Forrester analysts Heidi Shey and John Kindervag recently released a Strategy Deep Dive report focused on a topic that is near and dear to us here at TITUS – Defining Your Data.

For as long as TITUS has been, well, TITUS, we have promoted our strong belief that in order for organizations to effectively protect their most sensitive information, they must first classify their data so that they truly know what information needs to be protected. In other words, organizations need to “define their data”.

In their report, Heidi Shey and John Kindervag outline the fact that, “understanding and knowing your data is the foundation for data security”. They go on to speak to how data classification does not have to be complicated, and that organizations should focus on classifying new data first, and address their legacy data down the road. They also emphasize that individuals throughout the organization – from data creators, to owners, users and auditors – should be involved in data classification.

Forrester speaks about how classification should encompass manual processes involving employees in addition to tools for automation and enforcement. Involving end users in data classification – sounds familiar…

You can learn more about Forrester’s position on Defining Your Data by downloading the report today.

Microsoft Office 2013 has been available to corporate customers for about 4 months, and it was released to the public in February of this year.  Office 2013 is available via its traditional packaging, and is now also available via the Office 365 subscriptions.   The Office 365 subscription allows customers to stream the Office 2013 install to their desktop.  In either case there are a number of major changes to Office in this release. 

Some of the changes in Office 2013 may involve a change in the user’s workflow.  For instance, in Outlook 2013 Microsoft has streamlined the process of shooting off a quick reply in Outlook 2013. Instead of clicking Reply to open up a new email, you can simply start typing and reply inline on the message itself.

In addition to user interface changes, Microsoft has made changes to the object model used to build applications on top of Office.  The most radical addition has been apps for Office, which brings the web to Office client applications by adding browser-like features. This shifts the development focus from a proprietary language (Microsoft Visual Basic for Applications) to web-based languages (HTML5, CSS, JavaScript, etc.) that enable organizations to use their web development skills for Office development.

Today TITUS is making available the Service Release for Office 2013 Compatibility for both the TITUS Message Classification and TITUS Classification for Office products.  These new releases fully support Office 2013.  If you want to use the TITUS Classification solutions with Office 2013 this is the release you should install.

Because of the changes Microsoft made to both the user interface and the object model, previous versions of TITUS Message Classification and TITUS Classification for Office including versions 3.3, 3.4 and 3.5 will not be supported for use with Office 2013.

The good news is that TITUS customers who have current maintenance agreements will automatically receive the Service Release for Office 2013 Compatibility at no cost.

March has been a very busy month for US export control reform. On March 8, President Obama signed a new Executive Order that updates delegated presidential authorities over the administration of certain export and import controls. The Administration also announced that it had notified Congress on March 7th about its proposed export control changes for aircraft and gas turbine engines. These changes are very important because they involve transferring certain parts and components from the ITAR-controlled United States Munitions List (USML) to the Commerce Control List (CCL). This transfer will lead to a more streamlined export control process, which will make it easier for companies to export items to US allies, helping to boost sales and increase US competitiveness.

While the changes are a significant step forward in export control reform, there will be many challenges in managing the transition. After a 30-day review period in Congress, the final rules will be published, to be followed by a 180-day transition period. In the meantime, aerospace and defense organizations need to consider how the changes impact their current export compliance plans, especially in the area of user education. Organizations will need to make some decisions about how to educate users in the proper classification of export-controlled items, given that some items will be on the USML and others on the CCL.

As a first step, you can review some of the recent articles about the latest export control reforms, including:

• President’s Export Control Reform Initiative on export.gov
• Aerospace Industries Association export control reform fact sheet
• SpacePolicyOnline.com article on export reform
• DefenseNews article on USML changes

We also encourage you to attend the webcast US Export Controls & Defense Trade Controls Program: What You Need to Know in 2013. This two-hour live webcast brings together export-control experts who will discuss all of the latest export control changes (including the USML reform), and will provide best practices for managing the risk. As one of the speakers at this event, I will be providing real-life examples of how TITUS customers use our solutions to identify and protect technical data as part of an export control compliance program. This webinar is normally $299 per person, but you can register for the deeply discounted rate of $25 courtesy of TITUS.

