CIO - CRM systems are full of data that's valuable to your company. Or at least, it better be. But CRM systems are not at the top of the list for external hackers, so why should it be on your priority list for an ILP/DLP system?
Let's start by clearing up a misconception: the external hacker is rarely your biggest concern, particularly for a CRM system. The most dangerous breaches come from your own employees, particularly the disgruntled ones. Given the number of layoffs and the turnover of sales reps these days, the risk has grown. Your employees not only have access to a significant amount of data, but also know what the data means and how to separate the marginal from the important.
CRM Definition and SolutionsUnmasking DLP: the Data Security Survival Guide
So your first order of business is to prevent key CRM data from walking out the door. Legally, the data is the employer's property. But practically, your entire contact list and transaction history could fit on a microSD card that is easily hidden and transported. Although the best CRM systems have fine-grained access controls (enforced by role hierarchies, user profiles, workflow status, and application logic) and audit trails, I have yet to find one that has a meaningful level of ILP. If a user is allowed to run any reports, they can typically run almost all of them and export the results to a CSV file. If a user can see a record, they can save it as HTML or print it. And with almost every CRM vendor, there is no audit trail regarding access history.
CRM systems of course provide the ability to deny even read access, but going to that extreme both limits user productivity and tips off the bad guys that you are on to them. Instead, use a proper ILP/DLP tool.
You'll need to work closely with your ILP tool vendor, as SaaS CRM systems present some special challenges. If you haven't bought one already, make sure to look for one that is data aware, particularly in the Web context. The ILP tool will easily be configured to block creation of CSV files, or at least to prevent them from being e-mailed or downloaded. But you don't necessarily want to block the use of all CSV files, just the ones that have the contents of your CRM system. ILP tools can also be configured to block the saving or printing of an HTML page, but the very flexibility of SaaS CRM systems makes it harder to characterize the off-limits content. If this reminds you of the joys of configuring a screen-scraping tool, you're getting my point here. Salesforce.com does make things easier by using a unique URL for every object, page, and record in the system, so the ILP tool can simply be configured to key in on an entire range of pages.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- The Critical Role of Support in Your Enterprise Mobility Management Strategy Most business leaders underestimate the importance of tech support when they choose an EMM solution. Here's what to put on your checklist.
- Live Webcast Best Practices for the Hyperconverged Enterprise Network To the Age of Constant Connectivity and Information overload
- Live Webcast Unmasking the Differences between Consumer and Enterprise File Sync & Share The consumerization of IT combined with the rapid pace of the modern mobile workplace is forcing enterprise IT teams to evaluate file sync...
- Live Webcast Government Agency Webifies Outdated COBOL Applications Let this CTO tell you how his agency converted 1980s-era green screens into an e-filing portal for the 100,000 cases handled each year...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,...
- Getting Ready for BlackBerry Enterprise Service 10.2 Find out how BlackBerry® Enterprise Service 10 helps organizations address the full spectrum of EMM challenges, while balancing the needs of both the... All Applications White Papers | Webcasts