More from our Reshaping Information Security MarketInsight study.  This section deals with the pain and confusion surrounding e-discovery and how those responsible for information security get in the middle of e-discovery projects.

e-Discovery

One thing became very clear during the course of our discussions – information security and IT professionals are becoming very adept at e-discovery and their time is being filled with requests to produce emails.  In many cases, the infrastructure is simply not in place to provide relatively easy access to the mountain of email produced by a company on any given day.

Following a normal program of deletion is deemed best practices, but even if you anticipate an inquiry and don’t save the email records, you could be in hot water.  One company’s lawyer offered a definition of “transitory” email as one that is not for business purposes, however this created even more confusion.  In some cases, companies manage separate environments to accommodate legal hold requests and to ensure there is no spoilage of possible email evidence going as far in one case to have a separate mail server where certain mailboxes are moved.

More and more, the participants viewed being able to assist counsel with litigation discovery as a component of their jobs and were actively working to develop cost models for an investigation to ensure legal wanted to bear the costs when a request is made.  Of most concern to them was the “period of exposure” in a discovery request – figuring out what had and what they could produce within what time frame.

One participant cited 22 separate discovery requests he had to manage last year and another quoted over 40% of the employees at his company were on some type of legal hold.  As for other media and ways to communicate, Instant Messaging (IM) was deemed to be “like a phone call” so there was no need to archive it as they don’t record calls and if thumb drives are permitted and advocated as a way to move files and save data, they now become discoverable.