The most popular and comprehensive Open Source ECM platform
Let us know more
Enterprise Search: Security Headache
Enterprise Search centralizes and standardizes search across all enterprise data sources and repositories into a single system. The benefits of an Enterprise Search solution include:
- Promotes collaboration
- Improves and accelerates decision making
- Higher productivity
- Better communication
- Better compliance with regulatory requirements around audits and version control
- A single common interface that can be used consistently across the organization
- Uncovers otherwise overlooked data and documents that can be reclaimed and repurposed
While the benefits of Enterprise Search are many, some companies are now being bitten by a down side of the technology. Keeping sensitive data out of view from the search crawler can be tricky.
For example, InformationWeek cites a case where a defense contractor discovered that their enterprise search results allowed users on their non-classified system to see data stored on the classified network.
The problem boils down to the difficulty in mapping security from many diverse systems into the central search engine’s authorization system. Ideally all information of every level of sensitivity should be captured and made accessible via search, but assigning access permissions and being able to know how to map permissions to all users in the organization can be daunting, especially when so many documents still reside on file servers.
Because of the challenge, some companies are playing it safe and putting much broader restrictions on search access just to make sure that access permission mistakes aren’t made. The alternative is to be very careful with data access authorization settings. Wells Fargo, for example, estimates that they spend 80% of their application development and deployment time issues surrounding authorization and authentication.
Sometimes data repositories that were seemingly secure for years may not seem so secure after being exposed to enterprise search. The data scanning capability of enterprise search can index and expose information that may have been misclassified to users that should not have access.
The impulse is to err on the side of safety and impose restrictions on the search. But any restrictions also dilute the benefits of the technology, and finding the right point that balance the two requirements can be tricky.
