While Your Employees were Sheltering, Cyber Criminals were Attacking

Duration: 1:00:16 · Recorded: 2020-06-04

Speakers: Michelle, moderator, Zasio; Rick Wilson, VP Strategy & Solutions, Sherpa Software; Warren Bean, CRM, Senior Sales Engineer and Product Development Manager, Zasio

Lightly edited machine transcript. Slides are summarized where they carry information not spoken aloud.

[Slide: Title slide: "Who's in control of your corporate data: you, or the hackers?" Sherpa: Rick Wilson, VP Strategy & Solutions. Zasio: Warren Bean, CRM, Senior Sales Engineer, Product Development Manager.]

Michelle: Hello everyone, welcome to today's webinar, While Your Employees Were Sheltering, Cyber Criminals Were Attacking. I'm Michelle from Zasio, and I'll be your moderator for today's session. We have a lot of great information here for you today, but before I turn it over to our experts, I want to give you a quick background on why our two companies are collaborating on this session today. When considering cyber threats, people usually think about firewalls, antivirus software, and dangerous websites, things that the average user doesn't have much control over. However, if you manage information, then you do have some control over how well it's managed, so you can minimize the risk, and having the right information management software solutions in place can help make this an easier feat. After chatting at several trade shows and industry events, both Sherpa and Zasio recognized that we each manage complementary parts of the information governance puzzle. So we've come together today to tell you a unified story about how to find, govern, and protect your data. Our solutions are complementary and are meant to assist users at different phases of their records management journey. So this is not an official partnership, just a recognition of synergy within the same industry. You can download more information on these solutions from the Handouts tab on your GoToWebinar control panel. With that, I'm going to turn it over to our presenters today, Rick Wilson and Warren Bean.

Rick Wilson: Hey, thanks for that tee-up, Michelle. Very well done. We appreciate it. So my name is Rick Wilson. I'm from the Sherpa Software side of the presentation. So happy to be with you today. I'm coming to you from right outside of Pittsburgh, Pennsylvania, where Sherpa is based. And we have been in business for almost 20 years now, which is a pretty remarkable achievement for a software company in this day and age. We specialize in helping our clients manage and control their electronic information.

We're going to take you through some details of that, specifically with regards to how you can reach your remote workers in this COVID era that we're managing through. And then we'll also show how that process could help you select content based on the criteria you're interested in and tee it up, or prepare it to go into the Zasio records management world. And I'll introduce my co-presenter today, Mr. Warren Bean.

Warren Bean: Thanks, Rick. Yep, my name is Warren, and I'm here to augment what Rick just mentioned, and that is to help you protect your data with some of the tools that we have that we can see work well with the Sherpa environment. Basically trying to, as Michelle mentioned in the beginning, help you complete that puzzle, the puzzle being how to manage all the information, how to protect it, knowing that if you do a good job up front with understanding where your information is and how to govern it, it will be better protected against those threats that are coming at you on a daily basis, whether you're in the office or not. And so I'm coming from Boise, Idaho. That's where our office is located. And as you can see on the slide here, our company has been in business since 1987, so about 33 years now.

And so glad to be working with Rick and looking forward to giving you some good information, and looking forward to some good feedback as well. So as we go through, be sure and think about questions that you want to ask, and we'll be sure and give you some time at the end of this presentation to ask those questions and give you the best answers that we can.

Rick Wilson: So Warren, I thought 20 years was a good record, and you topped me with 33.

Warren Bean: Sorry about that, Rick. We've both been at this a long time. That's right, that's right. And one of the things that Rick and I both recognize as we've been talking and sharing information about what we do is that this visual here of this mountain is really what everyone is dealing with. It's a way to boil this down to what is the problem. The problem is that we've got these mountains of data. They're really hard to scale. And in fact, in all of the dealings that I have had with companies over my 20 years here at Zasio, I have not seen anyone who's doing it well yet. No one's effectively scaled that mountain and said they've conquered it. There's lots of good strategies, and people are doing lots of good things out there and getting some better handle on what's happening, but no one has completely solved it. So that's why we wanted to start off with that visual, to keep that in mind.

That's the problem that we're dealing with right now.

[Slide: Navigating "The Databerg": 16% business critical data, 30% ROT (redundant, obsolete and trivial) data, 54% dark data; 46% tagged or classified. Source: Veritas, The Databerg Report: See What Others Don't (Mar. 16, 2016).]

Rick Wilson: Nice. So I'm going to take Warren's mountain and flip it upside down for you. I just love this slide, the Databerg slide. I was on a webinar presentation a couple of months ago with a peer of mine, Jeffrey Sharer from Actuate Law firm in Chicago, and Jeff used this slide, and I borrowed it from him because it's one of those slides that just, the picture so accurately describes the situation that we're all managing with. There is this extended amount of information in the environment, which could be in lots of different repositories. It could be on your network shares, it could be on your user workstations, it can be SharePoint, OneDrive, you name it. There's so many places where your users are creating and managing content today, but the point of the slide is a very large amount of that is invisible to you as records managers, as IT professionals, as security folks who are charged with maybe locking that down and making sure that it is being managed correctly. Up to 54% of it falls into that dark data category: information that we may not even know about, let alone have some strategy to be able to manage it, retain it, and take it to the end of its useful life cycle. Even above the water line there, above the 54%, a significant chunk of that data, that 30% that's in the middle of the slide, is very often redundant, trivial, the kind of information that a user made a copy of a spreadsheet, or they shared that spreadsheet with another peer who made a copy of it, stored it on a network share, finished the project, and never thought to go back and delete it. And in some cases that information's been out there for a decade or more, maybe hiding on a network file share. And then there is that top piece, of course, the information we can see and get to, and you probably already have strategies in place to manage and control that. But what we're really focused on is helping you uncover the bottom portions, the below-the-water-line portion of the Databerg.

