SharePoint MetaData and Classification

Using Microsoft Word Quick Parts to Add Metadata to SharePoint

I recently came upon a new way to add metadata to SharePoint.  Using Quick Parts in Word documents allow users to quickly add metadata without them even knowing about it!

Typically Quick Parts would be used in templates or forms where you want users to fill in standard fields.  This can also be done using Microsoft InfoPath, but that would require a more sophisticated user or administrator to set it up.

The steps to set this up using Quick Parts are as follows:

1. Create the custom columns in SharePoint that will be used to store the metadata.
2. Add the Quick Parts to a Microsoft Word document that is created in SharePoint. These Quick Parts will point to the metadata columns just created in SharePoint.
3. Save this Word document as a template in the SharePoint library
4. Users can then open the template when they click "New" in the SharePoint Document Library
5. Users populate the Quick Part with the metadata, either by typing it in, or by selecting from a dropdown.
6. When the doucment is saved into SharePoint, the metadata is saved into the SharePoint columns.

This is explained in more detail in an excellent blog by Kevin DeRudder called Using quickparts in document templates.

Here is my quick example. I created a document library that is used to save administrative documents for a cruise ship company.   I added 2 new columns to the library called Cruise Month, which captures which month the ship sailed, and Cruise Classification, which captures the classification of the document. (Click image to get larger view)

I then created a word document and inserted these columns from Quick Parts

Here is the Word document.

I then save the Word document locally, and copy this document to the SharePoint document library template folder.

Then when users click on New document in Sharepoint, this template is opened.  The users can change the values of the Quick Parts:

When the user saves the document back to SharePoint the values in the Quick Parts are automatically added to the appropriate columns in SharePoint.

 

  

RegExs – How TMC Can Protect Vulnerable PII

Regular Expressions or (RegEx’s) are alphanumeric grouping of characters that have a specific pattern (and relevance or meaning to an application, entity or consumer). Many programming languages have built in regular expression engines to allow the parsing of data to find these patterns. Let’s take a look at a quick example.

Many security standards emerging or present in today’s market focus on the protection of PII (Personally Identifiable Information). Items such as national identification numbers (such as the US Social Security Number or the UK’s National Health Service Number) are government issued identification cards used for everything from tracking employment to assuring healthcare for its citizens. In addition, privately issued items like credit cards and university student ID numbers are also the focus of predatory attacks (if you’re curious, browse The Data Breach Blog for examples of theft as well as the potential impact to corporations, governments and private citizens).

The emergence of global security standards like PCI DSS in financial markets as well as government driven legislation (like the recently announced HITECH Act in the United States as well as privacy/security legislation developed by the European Union) have created the following requirements:

· Requirements to monitor requests for and the ongoing protection of PII

· Financial and punitive penalties for offending organizations who disclose PII

Obviously, this impacts a range of business markets, multiple levels of government as well as the consumer. It makes sense that there exists greater willingness to work with a company or provider that takes the PII threat seriously and have policies and systems in place to minimize the threat of information loss.

As part of our Message Classification for Outlook product, customers can now define not only keywords but use pre-defined or built-in regular expressions TMC’s Content Validation policy provides capabilities to search for specific regular expressions and warn the customer of their presence in the email message or an attachment.

To check emails and attachments for regular expressions, the TMC Administrator creates a Content Validation policy and defines whether they wish to check for keywords, regular expressions or both. Several regular expressions are pre-defined, and customers can build their own regular expressions if they wish (for a good reference, see the fantastic regular expression cheat sheet developed by Dave Child here).

Now, let’s move back to what the consumer experience is like. In the following scenario, an employee unknowingly attaches a Microsoft Office document which contains Social Security Number information, clicks Send, and classifies the email as Public. The Content Validation policy finds the SSN in the Word document and notifies the sender of the issue.

