Pit Falls in Data Mapping and Relevant Information Collection

With the growth in the usage computers and content creation tools, the volume of electronically stored information has outstripped corporate IT administrator’s ability to keep up. Keeping all information electronically generated materials is no longer viable from a cost perspective, as well as a litigation risk perspective. Many corporations have instituted electronic information policies which delete documents and emails after a specific period of time, e.g. three months to six months after creation. However, many employees hoard information and have found way around the information management policies, which increase litigation risk exposure for corporations.

How do employees get around the IT enforcement policies?

1. Rename Exchange Archive PST to another extension – most enforcement software does not cross check the content of a file with the extension. Employees have learned to create an archive of their email on a regular basis and simply rename the AAA.pst to AAA.doc to circumvent the email enforcement policy. Make sure that the eDiscovery software can not only find documents, but verify that the document and the document type are not in conflict to find all relevant information on the network.

2. Save PSTs to USB thumb or harddrive – If the data is not on a company share or computer, the enforcement policy is circumvented. However, opposing counsel can depose senior officers and uncover “personal” copies of company information for discovery purposes.


3. Non-IT storage – With strict IT enforcement policies, some corporate divisions have deployed a “divisional” storage server which is outside the knowledge and purview of corporate IT. Although storing electronic information can be useful, it poses a significant litigation exposure risk. Defense and Opposing counsel need to ensure a complete organizational Data Map has been created that has searched the network for “Rogue Storage Sites” to fully comply with FRCP. Make sure that the eDiscovery software can identify all informational sources on the network….otherwise the Organizational Data Map is worthless.

With eDiscovery cost being reduced with automated software tools, corporations have the ability to deploy systems to manage their informational assets efficiently. Furthermore with the dropping cost of eDiscovery, opposing counsel can now trust the defense’s Data Map, but ask for verification with a robust eDiscovery suite, like Kazeon’s eDiscovery software, to ensure and verify compliance.

Use case: Records retention policy and management protocol

For many organizations, the perennial information management challenge they face is records retention. Some organizations my either have no cognizable records retention policy or a state-of-the-art records management protocol they can never seem to get effectively implemented. Regardless of what state its records policy or management protocols are in, and organization that seeks to implement one should have a sense of the following fundamental characteristics of their data and organization:
a. File create, modify and access times;
b. File “owner”;
c. file content;
d. The rules that define which group within the organization’s internal data taxonomy, the classified information belongs to, i.e. – HR, finance, taxes, customers, operations, marketing, etc.;
e. The applicable regulatory framework for the organization – this consists of nondiscretionary externally mandated records retention requirements; and
f. Pending (to the extent they exist) litigation hold requirements.
1. Defensible data remediation; getting rid of files with little business value and high exposure.
Organizations that have implemented records retention programs without classification are likely over-capturing information. This means that while they get what they should, they may also capture superfluous information that is of no business value that could well represent significant risk to the organization.
Records retention managers who leverage search and classification technology will be able to report on a host of information, including, but not limited to, the age of files it encounter during a network scan as well s file access and modify times. This allows records retention managers to being data remediation based on file age and utility. Arguably, old files that are never modified or accessed likely have little or no business value. In fact these files are the ones that constitute the greatest organizational threat in the form of dormant data liability. However, simply because they exist, they may be responsive to a litigation or regulatory request.
2. Data classification; defining that which is an organizational record.
The precursor step to defining what constitutes an organizational record is data classification. Prior to data classification, the data must be discovered and its contents accessed. In today’s world, file metadata and content become part of an enterprise index. Policies, driven by corporate stakeholder criteria, can then identify the items that qualify as “records” based on the organization’s rules and apply user-specific metadata to them.
In the records retention use case, records retention managers or policy makers can create and automate simple or complex classification rule sets that will classify and tag relevant documents with values such as “tax record,” “HR record,” “final contract,” etc. The resulting record can then be migrated to its archival resting point on secondary storage or read-only media. In short, powerful metadata tagging capabilities now allow records managers and policy makers to get their arms around vast amounts of data and apply flexible and elegant classification schemes that heretofore would have been inconceivable.
II. Use case: Information security
In a recent study conducted by TIP, and independent IT research group founded by Gartner, EMC, Giga, and Bell Labs alumni, upwards of 70% of information security (infosec) professionals interviewed have confirmed that there has been a shift in their focus from external threats to internal threats to their information security. Some hot points for information storage mangers include stemming intellectual property (IP) leakage, identifying network security gaps and managing information access. Helping infosec professional by giving them insight into the nature of data at rest is a core foundation for infosec solutions. Questions such as, “who in the enterprise has data related to project X and where is it?” can easily be answered by leveraging regular expression content filter engines that identify and alert infosec professional to the existence and network coordinates of certain types of information that meet the organization’s risk profiles. Infosec managers should be able to scan, locate and sequester information such as credit card data, social security information or any other pattern or keyword-based sensitive and proprietary material. Even more importantly, they should be able to conduct automated risk rankings that combine multiple metadata and content conditions. Information access technology delivers these types of solutions. Now infosec personnel can ascertain data ownership and access rights and be in a better position to help make policy decisions about avoiding future organizational exposure.