[Slide: Unstructured Data Threat Matrix, threats and goals: locate and remediate sensitive data (PII, PCI, PHI) to reduce accessibility to personal data; proactive employee flight risk monitoring to eliminate loss of intellectual property; preemptive incident response classification to speed incident response time by focusing on most critical data; search and destroy missions, threats resolved in hours/days versus weeks/months; data risk assessment/mapping to analyze risk-prone data locations; internal investigations, e-discovery, privacy compliance (CCPA/GDPR) for regulation adherence, reduction in lawsuits and speed to issue resolution.]

Warren Bean: So something that you and I talked about, Rick, when we were planning for this, is that it would actually be easier if it were a mountain, right? It's much deeper than that, and so much is hidden from our view. So if it were a mountain we could see, we'd know exactly what we have to deal with, but in so many cases it's not as easy as that.

Rick Wilson: Absolutely, and probably in most cases actually, Warren. So like Warren, I spend a lot of my week on a regular basis talking to customers or prospective customers who are trying to manage information, whether it's the information they know about or, maybe more accurately, the things they don't know about, as Warren just pointed out. And what I hear from them on a fairly repetitive basis is various categories where they perceive that they might have a problem or a threat. So I've kind of pulled together a little matrix to talk about things that might give you categories, that might give you an idea of how you should be managing your information, or perhaps thinking about, do I have a strategy in place to manage a threat category that's shown on the slide here? Far and away the most common one is managing sensitive information, right? The interesting thing about this category is sensitive information varies from client to client to client. So if I'm dealing with medical industry clients, it's typically PHI or something similar to privacy. However, if I move over to maybe an education client, it's FERPA. If I move to an insurance carrier, it might be policy number information or subscriber information. So it pays to sit down and figure out what is sensitive data in your environment, and then be able to put together a strategy to control it. It really begins with articulating what that means to you, what exactly is sensitive. From employee flight risk monitoring: being able to identify and maybe manage intellectual property, especially today, with a lot of this being kept on your employees' desktops as they've been migrated into this remote work scenario, is kind of an interesting situation. So several months ago, pre-COVID, I was giving this presentation to a local bank, a major bank here in the Pittsburgh market, and the CSO was listening as we went through the slide deck and politely paying attention, but when we touched on this intellectual property, all of a sudden she leaned forward in her chair and she started taking notes. And after the presentation she mentioned to us that this is the area that she's really most concerned about. She said, not that Social Security numbers aren't important, but there's millions of those on the dark web already. In a large part they've leaked and they're available and they're out there. So I'm less concerned with that kind of information than maybe a competitor finding out about my branch expansion plans or my M&A activity that might be coming up. So how can we locate information that your employees might be using in a network share, on OneDrive, or SharePoint, on their workstation, and then maybe help you mitigate that?

Incident response classification: it really deals with the fact that if you've already got some kind of a handle on your information, it becomes much more easy to remediate or address a loss situation, right? So this is kind of the idea: if you've scanned an employee desktop and you've labeled information that might be confidential or it contains PII, if that laptop gets stolen or left at a TSA counter as they checked into the airport, you can pretty quickly figure out how much sensitive content was on that device, or how much PII might have been on that device, because you've already applied some sort of a classification to it and helped categorize it. Search and destroy has become huge over the last several months, and Warren's going to give you some statistics about some of the threat statistics that we've seen over this COVID situation. But maybe two weeks ago I had a call from one of my clients who's in the pharmaceutical industry, and they had had a phishing message get loose in their Office 365 mailbox environment, and it was the typical kind of phishing scenario. It looked like it came from an internal employee, it had a link to click, said it was a ShareFile attachment, and they were trying to get people to click on that attachment so they could harvest credentials or whatever. And in a matter of a couple of hours we were able to identify the characteristics of that phishing message, create a rule to remediate it, test that against a set of their mailboxes, and roll it out into production. So out of a little over 600 mailboxes, it turned out that maybe 180 of them, that email, and within a few hours they were able to remediate it and delete it from the mailbox environment. So search and destroy could be a really useful tool.

It's one of those things that you may not think about initially, but when the situation arises, you're glad you have a way to handle that remediation. Data risk and assessment mapping: so where are we going to be able to find information? These risk-prone data locations are typically the places that are hardest to get to, and what we hear often from clients is that's a network file share. Maybe you've only been working for the organization for three or four or five years, but there's data on those file shares that might be 20 years old. You have no idea if that data is important, relevant, and so forth. Of course, the corollary to that is your employee workstations. Before saving information, they're exporting content, or maybe from a cloud-based system like Salesforce, storing it local in CSV files or Excel spreadsheets that you're not aware of or able to manage. And then our final category here was this idea of preparing for privacy legislation, or perhaps e-discovery, and what we see there is with the rise of CCPA and GDPR, we know ultimately everybody's going to have to have some kind of a privacy strategy in place to be able to identify and manage the sensitive information. So it pays to be thinking about that ahead of time.