 

TMC provides customers several strong benefits for organizations concerned with PII protection:

1.    Immediate analysis (warnings are presented to the user at the same time the email is sent vs. feedback from a quarantine mailbox)

2.    Feedback to the consumer can be customized (the TMC Administrator can create information messages indicating why the error occurred as well as steps to be taken to rectify the problem)

3.    Adaptable controls (the TMC Administrator can simply warn the user of the issue but give them final decision on delivery or prevent sending the message until the sensitive content is removed from the message body or attachment.

4.    Monitored – all policy events in TMC are written to the Windows Event Log (which can be parsed for reporting to identify common errors (resulting in guidance on where employees may need training or policies may need to be refined.

 

I would be happy to receive feedback on regular expressions you would like to see added to the product. Please feel free to contact me at stephen.kingston@titus-labs.com.

 

-Stephen Kingston

 

Preventing Users From Attaching Sensitive SharePoint Documents to Email

Like many organizations, you've probably moved a lot of your corporate documents to SharePoint. What used to be hidden away on personal drives or shared folders can now be shared with a wider audience, helping to improve communication and decision making within your organization. But this greater accessibility comes at a cost to security; anyone who can view a document in SharePoint can use the Save As option to copy the document to their local computer. Users can then easily attach the document to an email and send it out. Many times this isn't even a malicious action; the user simply doesn't realize that the document is sensitive, or isn't thinking of the consequences of emailing sensitive information over the internet.

 

So what can you do to stop this? Short of implementing an enterprise rights management (ERM) solution such as Microsoft Rights Management Services (RMS), you can solve the problem in the following ways:

 

1) Use a product likeTitus Labs Metadata Security for SharePoint to prevent unauthorized users from seeing the document in the first place. This is a good solution if you want to restrict documents to certain users, rather than allowing access to everyone in the organization.

2) Use a product likeTitus Labs Message Classification to scan the content of attached documents, and warn the user if they are attempting to send a SharePoint document that is sensitive.
 
The second solution is what I'd like to focus on for today's blog entry. The ability to scan attached documents is something we've recently added to our Message Classification for Outlook product.  The solution scans email and attached documents after the user clicks Send, and warns the user if they are about to expose sensitive information to unauthorized recipients. The feedback is immediate, like a spell check, helping to raise awareness and educate users on corporate email policy.  Here is a sample screen shot:

 

 

You can also view a 3 minute demo here.

 

Message Classification is a great solution if you have specific keywords or regular expressions/text patterns that identify a sensitive document. For example, you may have SharePoint documents containing special project names or codes, or you may have documents with headers and footers that indicate the document is confidential. Message Classification can identify these types of documents, and prevent the user from sending them in email. It's the best of both worlds; you can still collaborate on these documents in SharePoint, but you can also prevent email slips by users.

 

As a client-based solution, Message Classification avoids the problem of email being blocked at the gateway due to false positives. If an email is incorrectly identified as sensitive, users can be given the option to override the warning and send the email anyway. This puts accountability on the user, while providing the flexibility to ensure business processes are minimally impacted by false positives. All warnings and overrides are logged, which means organizations can easily identify areas of concern, such as employees generating high numbers of overrides, or keywords that are triggering the most warnings.

 

Next week, our Product Manager, Stephen Kingston, will go into more detail about how you can use regular expressions to find these sensitive documents in email.

 

-Lara

 

Labeling and Watermarking SharePoint Documents When Opened

Back in January I discussed Timestamping and Tracking SharePoint Documents. Organizations want to track what happens to their SharePoint documents when they are downloaded or opened because a lot of people are dealing with sensitive documents. In the first release of our Document Marking for SharePoint product we could help organizations watermark or timestamp SharePoint documents when they were first saved to SharePoint.  But this didn't help organizations that wanted to apply labels, watermarks or timestamps when a document was opened or downloaded.