Organizations throughout the world have the need to comply with various regulations in order to ensure that their most sensitive information is protected. In Australia, for example, Australian government departments use TITUS classification solutions to meet the requirements of the Email Protective Marking Standard (EPMS). For a number of years, TITUS has also been assisting our UK government customers by helping them to comply with the Government Protective Marking Scheme (GPMS).

In the UK, government agencies and public sector organizations need to comply with Her Majesty’s Government (HMG) Security Policy Framework to protect their most important assets. In order to comply with this requirement, departments and agencies must adopt policies in accordance with the Government Protective Marking System, which is designed to help staff determine and indicate to others the levels of protection required to help prevent the compromise of information via protective markings to emails and documents.

The UK’s Government Protective Marking Scheme is being updated this year, but our UK Government customers can rest assured that TITUS Classification solutions will continue to support requirements to comply with the latest version of the GPMS.

The new GPMS scheme has been simplified with a new HMG Security Policy for Classifications that involves only three levels of classification, these being OFFICIAL, SECRET and TOP SECRET.  TITUS Message Classification provides support for this new GPMS scheme. TITUS Classification tools will apply the required protective markings to email and documents.

TITUS can help make the transition to the updated GPMS scheme seamless by providing:

• Full “out-of-the-box” support in TITUS Message Classification and TITUS Classification for Microsoft Office for the new standard
• Support for mapping of old markings to the new set of markings
• Special Help features that assist users to understand when to use the new OFFICIAL marking and how it relates to the older markings.
• Recommended product configurations to ensure compliance

Our solutions have been deployed to numerous UK Councils, and to more than 20 police forces throughout the United Kingdom, giving TITUS a great deal of experience in helping organizations comply with the GPMS standard. Organizations such as Fife Constabulary have utilized TITUS classification solutions to help them to comply with the scheme.  As the requirements are updated, we will continue to work closely with our customers, and support both new and older version of GPMS in order to ensure that organizations are fully able to comply with this standard both now and in the future.

Visit our website for more information on complying with Her Majesty’s Government (HMG) Government Protective Marking Scheme (GPMS). If you have a question about our support for the new and old standards, contact us directly at info@titus.com.

Back in August, the TITUS marketing team sat in a meeting and brainstormed for the name of our first information security conference.  With a list of names starting with every letter of the alphabet it was a very introspective exercise for our entire team. After multiple meetings and a few great debates, we came full circle and all agreed to the first conference name proposed…..FOUNDATIONS.

So why the name FOUNDATIONS? It seems that today’s world is anything but a FOUNDATION – everything is going to a cloud, databases are no longer structured, and information is becoming more and more fluid through social media collaboration. Being an information security professional, it is imperative that your strategy is not built on pillars of sand and you have the FOUNDATION in place to react to the next threat that comes your way. Data classification is at its tipping point and industry analysts agree that classification is the FOUNDATION to your information security strategy. Data classification gives information security organizations the tools they need to ensure the entire enterprise is involved with protecting their most critical information (IP, Health Records, etc.).

If you are a TITUS Customer, FOUNDATIONS will ensure you are getting the most out of your TITUS products and provide a platform for you to interact in a community with other TITUS customers. If you have never purchased a TITUS product, FOUNDATIONS will give you the chance to understand the business requirements your team needs to put in place a data classification strategy.

We look forward to hosting you in Ottawa in June!

Learn more at www.titus.com/foundations_13.

“Everything that happens once can never happen again. But everything that happens twice will surely happen a third time.”

That just about sums up our feelings as we head into our third year as a Silver Sponsor of the RSA Conference in San Francisco. Back in 2011…incredible debut for TITUS at the conference.  2012…wow, what an amazing week!   2013…only time will tell, but if the lead up to the show is any indication, we’re going to have a busy, fantastic, one-of-a-kind week in San Francisco!! 

This year, you will be able to find TITUS at the front of the room – just as you walk in the doors of the convention center at booth 1017. If you visited us last year, you’ll recall that we asked attendees to help us ‘Control the Data Chaos’ by entering our Crazy Chaos Cube.  This year, we’ve decided to double the fun, and will have not one, but TWO Crazy Chaos Cubes at our booth for visitors to experience. Try your luck and you may just walk away with one of the remote-control helicopters that we’ll be giving away every half hour.