I'm sure if you are in a GDPR scenario, of course that's been in effect for over a year now, you probably already sorted through that. CCPA is in its infancy; however, there's a number of other states that are looking at similar types of privacy legislation that might impact you and your organization.

[Slide: "FBI: Covid-19 Cyberattacks Spike 400% in Pandemic" (https://www.msspalert.com/cybersecurity-news/fbi-covid-19-cyberattacks-spike-400-in-pandemic/). "67% rate the inability to find records as a serious problem in their organization" (2020 Zasio Survey, rating of 4 out of 5 or greater).]

So Warren, let me hand it over to you here.

Warren Bean: Yeah, and these are just a few things that I thought stood out in the context of what we're discussing here. One is, one of the headlines I saw recently there from the FBI about the increase in the cyber attacks during the pandemic, and we've certainly seen that here, just as you described, Rick. We've had a number of very targeted email attacks where they are obviously looking at social media, looking at LinkedIn and other platforms to see who is who in the organization, and targeting messages to specific employees from their bosses, looking for that person to click a link, using everything from the typical bad or malformed website to OneDrive shared files to, you name it, they're using every tool in the toolbox and more. And as you can see there, that has just increased during the pandemic, because obviously a lot of people are working on networks that may not be as secure because they're working from home. They may or may not have things updated on home routers and such, and so all of that is just creating more of a target vector, or a surface attack area, for the attackers to get into. Not to mention it's harder for those who are in IT security to keep monitoring things if they are remote. They can't as easily go in and see servers firsthand if they're not there directly in server rooms and so on. So that was one of the things that stood out to me just as far as the threat risk. And then just in our own informal surveys that we do with prospects and customers, we found that, to make that problem even worse, a good two-thirds of our prospects and customers find that just the ability to find records is a huge problem in the organization. So you can imagine if you have issues with cyber attacks, and things are being, if there's ransomware that's loose and you can't figure out where your information is, then obviously you're going to have a problem with understanding the spread of the attack, what it's affecting, how serious it is, whether it's affecting vital records or personal records or just the general redundant information. It's going to be really hard to know that. And then here in this AIIM survey from 2018, you can see that again nearly two-thirds of organizations are mostly doing manual approaches to retention and disposition. So that means that for all of these different repositories that you have, whether it be SharePoint, shared drives, ERP systems, personnel systems, HR, accounting, most organizations don't have a methodical, systematic approach to purging records in those systems. And those records are ever more increasing in terms of the variability. It used to be that an accounting system, it was simply a database of accounting records. Now, for all these systems, you can easily add attachments and other types of documents, and there's no clear way to go through and purge that information out. So a lot of that information just stays there and becomes some of that dark data, becomes some of the redundant data that we talked about in some of the previous slides. So really this is just highlighting the fact that the attacks are increasing, and it's increasingly more difficult to find what your information holds, and it's not being destroyed. So if it's being attacked and you can't find it, and you're not destroying it, then you're really in a position of really not knowing if you're being attacked, or what is at risk in those attacks. So it really does create a pretty dire situation.

All right, let's go ahead and move on. And yes, this is what everyone wants, right? Benjamin Franklin: a place for everything and everything in its place. This is a picture from the Library of Congress of the pristine way that we'd like to have all of our files, documents, paper and boxes as well. This is the goal that we'd all like to have, so we know exactly where it's at. We can go to a card catalog and find it. But sadly, it's really not the case. I probably should have put a counterpoint here of the typical situation, which is piles of information everywhere and not categorized at all. But to further those goals, on the next slide we've got some more detailed items that we think are what most organizations have as far as goals. First of all, of course, just as we've implied here, knowing what you have and how to find it. That's really the starting point here, because that's tying into that whole issue of dark data. Do you know what you have?

Do you know where it's at? If you don't, then anyone else might be able to find it, including not just hackers but attorneys who might come in and do a discovery exercise. So if you don't know what you have, that risk just is compounded as well. And then, as indicated before, speeding the incident response time. So if you do get hacked, such as the example of the ransomware attack, and you know how to find the information that you're looking for, so like in the example that Rick mentioned of being able to quickly find those emails that could be clicked on and used as an attack, then you're going to be able to speed the response time for preventing an attack, as well as potentially the cleanup of something if you do happen to get attacked and it does get loose. And that ties into this next one too, and that is any kind of a threat mitigation. If you know that you are being threatened, and you know, for example, where your vital records are, and you can pull those out and protect them, maybe in a more secure area, then you're going to be able to close that threat off much faster. But if you have to spend hours just trying to figure out what you have and where and how it's classified, it's going to be much more difficult to do so. And in terms of regulatory compliance, Rick mentioned a couple of them, such as GDPR, CCPA, but there are a number of other ones as well. If you are in finance, then you have a number of SEC and FINRA regulations to pay attention to. If you are in pharmaceutical, then you have regulations from the FDA and ISO and a number of others. So every industry might have its specific ones, but probably every organization now is paying attention to the ISO regulations regarding just how you do business, how you secure your records and so forth. And so all of those are things that may have either specific retention requirements or specific compelled destruction requirements, and in some cases those actually conflict, because you might have in one case a law that says you have to keep it for seven years, but another law that says you keep it only as long as it's needed because it's personal information. And how do you balance those goals and make a cohesive schedule of that regulatory compliance? And that ties into the next part too, and it ties into one of the other threats that Rick mentioned in his slide, and that is the ability to quickly and efficiently apply retention holds.

