Mon, April 09, 2007 — CIO — When BCD Travel began investigating what it would take to get Payment Card Industry (PCI) certification for the handling of customer credit card data, Senior VP of Technology Brian Flynn realized that he didn't really know how his employees were handling such information. That meant not only could PCI certification be denied but also the travel agency's reputation and business could be harmed. At the National Football League's Houston Texans, IT Director Nick Ignatiev came to the same realization as he investigated PCI certification.

In both cases, vendors they'd been working with suggested a new technology: outbound content management tools that look for proprietary information that might be leaving the company via e-mail, instant messaging or other avenues.

Flynn started using Reconnex's iGuard network appliance, with vivid results. "It was a shock to see what was going out, and that gave us the insight to take action," he says.

After Ignatiev examined his message flow using Palisade Systems' PacketSure appliance, he too realized that his employees needed to do a better job protecting critical data, including customer credit cards, scouting reports and team rosters.

A key point: Many CIOs and CSOs already have information security methods in place, such as identifying, restricting access to and even encrypting sensitive data within their companies. Some also configure PCs so users can't copy data onto USB thumb drives or recordable CDs. Flynn and Ignatiev were already using some of these techniques—but their tests of outbound content management tools exposed a set of wide-open exit points for sensitive information, including e-mail, instant messaging, Web-based applications and file transfer protocol (FTP).

The traditional security methods may restrict sensitive data to legitimate users, but Flynn and Ignatiev found that even legitimate users were putting the data, and their companies, at risk. At BCD Travel, a corporate travel service, nearly 80 percent of its 10,000 employees work in call centers and thus have legitimate access to sensitive customer information. What BCD and the Texans found was not malicious activity but people who were unaware of security risks, such as in sending a customer's credit card number by e-mail to book a flight or room from a vendor that didn't have an online reservations system.

"Employees are just trying to get their jobs done," Flynn notes. Flynn and his peers must craft comprehensive strategies to help them get that job done more safely.