Of course, outside of all of the prize-winning fun, visitors to TITUS booth 1017 will be able to learn about how TITUS solutions – such as TITUS Message Classification and TITUS Classification for Microsoft Office – can help your organization to empower end users to help secure sensitive information and help prevent data loss. We’ll also be showcasing the latest version of TITUS Classification for Desktop, which enables users, with just a simple click, to classify and encrypt any file on a Windows desktop, including Adobe PDF, videos, images, and CAD files, helping protect sensitive data, including intellectual property. And, you can learn how TITUS Metadata Security Claims Edition enhances SharePoint security by harnessing the power of user claims and document metadata, to ensure that the right people are accessing the right information.

If you’re visiting the conference on Wednesday, February 27 drop by the Expo Briefing Center at 4:20pm and listen to TITUS Chief Technology Officer Stephane Charbonneau’s presentation, “Constructing an Effective Content Protection Program.” Attendees will gain insight into how they can construct an effective information protection program within their own organizations – one that will help them to determine what information is most valuable and needs the most protection.

For more information about TITUS at RSA San Francisco 2013, visit www.titus.com/RSAC. See you in San Francisco!!

It’s no secret.  I dress up at work.  It is not required at my workplace, nor is it necessarily the culture.  It’s a personal choice.  I think it provides benefits for my work life, as well as my home life.  How does dressing up at work help in my personal life?  And what does this have to do with mobile email security?  Good questions.

We all know mobile devices are everywhere.  We all see the stats.  We all have one.  Most of us use our mobile devices for both personal and business endeavors.  For employees and managers alike, mobile computing is a welcome trend. They can check their email and conduct other business in any location. If they can combine work and personal information on their device, they only require a single device for all their needs.  This causes a serious security problem, especially for the most used app on any mobile device:  email.  Today’s smartphones make it difficult to draw the line between personal and business email, as both business and personal email (and their attachments) tend to live all in the same place, and without separation.  This is where the problem of protecting business information, all mixed together with personal information becomes very difficult.  With more and more users mixing business and personal data on their mobile devices, the risk of a data leak occurring from email increases significantly because:

• Mobile devices are often used in public environments, where users are more likely to get distracted. This increases the potential for mistakes and accidental emails.
• Mobile devices are easily lost, misplaced or stolen. How do we protect sensitive data on the missing device?
• Privacy/e-Discovery. How do organizations know what data is on the mobile device? How can this data be found for e-Discovery purposes? What right does the company have to data on the device, when business data is mixed with personal data?

What is the answer to mitigating this biggest mobile risk of email?  Dress up at work.

Not only does dressing up at work help me look more professional in the office and credible in front of customers, but it helps me separate my work life from my home life.  When I come home from work, I remove all my dress clothes, and with them go any thoughts and stresses from work.  I throw on my sweats and an old t-shirt and I proceed to roll around on the carpet with my 3 kids.  Dressing up at work helps me separate my business life from my personal life.

On my personal mobile device, I use separate email apps for my business and personal email.  This affords me many of the same benefits as dressing up at work.  By having 2 different paradigms for business and personal email, I can easily separate my work life from my home life.  I am more focused at work and at home.  But that’s not all this situation provides.  I work at TITUS, a leader in security and governance solutions, and as you can imagine, my new purpose-built email app for my business email provides our organization with multiple security benefits:

• Email does not traverse external international networks and service providers
• Secure container for work-related emails
• Small footprint application that ensures no data is kept on device
• The ability to view attachments without opening unsecure applications or downloading files to the device
• Alerts when emails containing sensitive data are about to be sent to personal email account addresses
• Does not rely on remote wipe for data security
• Reduces the risk of not finding data that is required for e-Discovery
• Compatible with and complementary to existing MDM solutions

We are pleased to announce our new secure email app: TITUS Mobile.  TITUS Mobile keeps employees personal and business email separate, helping organizations protect corporate email on mobile devices.  It is a container that allows users to securely view email and attachments on their mobile device, while not keeping information on the device. With an iPhone look and feel that users want, and no additional server or integration work required, not only is TITUS Mobile easy to adopt and deploy, it is MDM-friendly, and can be an integral part of any corporate mobile strategy.

…Oh and it can also help with work/life balance.

I will save you the time, the report from the Public Interest Declassification Board will not tell you if we have made alien contact, but, it does make recommendations on the use of Classification, how and why Declassification is important and that Technology will facilitate both.