And it all ties into the other parts here as well. If you have to apply a retention hold based on records that a certain user owns, then can you find those records that the user owns? Because it goes back to knowing what you have and how to find it. And can you apply the retention holds where you know that it will actually be protected from disposition, or protected from alteration? So even if you can find it, can you actually lock it down and make sure that it is not being altered in any way?

And then, of course, once things are not on hold, the goal is to dispose of those records when legally defensible. So that ties into being able to know what the compliance issues are, the retention rules, but also the more that you can dispose of, the less of a surface area that you have available to attack, or available to discover. So it can reduce your risk surface area in a number of different ways. And so in most cases people are typically just keeping everything for as long as they can, because they're just concerned they might need it for some litigation, but in most cases most of the information you have can be disposed of, and do so legally, and protect you in terms of those risks that come from having too much information, especially when you don't know what's out there. And trying to avoid that redundant, obsolete and trivial information, the dark data, that's what we're trying to do. We're trying to make sure that it is as transparent as possible in terms of what you have, so that you can know with confidence what it is that you have and how to govern it effectively.

And so with that, we've come up with a model that we think is helpful for users to understand the way that this might work from a strategy perspective. It's a fairly simple diagram that we came up with, but basically trying to increase the level of compliance, following those regulatory guidelines, but also the automation in terms of how you operationalize that compliance. So again, if you have 200 different systems and you have to manually apply retention and disposition to each one of those, then that's going to take a long time, and you're likely not to do it. So the more you can automate, the more likely you are to actually achieve that compliance. So most people start there in that lower left-hand corner with not very much automation, and maybe compliant, maybe not, maybe not sure, and you want to take the path where you go up and to the right to achieve a higher level of compliance and a higher level of automation. Of course, as Rick has pointed out, with the Sherpa Software, part of that is the data discovery, that first step: being able to know what you have, being able to purge the ROT, just understanding what information you have based on whether it's privacy or whether it's contract related, etc. That's the first step. From there, if you can then take that information that you found and be able to map that to a records retention schedule, assuming you have a retention schedule, which of course is part of the process as well, then you know not only what you have and where, but you know the importance, you know the regulatory issues and so on that we talked about, and you can go on to the next step, which is to be able to automatically apply retention and dispose of those records, to get you to that sweet spot there in the upper right-hand corner, getting to the finish line.

Obviously, a very simplified model, but that's where people usually are wanting to get to, and there's a number of steps. Depending on where you're starting, you might be starting out higher or lower on that scale, on either automation or compliance, and your needs may change whether you're in manufacturing versus finance versus pharma, etc., depending on just what those goals are.

Rick Wilson: Yeah, perfect, Warren. So I know that as we talked, we thought our two solutions together could articulate that diagram we've looked at. So what we'd like to do is show you an example of how that might work. We've given you all these dire statistics and the information about threats to your organization, but we'd like to give you some ideas about how you might be able to solve that. So I'm going to take care of showing you part of the data discovery and perhaps some of that ROT purging capability, as we think about that diagram as it was swooping up to the right-hand corner, and then Warren will pick it up from the records management point of view. So we're going to flip over and take a look at one of Sherpa's tools.

[Slide: Demo: Sherpa Altitude IG web console (login, then home dashboard with Connectors, Data Sources, Data Targets and Data Owners tiles).]

This is our Altitude software, a management tool for your information, both unstructured, and recently we added support for structured. So I'm going to go ahead and log in to my SaaS dashboard here where I can manage my content. Altitude works through this cloud environment where you as an administrator can come in, whether you're the records manager, the IT person, perhaps the privacy or security folks, and you can create roles that allow you to manage your information. And that information could be in lots of different repositories. You'll notice in the Data Source block here, we're currently only attached to one type of information for our demonstration today, that is file information that might be on a workstation or network share, but Altitude supports eight or nine other types of content areas that you can use in conjunction by installing the agents for the content area you need: SharePoint, OneDrive, Google, that sort of thing.

