Steps to Eradicate Text Messaging Risk

Transcription

1 Steps to Eradicate Text Messaging Risk Use Text Messaging More While Reducing Your Organization s Compliance, Legal and Reputational Risk The popularity of text messaging is growing every year, and many employees and their clients now expect to use it as a tool to conduct business. Prohibiting the use of text messages is not only unsustainable for an increasingly mobile workplace, but it also does not protect your organization from risk - it simply hides risk where you can t see and manage it. In this report, we share five steps to help you build a risk management program that enables the benefits of text messaging while protecting your organization.

2 Text messaging is now woven into our work and personal lives Social changes, combined with technology advancements, have cemented the use of text and multimedia messaging as an inescapable requirement in today s work environments. Today, texts are transmitted at a rate of 200,000 messages per second. To put this into perspective, Twitter averages just 6,000 tweets per second. Alongside social networks and other digital communications types, the use of SMS and MMS technology in businesses puts intense pressure on organizations to adapt their governance policies and procedures to keep pace with regulatory, legal and risk management requirements in mobile environments. Every organization must protect its brand, which means all incoming and outgoing business communications should be monitored and be easy to find and produce when needed. In addition, organizations in the financial services, legal, lending/mortgage, energy, and healthcare industries have electronic communications archiving obligations enforced by regulatory bodies, while government organizations have various Open Records laws that require communications records to be made available to the public. How Should You Handle the Challenges of Text Message Compliance? Historically, risk averse organizations in highly regulated or litigious industries tried to prohibit text communications as a business communication channel to avoid compliance challenges. However, prohibitive and reactionary policies against the use of text messaging do not adequately reduce risk today within an organization. Mobility is now essential for success, so businesses must figure out how to enable their workforce while securing important data. Because text messaging is low-cost and easy to use, employees demand to use it to communicate with clients and prospects. Companies that prohibit text messaging place themselves at a distinct disadvantage. If your organization hasn t dealt with the issue of text messaging, it s time. It s reassuring to know that recent advancements in comprehensive archiving technology have made it easy to retain and manage oversight of business text communications no matter what devices, operating systems, or carriers are used by your employees. 2 5 Steps to Eradicate Text Messaging Risk

3 Map Out Your Organization s Mobile Business Requirements Before you set up a comprehensive archiving solution for the retention and oversight of text messages, you ll need to define/refine your organization s overall mobile strategy. Here are 5 steps to building your mobile strategy: 1. Know Your Device Ownership Scenario(s). Who will own and operate devices used for text communications? To begin, address how your organization will provide mobile devices that are used for business text messaging. This is important, because your device ownership and billing model will have a significant impact on how your organization implements its mobile and text messaging archiving and compliance plan. The major categories of device ownership are Bring Your Own Device (BYOD), Choose Your Own Device (CYOD), Corporate-Owned Personally Enabled (COPE), or a combination of these scenarios. Each approach to device ownership has advantages and drawbacks, so there s no perfect solution that suits every organization. Your choice of device ownership should be made based upon the specific needs, objectives, and capabilities of individual user groups within your organization. Bring Your Own Device. BYOD, also called Bring Your Own Technology or Bring Your Own Phone, is the policy of permitting employees to bring personally owned phones to the workplace, and use them to access privileged company information and applications. BYOD is making significant progress in the business world, with many using their own devices at work, especially in small to medium sized businesses. Advantages: Lower hardware and service costs; increased productivity and easy enablement; fewer or no carrier management requirements; quick to deploy; lower hardware and service costs for the organization. Disadvantages: Security is more difficult to manage and is less centralized compared to CYOD or COPE; no control over a device without a Mobile Device Management solution (see below); takes more work to enforce compliance requirements; may have additional legal and compliance implications and risks. For compliance: BYOD can allow organizations to apply some level of policy and technology to the device for business text messaging use. However, this approach can be limiting to employers if not managed properly, due to restrictions on how much text messaging data can be archived and supervised on employee-owned devices. Companies with less involvement in sensitive data management may benefit from the BYOD approach. Small businesses without a significant compliance requirement may find this is the most affordable device ownership option. 5 Steps to Eradicate Text Messaging Risk 3

