Table Of ContentInformation
Governance and
Security
Protecting and Managing Your
Company’s Proprietary Information
John G. Iannarelli
Michael O’Shaughnessy
AMSTERDAM • BOSTON • HEIDELBERG • LONDON
NEW YORK • OXFORD • PARIS • SAN DIEGO
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Butterworth-Heinemann is an imprint of Elsevier
Acquiring Editor: Brian Romer
Editorial Project Manager: Keira Bunn
Project Manager: Priya Kumaraguruparan
Designer: Alan Studholme
Butterworth Heinemann is an imprint of Elsevier
The Boulevard, Langford Lane, Kidlington, Oxford OX5 1GB, UK
225 Wyman Street, Waltham, MA 02451, USA
Copyright © 2015 Elsevier Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means, electronic
or mechanical, including photocopying, recording, or any information storage and retrieval system,
without permission in writing from the publisher. Details on how to seek permission, further infor-
mation about the Publisher’s permissions policies and our arrangements with organizations such as
the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website:
www.elsevier.com/permissions.
Thisbook and the individual contributions contained in it are protected under copyright by the Publisher
(other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden
our understanding, changes in research methods or professional practices, may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating and
using any information or methods described herein. In using such information or methods they should
be mindful of their own safety and the safety of others, including parties for whom they have a profes-
sional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any
liability for any injury and/or damage to persons or property as a matter of products liability, negligence
or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in
the material herein.
Library of Congress Cataloging-in-Publication Data
Iannarelli, John.
Information governance and security : protecting and managing your company’s
proprietary information / John Iannarelli, Michael O’Shaughnessy.
pages cm
Includes index.
1. Knowledge management. I. O’Shaughnessy, Michael. II. Title.
HD30.2.I2336 2014
658.4’038--dc23
2014027431
British Library Cataloging-in-Publication Data
A catalogue record for this book is available from the British Library
ISBN: 978-0-12-800247-6
For information on all Butterworth-Heinemann publications
visit our website at http://store.elsevier.com/
Dedication
To the men and women of the FBI, the finest law enforcement agency in the world.
John G. Iannarelli
To my wife, Karen, for all of your love and support.
Michael O’Shaughnessy
About the Authors
John G. Iannarelli has been an agent with the Federal Bureau of Investigation for
twenty years, specializing in cyber investigations. He has been assigned to Detroit,
San Diego, Washington, and Phoenix, where he currently serves as the assistant spe-
cial agent in charge, the FBI’s number two position in Arizona.
In 2012, Mr. Iannarelli received an honorary doctorate of computer science for
his contributions to the field of cyber investigations. He has presented at national
and international gatherings, including presentations to Fortune 500 companies, law
enforcement agencies, and the Vatican. He is the author of several books, including
his recently released Why Teens Fail and What to Fix, a guide to protecting children
from Internet dangers.
Previously Mr. Iannarelli served as a San Diego police officer. He is an attorney
admitted to the bars of California, Maryland, and the District of Columbia.
Since 2009, Michael O’Shaughnessy has served as the president of Guardian
Pro, a collaboration of highly qualified and uniquely experienced individuals dedi-
cated to the mission of protecting the private sector. As the founder of Guardian Pro,
Mr. O’Shaughnessy brings a heavy technical and security background and the vision
to grow a company focused on educating the public and corporations, and changing
the landscape of technical security awareness and knowledge.
Prior to Guardian Pro, he worked at a computer forensics company from 2004 to
2009. There he oversaw the growth of the company from 10 to 108 employees and
saw revenues increase from 2 million to more than 24 million dollars. The company
expanded services outside of forensics to include consulting, litigation support, and
electronic discovery.
He began his career with United Airlines and spent eighteen years in operational,
strategic, and security management. He served as international manager at Chicago
and Miami, operations chief in Chicago, and security manager at Washington, DC,
and Glasgow, Scotland, as well as general manager in Utah and Arizona.
Survey and Disclaimer
Unless otherwise noted, all comments offered by business representatives in this
book are based on responses to an October 2013 information governance survey
conducted by the authors. Fifty individuals representing small, medium, and large
businesses throughout the United States responded to the survey.
Although John G. Iannarelli is a special agent with the Federal Bureau of Inves-
tigation (FBI), this work is based solely on the authors’ own views and research, and
does not in any way represent the official position of the FBI. Any references to the
FBI are the result of the authors’ research and have been adapted from public sources.
Foreword
Toward the end of my thirty-year career in law enforcement, I served as the
assistant director of the Federal Bureau of Investigation’s (FBI) Cyber Division,
overseeing criminal cyber investigations worldwide. After retiring from the FBI,
I have subsequently served as the director of security for two major corpora-
tions with responsibility for thousands of employees, hundreds of facilities, and
numerous sophisticated technologies. In my professional experience—having
been witness to more losses of proprietary and personal information than I could
possibly count—one of the common themes in each of these incidents was the
failure to have an adequate information governance plan to guard against and
mitigate such incidents.
For most companies and individuals, protecting against the loss of proprie-
tary and personal information is nothing more than ensuring that a firewall is in
place. Sadly though, this does little to protect against today’s threats to information
security. Individuals and companies alike need to be proactive against the grow-
ing threats and need to take their information governance planning seriously. It
appears that everyone is aware of the potential for a computer intrusion, but little
efforts are directed toward any of the threats from within, whether they are nefari-
ous or unintentional.