It is important to remember that we live in an age of instant information and communications. Unable to remember who the first Archivist of the United States was? Just Google it! Why should I not be able to do the same for any Governmental document? The answer is simple. You may not have a need to know, the information is still classified, or it is stuck in the approximately 400 Million back log to be reviewed for declassification. This report outlines ways to address your right to know, the fact that it is still classified (possibly unnecessarily over classified) and how to remove that 400 Million back log.

This report is not the panacea for all that is possibly wrong with Intelligent and Military Classification doctrine. The Board heard from many witnesses spanning all stakeholders in Classification and Declassification of Intelligence and Military documents to bring together their recommendations. In my time at TITUS I have had the privilege to work and collaborate with some of the brightest minds in classification in the employ of the US Government and other Governments throughout the world, and they too would agree the system is not perfect. It is a Classification system based on keeping their Nations secrets safe and in turn their countries citizens. They are always actively looking for ways to improve the system and will look at suggestions to make things more efficient. They recognize that in a Digital Age the expectations on disclosures are different then when Satellites dropped film canisters to be analyzed and a file folder was Manila not an icon on your desktop. They want as much as anyone to streamline the process.

In reviewing the report, there are three main areas that are addressed:

The Classification System
The current system was established some 70 years ago, and in the time since has been updated in an ad hoc way. In the early “…1980s, an increasingly complex national security posture resulted in a sharp increase in compartmented and special access programs.” The result of this “…complexity makes integration and modernization more difficult and worsens over-classification”. The report then outlines six recommendations to improve and modernize the current Classification System. The recommendations focus around the move to a two tier Classification System and determination of Classification based on risk assessment on the “…level of harm anticipated in the event of unauthorized release.” As well, it is recommended that certain information that is “…information with short-lived sensitivity should be identified and segmented for automatic declassification without further review” and that a Safe Harbor clause should be introduced “…for classifiers who adhere to rigorous risk management practices and determine in good faith to classify information at a lower level or not at all”. The board also recommends that “The President should appoint a White House-led Security Classification Reform Steering Committee to oversee implementation of the Board’s recommendations to modernize the current system of classification and declassification.”

The Declassification System
Declassification is “used to remove restrictions on and grant public access to classified information that no longer requires safeguarding”. “Because agencies’ declassification guidelines and criteria are often outdated or difficult to understand, they can produce inconsistent declassification decisions and missed referrals to other agencies”. This will exacerbate “…the difficult task of reviewing the enormous volume of these so-called “born-digital” records as they become subject to automatic declassification after 25 years.” There is a pressing need to revamp the Declassification system as well in light of the historical importance of most classified information. Accordingly, “…“future historians may find that the paper records of early American history provide a more reliable historical account than the inchoate mass of digital communications of the current era”

One of the interesting ideas pushed is the historical importance of information in the classified files. We know that some classified information from as far back as May 1930 involved plans to Invade Canada could have been declassified as early as 1955. Imagine the ramifications that could have had on American-Canadian relations at the time? If this information was disclosed at that time, would then Prime Minister John Diefenbaker have as a constant Throne Speech theme of Canadian interests will be placed first with the United States? Would he have established NORAD, canceled the Avro Arrow, built the St. Lawrence Seaway and bought US manufactured Fighters? When it finally was declassified in 1995, it still caused controversy, but seen in modern eyes, it appeared antiquated and whimsical. In the 1950’s it could have impeded the increasing cooperation between Canada and the United States.

Using Technology to Aid Classification and Declassification
The previous two sections outline the issues with Classification and Declassification and what can be done to fix what is perceived as broken or ineffective. The Recommendations in this section points to the solution to the problem. That is the proper use and enablement of classification and secure collaboration technology to facilitate the protection of information and the reasonable disclosure of information after its efficacy is done. For example, one of the key recommendation points is to:
“Automate and streamline declassification and classification processes, and ensure integration with electronic records management systems”

The goals of TITUS software has been in these regards. TITUS Message Classification, TITUS Classification for Microsoft Office and TITUS Classification for Desktop provide automation in classification. TITUS allows for the creation of rich metadata that can provide the provenance and context to streamline the declassification. More importantly TITUS classification is done by guiding the classifier through the potential complexity of the metadata schema for classification. TITUS provides feature and functionality to facilitate recommended classification of an information object. The TITUS products provide a visual indication for human consumers of the information object, and in addition significant metadata is also added to the information object to facilitate electronic records management systems. TITUS provides solutions for SharePoint that will leverage the metadata of the information object with the need to know of the individual accessing the information. This automated policy based approach streamlines the records management requirement in this report.