4 Choose Your Own Device. With CYOD programs, an organization provides a predetermined, limited menu of devices that employees can choose from for business use. The organization may also prohibit use of a CYOD device for an employee s personal purposes (i.e. no personal phone calls, text messages, s, etc. can be made from the device), although this is relatively uncommon today. CYOD devices are either paid for/owned by employees, or the organization provides a device stipend to the employee, which allows the employer to retain ownership of the device when an employee replaces a device or leaves the organization. This option is often viewed as a happy medium between BYOD and COPE, as it combines the advantages and disadvantages of each approach. Organizations that want the best of BYOD and COPE, but are confident in their ability to manage the risks inherent with CYOD, may benefit from this option. Advantages: CYOD may reduce hardware costs compared to COPE; employees still control many aspects of their devices; IT / support for employees is streamlined since there are fewer types of devices used compared to BYOD; employees potentially only carry one smartphone (if the employer allows personal text messages/communications on the corporate device). Disadvantages: Employees might not like the selection of company-approved devices; the procurement process can be complicated compared to BYOD or COPE; the organization may still have hardware costs; IT must stay up-to-date on new mobile technologies; CYOD can be slower to deploy across a business. For compliance: CYOD provides more latitude for compliance and legal teams to govern data, and apply more policies and technical controls to ensure proper handling of text messages. CYOD also provides other security options for organizations that are concerned about potential BYOD ramifications, which is a key reason CYOD continues to receive attention. Company Owned Personally Enabled. COPE, which has evolved from the original device supply model called Corporate Owned, Business Only, is a mobile model that puts management in control of devices used by employees for business purposes. An organization provides a device to an employee at the organization s expense, allowing for complete governance over the device and its data. Employees often have the freedom to use the device for personal reasons, but the work information on the device is managed, and the organization retains ownership of the device. Larger organizations are more likely to use the COPE model, as it exerts the most control over mobility and text communications compared to BYOD and CYOD. Advantages: Allows for work/life communications on a single device; carries the advantages of CYOD, but with more control and authority over devices; has fewer security issues compared to BYOD and CYOD. Disadvantages: The organization must keep pace with current mobile technology; may be slower to deploy and maintain; employees may feel they have less freedom, which could hinder productivity. For compliance: Monitoring and archiving policies for electronic communications, including text messages, are easier to put in place and supervise with COPE. Because of this, COPE is often a top choice for organizations that have rigorous compliance, legal, or security requirements, including financial services, public sector, and healthcare entities. 4 5 Steps to Eradicate Text Messaging Risk

5 2. Update your communications policy to account for business text messaging. While mobile device policies likely already have a place in your organization s information security policy and supervisory procedures, you will need to enhance these to include explicit direction on acceptable use of text messaging for business purpose, and then enforce compliance. Your policy should address the following questions, and be distributed to employees: Which type of mobile hardware is preferred/mandated for business use? This is related to your device ownership strategy. Will your organization require/prefer iphones, or can employees use multiple types of devices? What type of data and devices will be archived and supervised? Be specific with employees here, noting who, what, when, and where business communications and text messaging on mobile phones will be archived and supervised. Also, note how communications will be archived, so employees are aware if they need to enable a specific archiving technology on their phone to be compliant. Will you allow employees to whitelist contacts on mobile phones? Describe if, how, and when employees can whitelist certain contacts (usually personal contacts like a spouse or physician) to exclude or prevent sensitive personal or medical conversations from being captured, archived and supervised by their employer. 3. Determine which mobile carriers and plans your organization will use. The mobile carriers and plans your organization uses will have an important role to play in your overall mobile compliance strategy, particularly if you use the COPE or CYOD device ownership model. To start, ask your approved mobile carriers if they have any solutions for Mobile Device Management (also see below) and performing important tasks, such as disabling imessage on iphones via Apple s Device Enrollment Program. First generation text message archiving solutions required an organization to install software on each device used by an employee for business communication. Today, integration between your mobile carrier, comprehensive archiving provider, and an MDM solution can for the first time streamline the time associated with managing mobile device security and compliance. Your compliance, legal and risk management teams will be able to respond to regulatory, ediscovery and litigation events more efficiently, using a unified, deviceindependent, real-time archiving solution. Also, your employees will be happy, knowing they may send and receive SMS/MMS messages without interruption to their day, while remaining compliant with regulatory, legal and risk management requirements. Many major mobile carriers now use Smarsh as a technology partner, and capture text messages and send them directly to The Archiving Platform from Smarsh, where they are kept alongside other critical electronic communications records including and social media content. For example, organizations that are AT&T customers can have text messages archived from employeeowned and corporateowned devices, using The Archiving Platform from Smarsh. Organizations that use Verizon can have text message communications from corporate-owned devices archived within The Archiving Platform.