I'm happy to say that we have added this feature in R2 of our Document Marking product which is now available. In this release you can specify that you want to add a header, footer or watermark when a document is opened (checked-out, downloaded) from a SharePoint document library.  The policy is applied at the library level and is applied to all PDF documents in the library.  Here is an example of an administrator defined policy for a library.  In this example we will be inserting the current user's name into the header and footer of the PDF, and we will be inserting a timestamp in the watermark.  This policy will be applied to all PDF documents in this Document Library:

 
(Click to get larger view) 

Here is an example of what a PDF document would look like once the policy has been applied.  In this case we are signed on as the Administrator, so that is the current user displayed in the header.  One thing to note is that the PDF copy the viewer sees contains the labels, but the original version in the SharePoint Document Library is not modified.  So if the organization ever decides to change the labels in the future, there will be no issues.

 

If you want to apply these types of labels to Microsoft Office documents rather than PDFs, you can use the Doucment Marking product in conjunction with our PDF Control solution to automatically convert Office documents to PDF in SharePoint.  This solution will allow you to retain all the Office documents in their original source, but SharePoint users will see the PDF version of the document.

Email Data Loss Prevention and the Windows Server 2008 R2 File Classification Infrastructure

This is a copy of a blog I wrote jointly with Microsoft.  It can be viewed on the Microsoft Windows Server WebLog at

http://blogs.technet.com/windowsserver/archive/2010/02/25/prevent-loss-of-sensitive-information-using-the-windows-server-2008-r2-file-classification-infrastructure.aspx

 

There has been a lot of talk lately about data breaches costing organizations millions of dollars in fines or lawsuits not to mention the bad publicity and other intangible losses.  Data Loss Prevention products are being deployed to try to help organizations minimize these types of incidents. Information classification can be used to prevent data breaches and help organizations with compliance requirements such as PCI, HIIPA, ISO 27001, the Massachusetts Data Protection Law 201 and other similar legislation.

 

The new File Classification Infrastructure (FCI) in Microsoft Windows 2008 R2 enables organizations to protect data by automatically classifying files and applying policy. FCI includes the ability to define classification properties, automatically classify files based on location and content, and invoke file management tasks such as file expiration and custom commands based on classification. Once the files have been classified, appropriate security can be applied based on the business value of the information.  For example, in a PCI environment, FCI based classification can be used to identify files that contain sensitive credit card information, and in a health care environment, FCI based classification can identify files with private health information.  Once the files have been classified file management tasks can be used to segment sensitive files onto more secure storage devices, to protect files with encryption, and to assign more restrictive permissions to the files. This helps ensure that information stored on file servers is well secured. 

 

Another concern is email.  Email messages or email attachments are a security risk as email cannot easily be controlled.  At Titus Labs  we’ve extended classification and information protection to the Microsoft Outlook environment. Titus Labs Message Classification can recognize file attachments that have been classified using FCI.

 

The Titus Labs solution can examine the FCI classifications of Microsoft Office attachments, and can apply policy that can restrict the distribution of sensitive information.  Titus Labs’ Safe Recipient policies can be used to:

 

1. Protect the distribution of email within an organization. By examining all the recipients of an email, the Titus Labs policy can verify via Active Directory whether the recipient is allowed to receive attachments of a given classification. This prevents inadvertent data loss by warning the user that one of the recipients should be removed. For example, in an internal scenario, a financial organization may want to ensure that an employee in corporate finance is restricted from sending files classified as MERGER / ACQUISITION to another employee working as a broker or trader.

2. Protect the distribution of email outside the organization. By examining the domain of each of the recipients, the Titus Labs policy can verify that the domain is listed as trusted in the policy and can warn the user of a possible data breach and warn them or force them to change the recipient list. In the following example, the sender has mistakenly selected the wrong Anne Hollingsworth at an external address. The sender receives a warning because the email contains an attachment that has been classified as CONFIDENTIAL / INTERNAL USE.

 

 
Invalid recipient is detected based on classification

This is an example of the power of classification to protect your sensitive information.