What else is walking out the door?
Use Case: Clean Separation
Companies trust their employees and give them access to all types of information so they can effectively do
their work. Additionally, consultants, contractors and other temp workers are granted access to information to
complete their projects. What happens to this information once a project is complete? What happens when an
employee quits his or her job? Today, corporations simply must hope that critical business data is not leaving
their company to be used by their competitors or worse.
How is your confidential data leaving your company?
An employee knows in advance when he or she is going to give notice, but you don’t. Days or weeks before an
employee plans to resign, they could be making copies of information they think may be relevant at their next
job. Is your intellectual property walking out the door? Is your strategy against your top competitor fleeing the
company? Will your price list end up in the hands of your competitors? Today, you probably have no idea what
data is carried off by your departing employees.
The loss and possible exposure of information does not have to be due to malicious acts by people leaving the
company, it could be due to a friendly departure as well. Some companies allow their employees to access their
information from home computers. While working, they may have downloaded information to the local computer
to complete their work. Over a period of time, corporate information accumulates on his or her home computer.
Even with diligence, it is possible that all copies of corporate information will not be deleted from the home
computer when the person leaves the company. The last ingredient to exposure is for the home computer to be
disposed of, by giving it away or trading it in. Another alternative is for the home computer to be infected with a
virus or spyware that is uploading random files to the web. These events can occur with a large time delay – for
example one year after a person leaves the company – which leaves a mystery for the company as to how it
occurred.
Consultants and contractors get access to whatever data they need to accomplish their tasks. As their time is
expensive, many companies hastily provide permissions to these individuals so they can get up and running
quickly. Once the assignment is complete, the company is happy and the contractors or consultants move onto
the next company and project. Now, critical corporate data will be on a third-party laptop out of your control.
You must ensure that whatever level of safeguard you have in place for your employees is in place for your
contractors and consultants. Today, you don’t know how contractors or consultants are handling your
information, and through no fault of their own, your company could be exposed. Tools are needed that protect
the company and the consultant.
Avalere Information Assurance Manager
Avalere Information Assurance ManagerTM (IAMTM) provides complete visibility, protection and control of
distributed information without limiting accessibility or impacting end-user productivity. There are currently two
modules within Avalere Information Assurance Manager:
The Visibility and Protection Module
• Classify: Identify information by its business use—before you can control or protect information, you
need to know what you have.
• Protection: Use encryption to ensure your data at rest and data in flight is safe.
• Report: Catalog and audit information to know where the information is and how it’s being used.
Avalere Use Case: Clean Separation 1
The Automation and Control Module
• Control: Configure policies to support compliance initiatives and corporate regulations.
• Automation: Enforce policies automatically so employees can focus on their jobs—central
administration knows that Avalere IAM will take care of the rest.
• Report: Verify that polices are being enforced correctly and reconfigure policies if needed.
Wouldn’t it be great to have a clean separation?
Today, you do not know what information is escaping corporate control. But with Avalere IAM deployed, you
could run a report targeted to a user and see what documents were printed, saved to a USB device, or attached
to an email. When that person gives notice, you could review this report with the employee during an exit
interview, and then require them to produce this information or guarantee that it is destroyed.
For consulting companies or contractors, this peace of mind is an additional service that can be provided to
customers. Via an audit, they can clearly demonstrate that no critical or confidential information departs with a
contractor whose work is complete. Consultants and contractors providing this level of service will have a
distinct competitive advantage, making the companies they serve feel more comfortable with inviting them onto
their team.
On the following page is an excerpt of an Avalere Information Assurance Manager Clean Separation Report: it is
of an employee who has given notice and is now in the exit interview before leaving the company for the last
time. Here you can see the documents that have been copied, moved, renamed and created, and the activity is
somewhat questionable. The creation of a contacts list is something you would want to be aware of and handle
appropriately. This report was run for just 10 days, but it could show this activity for any time period you deem
suitable.
Avalere Use Case: Clean Separation 2
Asset Audit Report
Date Range: 11/26/06 through 12/5/06 Information Assurance
Machines: All Machines
Domains: All Domains
Users: jsarrey
Full Pathname: All Pathnames
List of Tags: All Tags
Generated: 12/5/2006 2:00:12PM
Event Types: All Events
Overview
Asset Audit Reports can reveal
what activities are taking place on
any device at any time. By running
these reports, administrators can
quickly assess where corporate
information is headed. When
ensuring a clean separation, these
Personal
Sales.doc findings are invaluable.
contractTemplate.xls
vacationlog.doc
customerDemo.ppt
S&WDemo.ppt
FactSheet_06.doc
This sample report shows the level
S&WContract.doc
FeatureSet_Q4.xls
of detail Avalere can provide when
Q4Forecast.jpg an employee leaves the company.
In this excerpt, administrators
have run a report based on the
recent activity (from 11/26/06 to
12/5/06) of an employee who is
Asset Audit Report going into their exit interview
(jsarrey).
contacts.xls
Asset: Event: User: Time:
contacts.xls Create Asset jsarrey 12/4/06 11:20 am
E:\personal\backups
acct_card_feb05.doc
Asset: Event: User: Time:
acct_card_feb05.doc Rename Asset jsarrey 11/27/06 1:16 pm
C:\accounts
acct_card_feb05.doc Copy Asset jsarrey 12/5/06 9:57 am
C:\accounts
price lists
Asset: Event: User: Time:
price lists Move Asset jsarrey 11/27/06 1:17 pm
E:\miscellaneous
quentinproposal.doc
Asset: Event: User: Time:
quentinproposal.doc Copy Asset jsarrey 11/28/06 3:18 pm
E:\personal\backups
Avalere Use Case: Clean Separation 3
About Avalere
Avalere provides solutions that help address key compliance and security initiatives by controlling and protecting
critical distributed information. The company's flagship product, Avalere Information Assurance ManagerTM,
identifies and catalogs information while automatically enforcing internal and external policies. It provides
continuous monitoring of information behavior and comprehensive reporting for audit and discovery. Avalere
ensures the proper handling of an organization’s sensitive distributed information, which helps senior executives
make intelligent decisions regarding information cost, risk, compliance and security.
All without changing the behavior of users, applications, or processes.
Avalere, Inc.
139 Newbury Street
Framingham, MA 01701
508-405-2203
info@avalere.com
Avalere Use Case: Clean Separation 4