Office 365 certainly is typically found. Once we've installed those agents and configured them to look at a location, Warren's desktop machine, Rick's laptop, the network file share that the sales team uses, etc., then you can move into what we call data governance. So Data Governance is the module of Altitude that allows you to articulate a set of business rules against your content. Here are the various types of criteria that we're going to use to examine information, and that could be metadata, age, date, size, last access, things like that, or it could be a little bit more sophisticated. We could open the items, the files, the messages, the attachments, and look at content inside those for words or phrases or patterns using regular expressions and things like that. So what we've done in this example is we've written a little workflow. That's what we call the component that allows you to map out these business rules. We've written a workflow that's going to look at this file-based content, and in this example we're identifying two different types of categories of content that we want to take some kind of an action on. So this workflow begins, you see it looks like a flowchart, by scanning a particular path that we assign it to. Could be on your hard drive, or your C drive on your machine, could be on a network share, etc. And as we go through the hierarchy of that content, you can see it moving down from the path to the folder to the file, and at all these levels you can add some filtering to narrow the focus of your business process. So in this example we've added a filter for specific types of files, so you can see a little highlight over here on the right of file types that we've selected that we want to include as part of our examination. Maybe you're not interested in DLLs and EXEs and things like that, but you do want to look at Microsoft Office files and PDFs and ZIP files and RARs and that sort of thing. So using this test, we were able to focus that examination a little bit finer. And then when we find a matching file, in this case based on file type, we're going to check it for two things. So I've got one check that's going on for a set of keyword criteria that might help me identify it as a contract, and then I've got a second test that looks for terms that might identify it, or patterns that might identify it, as PII. So if I look at this keyword test, you can see it opens the file and it actually searches the contents of the file, and in this case I'm just looking for a simple word, the word "agreement." So if that file contains the word "agreement," I might think it's a contract, or it might be eligible for a contract, but I could certainly layer a number of other terms, so it could be agreement or force majeure or contract or settlement, all those things that might be indicative of a contract. When I find one of those, then I'm going to put an entry on an audit report. That's what this Set Values is: we're saving some information for the report. And I'm going to copy that file to another location. So the idea here is sweep a variety of content, maybe the 10,000 workstations that are on the network, look for documents that meet these categories, and then copy them in this example, but this could just as easily be a move instead of a copy, to a designated storage location. And as we continue through the scenario here, you'll see that's where the Zasio tools are going to look for, pick up those documents for management. So we're going to copy those, or we're going to store them in a particular repository called Sherpa Documents. In this case, for PII, we're doing something very similar.

We're checking for Social Security numbers, and you can see here there's some text, so we're doing a combination of text along with patterns for Social Security number or credit card. So we're checking to make sure, does it meet the Luhn algorithm, and does it have the right number of digits, and does it maybe have the word Visa or MasterCard or what have you. And the same thing with Social Security number, and the same process applies. We'll put an entry on the audit report when we find a matching file, and then we're going to copy it, and in this case those are going to a folder called Sherpa PII, which will be a target folder for the Zasio tools. So after we've articulated that business rule in our workflow here, we save it up to the web and then we attach it to a policy to actually execute it. So in this policy you have the ability to determine what file paths are going to be examined by those business rules: which workstations, which network shares, which OneDrive file sites, or which Office 365 mailboxes, for example, are we going to be examining during the course of this policy. And then we can set that up and run it. In my example here, as the actions took place, I created a report, and you can see here are the items that we identified. So it created the name of the file on the report here, the location we found it in, the location we moved it to. This one looked like it had PII, and we've masked that PII because maybe we don't want to propagate that, but we can see that this looks like a Social Security pattern based on the mask. Also added the last access date for the file. Now if you want to get a little bit more information about what was inside that document, you do have the option of bringing back a content snapshot, and that's what these little pink icons indicate in this column. So if I go down to one of these, this one looks like a credit card, so it contains PII. I can tell by the mask this looks like a credit card format. I'm going to open that text view, and this will give me an idea of actually what was contained inside that document. Now the actual file itself is still in place on the device or the mailbox or the OneDrive site where we located it, but we've done a text extraction and we've attached that to this report so that you can validate it, or maybe determine if it might be a false positive. This step's optional. Sometimes clients highly value it, sometimes it's not important at all, or it might be a security breach in your situation, so you're in control of that, whether you want to see that information or not when you bring it back. And from that point you can do a couple of things. You can take some kind of remediation action on this item by attaching a label to it, or in our example, we're outputting it to a specific file path location so that Zasio's Versatile application can pick it up. And I'm going to flip content presenter control over to Warren at this point, so he can show you how that would work.

[Slide: Demo: Zasio virtual machine desktop with Versatile Retention, Versatile Enterprise and Versatile ERMS among the application icons.]