6 4. Determine if your organization needs to use a Mobile Device Management (MDM) solution. Mobile device management is a security software used by an IT department to monitor, manage and secure any corporate or employee-owned mobile devices that access critical business data, deployed across multiple mobile carrier providers, plans, and operating systems. Some solutions including MobileIron and AirWatch incorporate security and compliance policies and configurations across an organization from a single platform, and provide the visibility and controls needed to deploy, manage and retire devices when employees replace devices or leave the company. Depending on the size of your organization, an MDM solution can be incredibly helpful, providing a view into the security of mobile devices on a given network. MDMs can also handle tasks that help ensure the proper archiving of text messaging content (such as disabling imessage and other non-text messaging apps on ios devices). If your organization will use an MDM solution, look for one that integrates with your comprehensive archiving solution so text messages can be archived alongside other digital communications including , social media and other data. 5. Retain, oversee and report on text message data. As mentioned above, numerous industries are required to archive and supervise electronic communications, including text messages. To make risk management much easier, look for an all-in-one archiving solution that lets you capture, search, review, monitor and produce text messages in one platform, alongside other critical electronic communications including , social media, website content, and more. That way, you ll be able to see when a conversation begins in an , moves to text messaging, and concludes on social media. Your model for providing mobile devices, operating systems, and mobile carriers will determine how your organization should archive text messages. No matter what, you ll need an archiving solution that can handle any of the following scenarios, or a combination: BYOD: For an employee s personal phone, an over-the-top (OTT) application can be used to provide a virtual phone number and a container-based approach where text messages can be captured and directly sent to your organization s comprehensive archive. (Make sure iphones are supported). CYOD: To capture text messages without an additional application required on devices, choose an archiving provider that partners with major mobile carriers such as AT&T and Verizon Wireless. Also, the archiving provider should be able to capture any inbound and outbound content on any US carrier with the use of a lightweight OTT application. COPE: When your archiving provider is integrated directly with a mobile carrier s network, this allows for any device to be archived without installing an additional application on mobile devices. iphones and other popular smartphones can be supported. Put it All Together Fusing the five key elements listed above together to form your mobile strategy will help ensure that your compliance, legal, IT, risk management and other critical teams coordinate and prepare to mitigate text message risks. Accurate planning provides a greater opportunity for success. When you expand support for text communication channels while preserving governance requirements, your workforce can become truly mobile, without worry.

7 WHY SMARSH? Smarsh delivers cloud-based archiving solutions for the information-driven enterprise. Its centralized platform provides a unified compliance and e-discovery workflow across the entire range of digital communications, including , public and enterprise social media, websites, instant messaging and mobile messaging. Founded in 2001, Smarsh helps more than 20,000 organizations meet regulatory compliance, e-discovery and record retention requirements. Copyright 2017 Smarsh, Inc. All rights reserved.