EVOLVING DMS SECURITY MODELS

Transcription

1 EVOLVING DMS SECURITY MODELS To Meet Client and Compliance Requirements #ILTACON #ILTA140

2 BEN VP of Stuff, Prosperoware Director of IT & Operations/Facilities, Bond Pearce (UK) CIO, Lathrop & Gage (USA) CIO, Ruden McClosky (USA) Director of IT, Los Angeles City Attorney Technology Consultant, Baker Robbins (now HBR) Legal Counsel, State of Illinois Clerk, U.S. District Court, Chicago

3 JOSEPH IERULLO Director, Enterprise Technology Osler, Hoskin & Harcourt LLP 6 offices: Toronto, Montreal, Ottawa, Calgary, Vancouver, New York; 1,300 Users (450 LPs) Previous roles include Chief Architect, Enterprise Architect in Technology and Consulting, Finance verticals Maintain one of the largest imanage DMS installations globally Users of imanage since 1998

4 LUTHER Information Technology Manager Miller & Martin PLLC 3 Offices: Chattanooga, Atlanta, Nashville; 250 users (140 lawyers) Also wear the hat of senior network engineer, chief system architect, storage admin, DBA, etc. Users of imanage since 2002

5 Optimistic Highest privilege level granted Least restrictive SECURITY MODELS Hybrid Pessimistic Optimistic model with caveat Deny takes precedence Lowest privilege level granted Most restrictive

6 Partners Matter HOW PERMISSIONS WORK Joe Optimistic Hybrid Pessimistic Ben Maria Luther Ben (Partner) Joe (Partner) *Assigned Permissions Partners = View Only Matter Team = Read/Write Maria (BOTH) Luther (Matter) *Assigned Restrictions Luther = Denied Access *The model chosen greatly effects access whenever there is a conflict.

7 DIFFERENCE IN PHILOSOPHY When performing a background check on someone, do you: a) Check the list and stop at the first OK result? OR b) Check the list and stop if you receive a FAIL result?

8 WHY THE INCREASED INTEREST? People belong to many, many, many groups within a Firm. A document has many, many, many conflicting access controls applied. Easy to inadvertently assign multiple permissions and grant too much access to someone. Difficult to manage ethical walls groups and keep documents secured and for the right audience with optimistic security.

9 PROS AND CONS Optimistic Hybrid Pessimistic Doesn t work in today s world. Use Hybrid or Pessimistic! Allows you to be an optimist without being a fool. Easy transition from Optimistic. Allows fine grained access control. Most highly secured systems follow this model. No Access effectively excludes an audience with certainty (blacklist screens). Allow certain users in a group full permissions for moving and maintaining folders Some people will still have contribution permissions that shouldn t. You get only what you are given. Assign view only and contribution roles with certainty. The most secure but most painful to achieve (if you aren t feeling any pain, you likely aren t secure enough!)

10 WHAT ARE THE DRIVERS FOR CHANGING?

11 Hacking is the new normal. It s a story of outsiders and insiders. 40m records stolen Cost of $66m 600 jobs lost Revenue loss > $1billion Estimated cost = $162m

12 LEGAL IS NOT IMMUNE TO THE THREAT

13 APRIL 2016 THE PANAMA PAPERS 11.5m docs 2.6TB data

14 Why are clients pushing you for security?

15 Firms: hard on the outside, soft on the inside

16 STORIES OF EVOLUTION

17 MILLER & MARTIN PLLC PLANNING THE SWITCH Answer the Why? Needed a way to exclude users from certain matters Nothing is ever simple Ridiculous ACL Inconsistent ACLs inconsistently applied Test, test, test Know what the impacts will be prior to the change

18 MILLER & MARTIN PLLC FLIPPING THE SWITCH Reindex the entire document collection Can take days or weeks Reorganize/fix bad ACLS

19 MILLER & MARTIN PLLC FEELING THE SWITCH Deal with the ongoing pain of Where s that document? Why can t I find it? Dual filing documents (once to a public folder, another to a private folder, which ACL wins?)

20 OSLER, HOSKIN & HARCOURT Identify potential issues ahead of time as much as possible Prepare the Service Desk with explanations of why we are changing. Empower individuals with the ability to act upon escalations Get a senior partner to champion initiative from ethics, conflicts, privacy etc.

21 OSLER, HOSKIN & HARCOURT Stand your ground % of all issues raised from users with permissions that they should not have had! Can t effectively implement ethical wall solution without abandoning optimistic security Bundling with another initiatives There will be some issues regardless of which model you choose The world is evolving towards a full Pessimistic model

22 CHALLENGES Pessimistic - Not how people work? Look at use cases, workflows, processes. What is impact? Buy-in; Who are champions? Establish best practices Support - what changes, what's required? How do you ease transition? Timing is something DMS s native work flow may need another layer (i.e. self-service module) KM versus security Google-like search in an enterprise is a lie.

23 WHAT OTHER SYSTEMS SHOULD ALSO CHANGE?

24 QUESTIONS?