Karthik Kannan Quoted in eWeek on Financial Crisis and its impact on eDiscovery

Karthik's Quote....

"The effects of the bailout package passed by the House and Senate last week [on the e-discovery industry] are probably going to come in this [fourth] quarter," Karthik Kannan, vice president of marketing and business development for Kazeon, a respected e-discovery software provider, told me."In the last couple of years, we've had significant traction and sufficient growth. But we have barely touched the tip of the iceberg in terms of market availability, from an addressable market standpoint." Kannan said he thinks this Wall Street-centered meltdown clearly will be a further impetus "to get people to call us. We are seeing that more people are adopting a proactive position on information management," he said. "We are also seeing more hits on our Web site the last couple of months."


Read the whole story: http://www.eweek.com/c/a/Data-Storage/eDiscovery-Search-and-Storage-Providers-Await-a-Litigation-Boom-Following-Financial-Crash/

Kazeon and Quantum form solution Alliance

Kazeon announced a solutions alliance with Quantum Corp., the leading global specialist in backup, recovery and archive. Kazeon's ability to perform automated eDiscovery collection, preservation, processing, analysis and review on all electronically stored information (ESI) residing within an enterprise works seamlessly with Quantum's DXi-Series disk backup systems incorporating data de-duplication and replication technology. The combination provides a comprehensive solution for eDiscovery, archival and compliance minimizing the data actually stored.

http://www.kazeon.com/newsroom2/2008-10-07.php

Federated eDiscovery

Common challenges encountered by corporations in managing their enterprise-wide information:

1. Unnecessary data movement and collection before first-pass review by inside and outside counsel – untargeted, over-collection leads to liabilities, high preservation costs, delays in decision making and inability to make crucial early-case assessments

2. Too much data being outsourced to legal service providers for eDiscovery and hosting for analysis/review – corporations do not have control on in-house eDiscovery and costs are driven sky-high

3. Data is brought over the WAN to central locations for review, analysis & processing – too much network bandwidth is consumed and the infrastructure costs are high

The ideal solution will provide a federated architecture that obviates unnecessary data movement, allows in-place analysis and first-pass review, enables early-case assessments before collection, and enables targeted collection of relevant data. The result is not only efficiency and cost reduction, but also accuracy, defensibility and providing control to the corporation.

http://www.kazeon.com/newsroom2/2008-10-20.php

Agent Paradigm eDiscovery Paradigm

Agent Paradigm
Many companies use agent centric discovery. In the agent centric paradigm, a corporation must deploy and install a small application on each and every device it wishes to perform discover upon. The advantage of agent centric discovery is that the discovery effort leverages the source compute engine (CPU) to conduct search. Agent search also solves the challenge in discovering Live and Locked Files since runs in the client and has root access. The downside to agent centric approach is that corporations have to know each and every device on their network before discovery begins. The deployment and installation of the discovery agent must occur on every device. A corporation with thousands of desktops, laptops, servers and file servers will need significant planning to deploy the agent, not including test time of the agent on critical operational systems to ensure compatibility. Since corporations can only collect data from known sources, the agent approach exposes the corporation to omission liability, if relevant litigation materials are found on an unknown source. Another challenge with agent centric discovery is user intervention. Agents are often disabled by users because they slow system performance, which further impedes information discovery and collection.


Agent Benefits
• Distributes Compute Load
• Searches Lock and Live Files

Agent Challenges
• Search only know sources
• Agent compatibility challenges
• Agent application termination by users
• Agent deployment and installation on all information sources

Managing Information “in the Wild”: Ten Tips for Lite-ECM

Traditional Enterprise Content Management (ECM) products and solutions have and continue to deliver the ability to manage content, documents, and records within the enterprise to meet today’s business regulations. ECM platforms are a corporate necessity and will continue to be the backbone for critical, high-value information management and collaboration capabilities for the foreseeable future. However, there is a growing challenge in enterprise content creation and management. With the increase in knowledge workers and user friendly content creation tools, electronically stored information (ESI) volume is growing at nearly a hundred percent year over year. With this volume of information, over eighty percent of informational assets reside outside the ECM repositories, i.e. are “in the wild”. With today’s dispersed mobile workforce, documents and records are now created and scattered across databases, servers, email applications, laptops, desktops and storage systems around the world. The problem is how to find the key critical documents and records in today’s informational ocean and pull them into the ECM workflow, while leaving the rest in-place and indexing it. Because, importing all documents and records into the corporation’s central ECM repository is no longer possible or feasible due to sheer volume. A solution to the “in the wild” information problem would be to provide ECM functionality and features ranging from information access, information management, records management, metadata capture and management, full text and full content indexing, auto-classification across any device to separate non-critical information from critical information and seamlessly transition it into the ECM repository or indexing and managing information in-place.

