security. Putting confidential information outside the firewall is actually safer and more expedient for all parties involved. Fortunately, there are solutions today that understand this new paradigm and are providing new ways to conduct important business securely without being impeded by IT complexity. Whitepaper Document Protection for CFOs: Top Three Misconceptions that Jeopardize Corporate Security Introduction It’s no secret: As the business climate fluctuates, corporate activities increase in complexity, and the risk of intentional data breaches in the news: or unintentional breach of confidential information grows. A new Silicon Valley start-up recently Corporate governance, finance, accounting, strategic partner- raised about $30 million in three ship, legal and restructuring executives all work with sensitive rounds of venture funding after receiving a valuation of $150 million. documents that can be damaging if they fall into the wrong Unfortunately, the company’s VP of hands. The impact can range from a mildly embarrassing sales mistakenly leaked the company’s sales spreadsheet. In a matter of mistake to a fatal blow to careers or entire companies. hours, screenshots of the start-up’s sales figures were available to The most successful corporate executives operate within anyone and everyone on the web. large networks of suppliers, consultants, regulatory agencies, Or how about this recent news channel partners, industry groups and more. Each of these item: A former contract employee of a major US mortgage lender was external partners requires access to corporate documents, indicted in early 2009 for cyber which must be shared without jeopardizing sensitive information. intrusion after the discovery of a “logic bomb” set to destroy data Several common business practices are associated with high-risk on all 4,000 of the company’s security breaches: servers. Fortunately, the worm was discovered before it executed; • Board and executive management: Board members need to potential damage included possible loss of millions and a shutdown in collaborate on critical issues, without exposing themselves operations of at least a week. or their companies to risk. A highly competitive business environment demands swift decisions, so secure anywhere, anytime access to sensitive documents is a must. • Auditing, compliance and financial reporting: Companies compile financial information across multiple divisions, and collaborate with outside accounting firms and auditors on financial reporting. Security breaches arising from sharing documents with these external partners could prematurely disclose financial information, negatively impacting shareholder value. • Corporate finance: Banks and current or potential investors need access to some of a company’s most sensitive information—sales forecasts, pipelines, business plans, research data and cost information. These documents must be protected with the most stringent security measures available to prevent access by unauthorized individuals, and to restrict forwarding, saving or printing when appropriate. page 1 ( Document Protection for CFOs: Top Three Misconceptions that Jeopardize Corporate Security • Legal and M&A: In a corporate merger or acquisition, due diligence, negotiation and post-merger inte- gration must take place in a secure environment. Various participants need different levels of access to documents, and it may be necessary to grant only temporary access to time-sensitive documents. Additionally, any access or changes to data must be documented. • Corporate strategic initiatives: Corporate strategic activities such as a major restructuring or reduction in force are generally limited to a very small group of company executives case study: working in collaboration with outside parties such as Mergers and Acquisitions consultants and legal professionals. These small groups must be able to protect their strategic documents without challenge: granting access to the corporate IT staff or security providers A law firm was heading the sale of a large, well-known automotive during the protection process. company. In the due diligence process, they needed to broadcast Because of the sensitivity of the documents involved, many sensitive documents to a number of potential bidders. The challenge was companies still use non-electronic means of sharing data in to distribute the data in such a way these processes, resulting in high information-sharing costs, that recipients could not “keep” the data, to track downloads and gauge gross inefficiencies, the inability to share documents in parallel interest, and to follow up with more with multiple partners and increased exposure to risk. detailed documentation to qualified bidders only. The deal team at the firm wanted to self-manage the due The press offers a wealth of evidence that ensuring confiden- diligence process rather than rely on IT. tiality and control over business-sensitive data is no easy task. Why? Because business is changing in unforeseen ways, and solution: The firm deployed a secure deal sensitive documents are being shared in ways that corporate room, not just for the due diligence executives can no longer assume are protected by traditional process but for the entire lifecycle of the transaction. This included initial IT measures. strategy, gathering all confidential information quietly, highly controlled This white paper will discuss the enormous cost of data due diligence, negotiation, closing, breaches, the risks end users introduce through common and post-merger integration. The whole process was 100% secure, business practices and misconceptions that exacerbate totally controlled, easy to use, and the problem of protecting a company’s most important did not require any IT resources, thus expediting a major merger safely and and confidential information. It will look at traditional IT successfully. approaches and reveal why they are no longer adequate. It will suggest a change in how companies view data security, and explore new technologies that meet the needs of the new enterprise.