I have seen significant losses of proprietary and personal information, not just
from the criminal intrusion but from the well-meaning employee who compromises
operations by being socially engineered. Likewise, there are the disgruntled work-
ers who choose to take their frustrations out on the company by means of sabotage.
In any of these cases, much of the damage could have been prevented, or at the very
least minimized, had a proper information governance policy been incorporated into
everyday functions.
I have had the pleasure of working directly with both authors of this book, and can
think of no other persons better suited to explore comprehensively and explain the
threats and the solutions through information governance planning. Their combined
law enforcement and corporate experiences make them exceptionally well suited to
share their experiences while imparting their unique knowledge of implementing
policies and practices designed to keep you and your business safe.
xvi Foreword
Whether you are the sole proprietor of a small operation, or the chief informa-
tion officer of a major conglomerate, within these pages you will find a takeaway to
minimize and potentially prevent the potential—or shall I say inevitable—loss of
sensitive data. For as the authors will tell you, it is not a matter of if but rather when
you become a victim in today’s world of handling sensitive information.
Jana D. Monroe
Former Assistant Director Cyber Division
Federal Bureau of Investigation
You are the primary victims of the evolving cyberthreat. But you are also the key
to defeating it. You have the information on your servers and your networks. And
you have the expertise and the knowledge we need to stop these attacks. You need
zealously to guard your proprietary information and your customer data.
James Comey
Federal Bureau of Investigation Director
(Source: from his speech in RSA Conference,
San Francisco, California, 26 February 2014)
C
h
a
p
t
e
The Case for
r
Information
Governance 1
Guarding assets, staff, and accounts has always been a key to protecting businesses.
But in the information age, are you protecting your most important resources—
company and client data? Each year, businesses lose billions of dollars due to data
leakage, on top of which the government often imposes millions in fines. In addition,
leakage can cause irreparable damage to your company’s reputation. It is not a matter
of if you will be a victim; it is a matter of when.
We have all heard the old adage that an ounce of prevention is worth a pound of cure.
When it comes to data management, that pound of cure may not be available, so the new
adage might be that an ounce of prevention is worth preventing the total destruction of
your business. The ounce of prevention is information governance, and—if you are like
most people—you have no idea what that is or how to take advantage of it.
This book explains how you—as a business owner, executive, or even someone
just interested in keeping their proprietary information safe—can better adapt to
twenty-first-century threats. By understanding the changing landscape and moving
your organization to be focused and data centric, the damage or loss of your key
information can be minimized if not out-right prevented. We will break down for
you what information governance is and does for different sized companies. Large,
medium, and small companies all have unique circumstances that will be addressed.
Additionally, we will discuss what they have in common. Information governance
has many standard issues that can and should be addressed across all organizations.
Information Governance and Security. http://dx.doi.org/10.1016/B978-0-12-800247-6.00001-7 1
Copyright © 2015 Elsevier Inc. All rights reserved.
2 Information Governance and Security
One of the benefits of reading this book is the impact on your personal life. While
this book is written to help in business, many of the tools and habits discussed are
important for individuals. Digital threats affect people at work and at home. Be mind-
ful as you read to see the parallels to your life away from the office.
Let’s start with a bold statement: information governance is not a function of your
information technology group. It is a base-level management function, much like human
resources or finance. A properly developed and managed information governance pro-
gram protects your company and keeps it effective and efficient. It helps to manage com-
pliance issues and can be vital in defending against litigation. It will make employees
more satisfied and secure in their work and limits your risk of loss from human error.
Information governance is more than an IT problem that needs to be solved; it is a sys-
temic solution to counteract threats, alleviate inefficiencies, and prepare for the future.
Take, for example, the story of an architectural firm located in the southwestern
United States that was happily doing business as a profitable midsized company in the
spring of 2011. The employees were engaged. The clients were happy. The company
was making money and having a great time. All seemed well, so what could go wrong?
During that time a senior designer with full access to the client base and design
work resigned and went to work for a competitor. In very short order, clients started
leaving and much of the work was shifted to the competing firm by whom the
employee had been hired. Not good.
In an effort to stop the bleeding, the firm’s owner went to his attorney to take
action on this sabotage by stopping the theft of clients and company designs. Upon
review with legal counsel it was determined the employee had never been asked
or required to sign a nondisclosure or a noncompete agreement. The owner even
contacted law enforcement in an effort to right the wrong, but received the same
response. There was nothing they could do. The former employee was not in breach
of contract, nor could criminal intent be proven in a court of law.
The victim company was able to recover, but only after shrinking in size, laying
off office personnel, and moving to a new, smaller building. Several years later, they
have still not fully regained their previous work levels. The situation was tragic and
preventable. It occurred because the architectural firm did not have a policy that
addressed data management and access. They had no employee agreements to hinder
or address the theft of intellectual property. They had no information governance
program to steer management to avoid such problems.
Information Governance
So what exactly do we mean when we talk about information governance? It is a set
of established policies and procedures you and your employees implement and fol-
low in order to manage sensitive and proprietary information.