To help manage the information growth while maintaining enterprise content management control of high-value documents and records, corporations need visibility into important data outside the ECM repository or “in the wild” information. Gartner coined the term ”Lite-ECM” which describes a cooperative Information Access and Management suite that seamlessly integrates and extends today’s ECM platform capabilities to provide identification, search, analysis and auto-classification of information outside the ECM repository stored throughout the organization. Adding in-place indexing and management capability delivers the ability to virtually organize distributed information into a single, easy-to-use information viewpoint, regardless of where the information resides. But, adding another tool to the toolbox can be challenging, especially on today’s constrained IT budgets. What are the key features needed to determine the right Lite-ECM product fit for your corporation? David Morris, Director of Product Marketing at Kazeon, provider of Information Management and eDiscovery technologies, offers insight into the top criteria for choosing a “Lite-ECM” software suite to augment and extend your ECM capabilities and reduce deployment and management headaches.

1. Enterprise-class Scalability & Performance – Most Lite-ECM information platforms were architected with a reactionary (do it once) ideology, which causes significant scalability challenges when attempting to deploy continuous Lite-ECM capabilities to manage today’s dynamic information environments. A Lite-ECM suite must be scalable to search across hundreds of terabytes of electronically stored information, as well as scale into the billions documents, and have the performance to process the data to keep pace with today’s information growth.

2. Auto-Discovery of data sources - The Lite-ECM suite must have the capability to auto-discover informational sources anywhere on the network, since critical data may reside in the enterprise file storage file server or a laptop in Shanghai. To truly manage all information, auto-discovery is a critical feature of any enterprise level Lite-ECM suite.

3. Holistic and Dynamic Organizational Information Map –Since network topology can change rapidly, having a dynamic and active continuous auto-discovery capability is critical for information indexing, internal investigations, litigation procedures and information capacity planning.

4.Agent-less Information Management– Organizations have enough critical data running on servers, laptops and desktops today. Having another agent on all devices simply reduces operational health and increases risk, not to mention that the device has to be “known” to install an agent. Agent-less search has a low impact on the IT infrastructure and is more rapid to deploy. With the scalability challenges solved, it is the lowest risk highest reward approach to identifying all data sources on the network. Since users cannot disable agent-less search, it provides a rapid and powerful investigation and litigation capability to find potentially relevant information and hold it in-place for review.

5. Robust Search, Analysis, and Classification - Searching, analyzing and classifying information complex challenges; however, a Lite-ECM suite will need have all three to truly add value and help separate the relevant from the non-relevant information within an organization. Having a strong analysis and auto-classification capability that can sort large data sets based on metadata, document content, file type, etc. is necessary to accurately and quickly reduce the volume of data to a relevant and manageable set to review and processing.

6. Tagging –Automating the tagging of individual content or grouping content into relevant virtual folders with a robust policy based engine allows administrators to simplify the review and reporting process by delivering a virtualized organizational information overview.

7. Workflow Management– After gaining insight into and classifying critical information, bring the “in the wild” data into the ECM platform for workflow management and preservation is a key capability. With the ability to automate the move, copy, encrypt, delete actions; an automated policy based methodology accelerates the manual processes for processing of all enterprise data. Furthermore, it allows corporate governance policies and IT policies and procedures to be managed and enforced through the existing platform.

8. Unified Management – With billions of documents and petabytes of storage, corporations can easily be overwhelmed by the volume of data and its presentation. A robust Lite-ECM suite must have a unified management view across the entire network and the ECM platform to simplify operational management. Without a unified management approach, the management task is overly burdensome and not feasible.

9. In-Place Record Hold – Being able to tag and hold potential critical information at the source, i.e. server or laptop, is a capability that separates the efficient Lite-ECM suites from unusable ones. It is not reasonable to move all potential critical data back to a repository before review, the in-place hold and review and subsequent collection process streamlines and accelerates the process to meet today’s demands and reduce infrastructure costs.

10. Enterprise-Wide Critical Information Capture – With 80% of corporation’s informational assets outside the control of the ECM platform, a Lite-ECM will need to have the flexibility to identify, access, search, and review information which resides in databases, email archives, servers, email systems and storage systems across the network. With an automated workflow policy engine, capture and movement of critical information to the ECM repository can be accomplished on a daily, week, or monthly basis. Having an extensible architecture to facilitate search, collection and review across existing and emerging applications and data types is a critical capability.

Deploying a Lite-ECM suite is a complex process, since it impacts IT, Legal, human resources, records management and security teams. To meet stakeholder needs, Mr. Morris advocates convening a cross-functional team to gather requirements, review solutions, and manage deployment of a Lite-ECM suite, as well as to create a sense of ownership and responsibility or the enduring usage of the new suite.