+1 812 868 ROSS (7677)

Knowldge Capital and Dark Matter in the Enterprise

So I was having a conversation
with a colleague the other day on managing knowledge capital in the enterprise,
and the rat’s nest of network folder structures that, inevitably, wind up on
the servers of corporate America.

 

His comments were something
like, “If it is anything like my experience, there are now tons of redundant,
outdated, and conflicting data on shared drives without a clearly understood
policing and maintenance function.

 

My overriding concern is this:
over time, organizations inevitably develop musty, decrepit labyrinths of
shared sub-directories and folders, where access and editing rights are not be
well-understood or controlled, and current and outdated data are inter-mixed.
In other words: FUBAR (you know the meaning?)”

 

So what do you do about it?

         
Well, In part,
develop an over-arching general document retention policy for managing risk and
retention of identified documents. There is quite a bit of case law on the
statute of limitations under the UCC, and precedent around suits filed where document
retention policies were inadequately defined
.

         
Also, the whole policy
thing needs to be enforceable, so finding the sweet spot of the policy is
tricky. Making a set of practices so legalistic prevents adequate adherence,
and makes enforcement next to impossible.

         
Finally, again this
is about education, end goals and not about technology (IMHO).

 

To use a simile, it’s a little
like my garage at home growing up (and probably a bit like my garage now)…

 

My dad had the tendency to keep
every copy of the National Geographic magazine we ever received… and stacked
them up in the corner of the garage, on the bet that, “there’s that article
I’ll want someday…”

 

Before you know it, 20 years
have gone by and there are National Geographic magazines stacked up taking an
entire wall of space.

 

With the inexpensive nature of
computer storage today, the issue is exacerbated.

 

It is cheaper to throw storage
at the problem then to fight with people to “clean out the garage…” Remember
what that was like when you were asked as a kid to clean out the garage/storage
shed/your room/whatever?

 

In addition, the issue is pervasive;
it runs as a thread, in many organizations.

 

I did some research on this in
graduate school, as part of document retention policies for information
assurance, organizational knowledge capital and IP management.

 

It seems to me that there is a
larger issue involved than the “I might want that article someday” information
gathering habits people have. There is a lot of research on knowledge capital
and its management in the enterprise.

 

The average tenure of an
employee has declined over the last 25 years and as we have moved from an
industrialized society to an information society, we see too, knowledge capital
move around more frequently. The problem is that (in our organization
especially) there is more tacit or esoteric knowledge than explicit knowledge.
So the question, in general, “how do we tap in to that knowledge that exists
within the enterprise so we can develop a competitive market advantage?”

 

We’re not the only ones asking
that question, many other organizations are as well. That question has created
business and research specializations in the fields of library and information
science.

 

The response from the
information and technology sciences has created several models for tapping in to
the organizational knowledge capital.

 

The whole internet “Google” as
the “Encyclopedia Galatica” is part of that.

 

The extension of these search
technologies in the enterprise makes use of tags (metadata) to categorize the
information in to logical constructs.

 

Crawlers and index engines
summarize the information in to searchable databases.

 

This gets the explicit knowledge
from the enterprise in to something that we have a hope of using in a
meaningful way.

 

The next step is to get the
tacit knowledge out of the heads of the “enlightened few,” and in to the hands
of the other organizational knowledge workers. So with tenure decreasing, implying higher turnover, think about what happens every time that esoteric
knowledge walks out the door? What does that do to the continuity of not
information, but knowledge capital?

 

A great deal of research has
been done (mine included) on the use of social computing models (think
facebook, linkedin) to extend reach of the enterprise to its market channels,
and internally, to perform knowledge transfer between workers.

 

Look at Sharepoint as an example
of how organizations are doing some of this now.

 

More research in this area needs
to be done, and my intuition is that the companies that tap in to this “dark
matter of organizational knowledge,” as I called it in one conversation, are
the some of the ones that will have a competitive advantage in the recovery.

 

USB AES Crypto System Cracked

The companies SanDisk and Kingston offer encrypted USB Flash Drives which have been certified by NIST according to the FIPS standard in order to be used by the American army forces and government. Members of staff of the SySS GmbH have managed to bypass the entire protection of the USB sticks. Independent from the password in use, respective encrypted data can be reconstructed within seconds. Read our publications: Paper SanDiskPaper Kingston

via www.syss.de

I’ve been a fan of encrypted USB thumb drives for some time. I’ll go out on a limb here and say that I have carried one around with me for a couple of years. In the associated article, SySS a German Security Analyst firm made this announcement in a white paper published in December 2009.

With the ubiquitous presence of USB thumb drives (you can get them at the grocery store checkout stand for crying-out-loud) and the enormous capacity of these drives, people are carrying around massive amounts of data on them. Most of the data floating around are all about Aunt Sally’s 4th of July picnic pictures, but in fact these drives represent a real security risk to the enterprise.

It wasn’t that long ago that the capacity of entire corporate networks amounted to less than the capacities generally available on these ultra-portable devices. Not to mention, how many of you are carrying or transporting your personal information around on these things? Social Security Numbers? Drivers License Numbers? Credit Card Information? How about your Quicken files?

What happens if these drives are lost or stolen?

Several manufacturers recognize these risks and have designed hardware encrypted USB drives. In a nutshell, these drives take the information you put on them, and using sophisticated hardware, encrypt the information using a secure data protection algorithm.

This algorithm, AES (Advanced Encryption Standard), is an advanced encryption standard adopted by Uncle Sam to secure information used by the Federal Government. Properly deployed anybody using USB drives employing this standard can rest assured that their private information is private.

You’d think you’d be safe, and I won’t get in to the technical details, because it is really subtle. But there are some manufacturers of these secure USB drives, that improperly employ the standard, and subsequently make these devices subject to cracking. The attacker doesn’t even have to KNOW YOUR PASSWORD, talk about a false sense of security. The list of manufacturers can be found in the attached link, and in all fairness, they have been notified and a patch is published to resolve the vulnerability.
That said, I’m not big on product endorsements, but IRONKEY bears a mention here. I’ve used IRONKEY secure USB drives for a while, and they were never a vector for the vulnerability mentioned. They employ a rock solid hardware/software combination to secure the data on these devices. You can find these secured USB drives at www.ironkey.com.

So you thought your data was secure?

Hmmmm…