Final Thoughts
The report provides strong guidance to both the US Government and to TITUS on what the challenges are today. For TITUS this report provides invaluable market needs and at the same time confirms for TITUS that the current product strategy being executed will meet the Classification needs of the US Military and Intelligence Community today and into the near future.

While the report didn’t disclose if alien contact had been made, it may provide the framework that at some time hopefully in the near future that information may be declassified!

On Tuesday we gave a joint presentation with McAfee and NATO called “NATO and TITUS – Intelligent Data Loss Prevention with Endpoint Classification”. There was a great turnout for the presentation with a full house of about 200 people in the room. John Tatman, Principal IA Engineer, NATO talked about how the joint TITUS McAfee solution is helping NATO protect its information. Also discussed was how the TITUS products now plug seamlessly into the McAfee EPO management environment. EPO can be used to deploy the TITUS classification tools, and can also be used to log and report on classification events within the enterprise. This combined TITUS McAfee reporting solution can give you an idea of how classification is being used within the enterprise, as well as policy violations such as trying to downgrade classifications, or send sensitive information outside the organization. For more information on this solution see our press release at http://www.titus.com/press/2012/NATO_TITUS_McAfee_Release.php

In their keynote this morning, McAfee talked about what they will be enabling in EPO V5. They demonstrated the concept of real time EPO in EPO 5.0. This real time concept allows administrators to query, in near natural language, what is happening in their environment. The answers don’t come from a compiled database of information, but rather from information collected in real time. One of the example queries was “Show me all running applications on my system”. This query can report on any rogue or unsupported applications being run in the system. Once you have this real-time information, you can use it to do real time risk mitigation. In the above example you could remove or prevent the non-approved applications.

Back to the sessions. Signing off for now.

They were one of our first customers. Their requirements are one of the reasons that TITUS began developing email classification security software. From our relationship with them, a better classification product was born.

The relationship between TITUS and our Australian customers, particularly those within the Australian federal government, is a long and positive one. If you look through TITUS archives, you will find that back in 2005, TITUS (then Titus Labs) announced a, ‘solution that meets all the mandatory requirements of the Australian government Email Marking Requirements’.  It was then that we began working closely with the Australian government to help them meet the requirements of the Email Protective Marking Standard (EPMS). Over the years, we have continued to work closely with our Australian government customers to ensure continued support, allowing them to meet the requirements for each subsequent version of the standard.

The Email Protective Marking Standard for the Australian Government formalizes the use of email classification by mandating the use and format of protective markings for all email messages exchanged within and between Australian Government agencies. Protective markings are used to convey the protection requirements for information contained in a message and use the classification system defined in the Australian Government Information Security Management Protocol.

The Australian Government Information Management Office (AGIMO) recently released version 2012.3 of its EPMS, and TITUS Message Classification for Microsoft Outlook and Outlook Web App (OWA) continues to provide full support for this latest version, while also continuing to maintain support for all previous versions.

TITUS Message Classification allows Australian government organizations to:

• Read and write protective markings compliant with the Australian Government’s 2012.3 Email Protective Marking Standard
• Seamlessly transition (gradually or immediately) from previous standards to the current v2012.3 standard
• Guide users through classification selections to make it easier to apply classifications
• Aid users to select appropriate classifications for their emails with built in help

One of the strengths of TITUS Message Classification is the ability for customers to easily customize classifications and markings for compliance according to their requirements. To assist Australian government customers with their need to comply with EPMS, TITUS has produced and included recommended product configurations. These configurations not only ensure support for the new standard, but they also provide customers with interoperability with the previous versions of the standard. This interoperability helps minimize disruption when migrating from older versions to the latest version of the standard. Guided classification support and tooltips help end users fully understand and get up and running with the new security classifications.

TITUS will continue to work closely with our Australian federal government customers and support both new and older version of EPMS in order to ensure that they are fully able to comply with this standard both now and in the future.

Visit our website for more information on complying with Email Protective Marking Standard (EPMS) version 2012.3. To receive the standard configurations produced for the Australian government, or if you have a question about our support for the new and old standards, contact us directly at info@titus.com.