Warren Bean: Thank you, Rick. [Rick Wilson: No problem.] Grab the right window. All right, so yeah, the plan here is to just follow through on what Rick has done on the Sherpa Altitude side, to help you sort out, in this case, PII and some contract information, and say, well, okay, now that we've found it, what do we do with it, and how do you govern it from there? So that's where Sherpa has the strength of going in and finding what you have, doing the detailed analysis, and on our side we've got more of the tools to take it from there and move it along through the rest of its life cycle. So again, that's where we found our synergy between our two solutions, and came up with something that I think will work out well there. And just to help understand some of the things that we've got in play here, I'm just going to highlight these three icons. Some of the things that we specialize in terms of our products are basically a retention schedule management, based on this Versatile Retention product; records management, indicated here by Versatile Enterprise; and then electronic records management, by the icon you see here for Versatile ERMS. And that's going to be the one that we focus on the most. I'll just make one reference as we go along here to Enterprise, to show you some pieces that flow into the electronic records. But with that, the question is, okay, so what about those documents that the Sherpa system found and categorized for us and collated for us? So the idea is that to manage those, we need a place to put them, or a place to categorize them. And so before I go into those folders that we use to track that, let me just explain briefly what Versatile ERMS is. From the very simplest aspect, it's simply a list of electronic folders that you can create and put things into. That's really the basic form, but the more important aspect is what's happening when you do put things into this repository. And as an example, let me just take this one here, like Contracts and Agreements. If I look at the properties of this, this is really the key here, and that is all of the properties here actually linked into our total records management system, that is Versatile Enterprise. So from here I can assign the company and department ownership, such as Zasio as the company, Legal as the department, and then most importantly, assign it to a records retention category. So essentially, from this folder, we have access to all of our retention categories and properties. In this case I've got just a functional schedule, two levels, and obviously this is coming under the Legal heading, and this is allowing us to assign anything from our retention schedule to the folder. Seems pretty simple, but if you can imagine that if you grant access to this folder from a user perspective, then all he or she needs to do is be able to open that folder, if they've got access, and be able to drag and drop things in, save from applications, capture from email, and anything that goes into this folder is automatically categorized under that heading, under that policy. So if I look at any document here and look at the properties, we'll see that, for example, it has an automatically calculated destruction date. So there's no guesswork anymore as far as how long that document should be kept. It's going to be kept according to the properties that we assigned to the folder, and each one of those record series has rules behind it to determine how that calculation is done. But that's where it's sometimes helpful to look at the Versatile Enterprise application, just to see where those rules are defined and how they work. So if I go into the Organization section here and into Record Series, then we'll see that same list that I was looking at a moment ago. Actually, it's under that Global listing. Here's that same list of functional categories, the same Legal group, and here's that General Contracts and Agreements, and you can see that we've got the basic definition of a record series category, with its codes and titles and descriptions and so forth. But the real key is the retention calculation here, which in this case happens to be last modified date plus 10 years. And obviously there's lots of different ways to calculate that. This happens to be event-based; they can be standard time-based, all different ways to manage that, including calculating from fiscal year versus calendar, and from the beginning date or the end date, all different ways that we can use this methodology to calculate the appropriate retention. But the idea is that you can set up all of your retention rules and categories here in Versatile Enterprise, and those can be automatically applied to the records here once they land in ERMS. And the structure that you use here doesn't really matter. It could be by retention schedule, it could be by department, by users. It doesn't matter which way that you want to do that; the same kind of rules would apply, where every folder or subfolder could have a separate rule in terms of retention, and that would drive the disposition as well. So the other thing to consider here is that items that are in these folders can also be put on hold, as you can see from a couple of these items that I've got here that have this H overlay on them. So all of these are items that have been put into a hold batch, so that they can't be altered or destroyed.

And so that's another aspect of the Versatile ERMS system, to be able to protect them in that state. And in other cases we have items that are pending review, items that have been approved, and so a number of different statuses you can use to highlight exactly what's going on with that. And then one other point to note about the information we're tracking: we also have a number of metadata fields that can be used to add value to that. So a lot of this is collected automatically, just as you file a record into the system. Others can be filled in based on the requirements of that type of document, and others are things like audit trails that the system automatically tracks, where you know exactly when the document was added, when it was last viewed, approved, etc., and that just stays with it for the life of that record. So lots of additional value that we're providing there in terms of what you can do with that information, and how we are trying to give you the tools to manage that. So what about those documents from the Sherpa Altitude application? Basically, if I go a little bit further here, you'll see that I've created a folder for Sherpa documents, and I've created a couple of special types of folders where they've got these little globe icons on them, and that indicates to me that these are ones where the content is not stored natively in our repository. It's actually stored out in another location. In this case, that location is the repositories, or those folders where those Sherpa documents landed after being discovered by the Altitude software. So if I go into Discovered Contracts, you can see here are those ones where that word "agreement" occurred, either as part of the title or part of the content. And each one of them again has those properties where I can see when they're eligible for destruction. I've got the metadata, the audit trails, etc., all the same properties we saw a moment ago. Same thing for the ones that had PII. This is just monitoring that output from the Sherpa system, and any time that the folder there is updated, we're pulling that information in. But again, we're not storing that content here.

We're not duplicating the content from Sherpa; we're simply giving you a window into that information. This one's a little bit different in the sense that I set up a rule in the folder that says anything coming into these areas should automatically be an approved record, rather than being something where it could be editable and transitory. These are going to be approved records, so that we can only get rid of them if we go through a defined approval and disposition process. But for any of these items, I can open them up and view them just as if they were on my local repository, and work with them like they're on a shared drive or something local, but they all are residing in that folder where Sherpa put them. So from here, if we wanted to take this full circle, if we wanted to be able to defensibly destroy these, then of course one of the things we might do is run a search for what's eligible for destruction. So part of the search tools that we build into ERMS, you can search by keywords and all kinds of different criteria, but I'll just focus on the destruction date criteria for now, and just say, let's just look for anything eligible for destruction in this folder up through today's date. So we find our eligible items, and these are all based on that automatic calculation. And so from there, if we wanted to take all of those and just say, let's go ahead and add them to the batch, this is basically putting them into our destruction batch, and we'll confirm, yes, that's what we want to do. So those items have now been put onto a destruction batch. So if we wanted to go ahead and finalize that destruction, then we can go into Versatile Enterprise, where we do all of our records management functions, and within this we have our Dispositions section.

And if I just look at the last batch that was created, here is the batch that we added items to. We've got those items here showing the details of the documents that we just added to that batch, with the status. We can drill down into some additional details here as far as approvals and such, but the idea is that we would basically use this as a way to give people notification about items that are ready for this disposition. We can go through an authorization and disposition process to get our approvals, which I won't go through here in this demonstration, but basically we're trying to get to that goal of being able to say, hey, let's go ahead and destroy those items, and say, let's go ahead and destroy that batch. And that has now been executed. We can see that we have destroyed that; we've got an audit trail showing that. So those have now been put into a destroyed status. And so if we go back out to our ERMS folder, what you'll see is that these still exist temporarily in our Sherpa folder, but they are ready to be destroyed. These items with the red X mean that they have been flagged for destruction, so the next time that synchronizes, either automatically or manually, those will be deleted from that source folder. So I'll go ahead and just do that synchronization now, and so that process will go ahead and delete them from that folder where the Sherpa system deposited them, and be able to basically complete that cycle, complete with audit trails and the ability to manage that process. So now we've only got one item left, and those documents are no longer accessible, whether it's for discovery, for hackers to access and get a hold of. That has been defensibly destroyed based on a retention schedule. So obviously that's the ultimate goal, in terms of being able to find the information, to put it in its proper place, go through the disposition process, and be able to manage that effectively. And of course, in between time, obviously searching and all kinds of other options available to be able to give you the complete information governance picture. So to recap what we're trying to show here: the more control and management that you put in place over your records, and knowing what you have, discovering it based on those different criteria like we saw with the Sherpa Altitude software, and making sure that you destroy it when it's ready to be destroyed, the more you can do so, the better off you'll be in terms of knowing what you're protecting, knowing where it's at, making sure there's not too much out there to be found, and completing that information governance picture for you.

Rick, did you have anything else you wanted to add to that recap, or that overall goal?

Rick Wilson: No matter how many times I see that, Warren, I'm still impressed. Nice, nice job. Yeah, I think our capabilities really interface nicely, on that data discovery, data management side, and then being able to hand it off to your records retention processing. Great. Michelle, did we have any questions come in during the course of our discussion?

Michelle: We did have a couple come in, so I can start going through those for the last 10 minutes. So the first one came in, and I think it was when Warren was going over ERMS, but it's: [audience question] what kind of encryption is on the scan over the web?

Rick Wilson: So our document scanning actually takes place where the document resides. As we pass the information back into our web console for you to be able to view it, like those report extracts I showed you, the text extracts, that's all done via HTTPS, so we're using the standard HTTPS protocol. We found that that was typically the easiest thing for clients to implement, since they typically have port 443 open already, and it doesn't require a lot of firewall modifications.

Michelle: Okay, anything else on that one? [Rick Wilson: I don't think so.] All right, then we have: [audience question] how long is the data stored at your place, who has access, and is that encrypted as well? As a follow-up, it looks like, to that question.

Rick Wilson: Sure, so I'll give you the Sherpa answer, and then Warren can chime in with his answer. So from a Sherpa point of view, every customer who is an administrator in your Altitude environment has control over that information. So if you delete, for example, one of those reports I showed you, that information is gone. It's purged out of the database. Everything's being stored in a SQL Server database inside the data center, and that's being kept on an encrypted server. So it is in a real data center environment. We use Rackspace as our provider for data center services, so it's very secure. We've got all the SOC audits to prove that they have all the authorization in place, all the processes in place to secure that content, and it's locked on an encrypted server inside a SQL Server database.

Warren Bean: Yeah, and to follow up on that one, Rick, on the Zasio side, of course it's going to tie back to your retention schedule. I mean, obviously you have a lot of data that would not be necessarily subject to a retention schedule. It might be just transitory information, but even with that, you can have something in the retention schedule that deals with transitory data, to make sure that it's destroyed and done so in a timely fashion. But otherwise, then each bucket that you have in the retention schedule should govern how long you keep each of those types of records, and utilize a system like Versatile to tell you when they're eligible for destruction, give you those reports, and give you the ability to successfully purge those.

Michelle: Great. Next one: [audience question] can ERMS protect the documents found by Sherpa from being destroyed?

Warren Bean: They can, and that depends in some cases on how we are integrating, and also with what we're integrating. So in the case of integrating with a file share, like we made an example of here with the Sherpa records, there's a couple things that can be done. For example, when you put a document on hold, I don't think I had any of these on hold, but if I put this document on hold, for example, that would actually mark the file as read-only in its source repository, to prevent that destruction. Now, someone who knows how to undo that read-only status could potentially delete that, so it's not a foolproof way to do that. But we also, in this model, mentioned that the data is not stored in our repository. We're just keeping the data in its source repository, and this is really just more of a pointer to that.

But we can actually change the properties of the synchronization to do a full content synchronization, so that we actually pull the data as a duplicate of its source into the system. And if we do so, then if we put the approved status or a hold status on it, then it's in our system and it's locked down, and you can't delete it, because we're protecting that. So if you have something that is maybe a vital record, but you want to manage it in place, you might want to consider in that case actually making a replication of that data into the ERMS system, so you can fully protect it. And that way, if it does get maybe hacked with ransomware or something, you still have the protected copy in our system that is there in the records management environment.

Rick Wilson: Yeah, Warren, just a springboard off of that: I showed the fact that you can tag or label items that Altitude's identified for further processing. So we could move them into the folders, as you described already, allow you to take that action where you put them into the repository, and then you could use Altitude to be able to go back and delete the original copy of that information. So that's trying to close the loop on that source version that might be located on a workstation where it shouldn't be, or a file share.

Warren Bean: Yeah, that's a good point, because there's a lot of different strategies you can take as far as whether you're copying, moving, replicating. Yeah, there's a number of different ways to tackle that, and I think each type of content might have to go through a decision process as to how you want to go about managing that.

Michelle: [Speaker: Sure.] Great. Another question that came in during the demo: [audience question] you showed how Altitude could manage documents on a file share; can it also be used on workstations?

Rick Wilson: Yeah, it can, Michelle. We support Windows only today, so we're working on a roadmap to add a Mac component to support the Mac desktop, but today, with any Windows workstation, you can install Altitude on it. In fact, our largest Altitude client today is about 112,000 workstations that they manage for data retention, data remediation, security searching, things like that.

Warren Bean: [inaudible] Yeah, in fact, in this example, basically it was a very simple process. I just installed a very small agent on this demo workstation, and Rick has been able to do all of the setup and managing that remotely. So then I just had to point ERMS at that folder locally. In fact, that was one of the cool things about when we collaborated on this, is that it didn't take any additional coding or APIs. They simply used their default functionality, we used our default functionality, and we were set up in very short order.

Michelle: Great. [audience question] Does your tool work with Microsoft 365?

Rick Wilson: From a Sherpa point of view, we certainly do. So probably 85, 90 percent of our customers today have some or all of the 365 suite involved. So we do have support for 365 email, SharePoint and OneDrive. We're working on Teams right now. Don't have that yet, but it should be coming soon.

Warren Bean: Yeah, and same here. We work a lot with 365, as far as either synchronizing with email, applying the retention rules to the 365 retention labels, so that you can apply retention in those different repositories. So yeah, definitely integration available there as well.

Michelle: Great. Let's see: [audience question] are the Sherpa documents searchable through ERMS?

Warren Bean: Oh, they are. Yeah, I should have made a point of that. So one quick example here would be if I searched on the word "employee," it would find this. Now, one caveat is that, being that I'm not storing the content locally here, if I do a search within this context, I wouldn't be able to search the content inside of that spreadsheet that's stored in the remote file. It's only going to be searching on the metadata that I've got here, such as the titles, the dates, the categories, etc. However, that's not the case for all situations. As an example, if I go into my external folders setup here, we have the ability to point this to things like Box and Dropbox and Google Drive and OneDrive and so forth. And a lot of those, I know Google Drive and OneDrive in particular, I can search the content in those even if I'm not storing the content locally. So in other words, the API that we use to connect to Google Drive, for example, when I do a search, I can do a search not only on the titles and the things that I'm storing here, but the actual content of this spreadsheet as it's stored on Google Drive, or a Word document, or PowerPoint, etc. So it just depends on the type of connector and what capabilities the API for that connector provides to us.

Michelle: Great. It looks like we just have a couple more, so we're doing well on time. [audience question] Could your product be considered a DLP solution?

Rick Wilson: Yeah, Michelle, from our point of view, we typically are not falling into that category, only because Altitude doesn't work real time. So a lot of our customers who are asking that question are expecting, for example, as an employee saves a document or they send an email, for that document or email to be scanned and perhaps rejected or prohibited from being saved or sent through the email gateway. Altitude works in a batch format against content at rest, where it resides on your workstation, your file share, your other repositories in your environment. So it's not a traditional DLP, but it's a great complement to a DLP, because DLPs are great for current data, data in motion, as you create it, save it, manipulate it, modify it. However, it doesn't help you much with all of the historical content, and as we talked about on that Databerg slide, there's a ton of that out in most environments that has been around for many, many years.

Warren Bean: Yeah, I would say that the same is true for us as far as data loss prevention. Ours is more of a repository and governance tool versus a real-time monitoring tool.

Michelle: Perfect. Okay, last question: [audience question] how difficult is it to set up new connections between Versatile and Sherpa?

Warren Bean: Let's see, Rick, I think we did ours in about 20 minutes.

Rick Wilson: That's probably a good estimate, Warren. Yeah, it was fairly straightforward. A little more difficult if you're going to do thousands of workstations, probably, but it's not a very onerous process, I would say.

Warren Bean: And just to give an idea of that, we have a management console here, and when we set up an external connection, in this case it was just a matter of saying, hey, we're going to point Versatile at a file system. And so we created a couple of connectors to the Sherpa docs, and it's basically just creating that connector to point to the location where those are going to reside. And then within ERMS itself, just came in and created a folder using that connector. So when it came to creating these, that was just a matter of saying, well, let's create a new external folder, and we're going to use the file system pointer that we created for those Sherpa documents or PII, and that's going to point there and sync up with it. And so it's a pretty straightforward process, again, no coding involved or anything else. By the way, this is where you can tell that you actually want to have it synchronize the contents as well as the metadata. So if you did want to replicate some of that data, you can do that here, and then you can set up the synchronization schedule, if you want to go every 10 minutes or every hour or daily, whatever the case might want to be. So that's just about all it takes. It's pretty easy to do.

Michelle: Awesome, thanks, Warren. So it looks like we are about at time, so just wanted to thank everyone for attending today's webinar. Again, we will send out the copy of the recording, and we'll try to send out the PDF of the slide deck as well. If you have any follow-up questions, feel free to reach out to Rick or Warren. We'll include their contact information in our follow-up. Thank you again, and have a great day, everyone. Thanks, everyone, thanks for joining. Bye.