AGAT

Categories
blog DLP Ethical Wall

FINRA Compliance Requirements

Due to the COVID-19 pandemic, many companies had to restructure the way they worked almost overnight. Suddenly data that was protected by the organization’s regulations and contracts had to leave the company in order to work with it. That is the reason why FINRA extended all its compliance regulations to the internet space, establishing strict cloud governance standards and making cybersecurity a must.

Insider threats to enterprise data are a permanent cause of concern since they can impart a huge amount of destruction on a business, especially in the financial services sector. A simple mistype by an employee with privileged access can be just as damaging as a compromised employee looking to make a quick buck. Financial institutions face the second highest breach costs among targeted industries.

Table of contents

  1. What is FINRA?
  2. What does FINRA do?
  3. Rules regarding information barriers
    1. How to comply with FINRA information barriers requirements 
  4. Rules regarding data loss prevention (DLP)
    1. How to comply with FINRA DLP requirements
  5. Rules regarding archiving and data recovery
    1. How to comply with FINRA eDiscovery requirements

1- What is FINRA?

The Financial Industry Regulatory Authority (FINRA) is a private, nonprofit American corporation that acts as a self-regulatory organization (SRO). Its mission is to set forth rules and regulate stockbrokers, exchange markets and broker-dealer firms, keeping the U.S. markets safe and fair. FINRA is the successor to the National Association of Securities Dealers, Inc. (NASD) as well as the member regulation, enforcement, and arbitration operations of the New York Stock Exchange. 

The US government agency that acts as the ultimate regulator of the US securities industry, including FINRA, is the US Securities and Exchange Commission (SEC). Although FINRA is not a government organization, it does refer insider trading and fraud cases to the SEC, and if you fail to comply with FINRA rules, you may face disciplinary actions, including fines and penalties that are set to deter financial misconduct. 

2- What does FINRA do?

  • Oversees all securities licensing procedures and requirements for the United States.
  • It’s responsible for governing business between brokers, dealers, and the investing public.
  • Examines firms for compliance with FINRA and SEC rules. 
  • Performs all relevant disciplinary and record-keeping functions.
  • It encourages member firms to secure their financial data and execute transparent transactions. 
  • Delivers steps defining accurate cybersecurity goals.
  • It fosters transparency in the marketplace

Best practices Compliance FINRA

Is your company compliant? You must, among other things, make sure that digital data is immutable and discoverable and that the access and usage of data can be restricted, regulated and audited*. This is where AGAT’s SphereShield software can help.

3- Rules regarding Information Barriers

In a few words, financial institutions are subject to regulations that prevent employees in certain roles from communicating or collaborating with employees with other specific roles. Why is this? because there are conflicts of interest involved, and if they exchange sensitive information there can be severe consequences. 

A research analyst provides information to investors, they gather data around possible investment opportunities. Their increasing popularity expanded their influence on the price of securities: they give ratings that, if good, can make the price of an asset go way up. In parallel, a slight disfavorable change in their ratings can make prices drop. That’s why, to maintain a fair marketplace, research analysts cannot disclose ANY information they collected before an official public release.

The practice of information barriers has been expanded over recent decades to prevent those communications and risky information flows and to avoid insider trading, protecting investors, clients, and other key stakeholders from this wrongful conduct. FINRA Rules 2241 and 2242 require organizations to establish policies and implement information barriers between roles involved in banking services, sales, or trading from exchanging information and communicating with research analysts.

 – How to comply with FINRA information barriers requirements 

Agat’s SphereShield offers granular control over users/groups engaging in communications both within other areas of the company or with external organizations. It also includes independent control for different kinds of actions: instant messaging, audio, video, conferences, desktop sharing and file transfer. 

So, let’s say a user identified as a Research Analyst wants to communicate with someone from a restricted area: a well implemented information barrier will fully block that possibility.

4- Rules regarding data loss prevention (DLP)

Firms must put robust policies in place for employees to know which sensitive information they cannot disclose, and also monitor them for suspicious activities that  hint at possible misconducts. FINRA rules 3110/3013 explicitly mandate analyzing all electronic employee communications. 

Clearly, reading all emails and listening to all voice calls is just not possible, but there are technologies that can actively transcribe, analyze, and monitor communications flagging any suspicious behaviors or activities. As an extra step, there’s software that can assist a firm to turn surveillance from reactive monitoring (that means, addressing employees missteps after the fact) to a proactive rule creation approach. This allows for risks to be identified, managed, and mitigated before information breaches or other incidents occur.

– How to comply with FINRA DLP requirements 

AGAT’s DLP engine does real-time inspection of content, being capable of blocking or masking all data that is defined as sensitive before it reaches the cloud or is sent to external users. Firms can use it to prevent information leakages and insider trading offenses from happening, but it will also help them identify communication red flags  to make risk assessments and train personnel.

5- Rules regarding archiving and data recovery

Examining a company’s books and records to make sure they are up to date and accurate is a significant component of FINRA industry inspections. FINRA establishes in its rules that access to all the records they might need  to audit has to be accessible easily and promptly. 

FINRA rules 4511, 2210 and 2212 are the rules on storage and recordkeeping, stating that all organizations must preserve their records and books in compliance with SEC Rule 17a-4. This includes ensuring the easy location, access, and retrieval of any particular record for examination by the staff of the Commission at any time. This rule applies, and has specific notes to electronic storage, like accurately organizing and indexing all information. 

– How to comply with FINRA eDiscovery requirements

An eDiscovery search feature isn’t an ordinary content search tool. It provides legal and administrative capabilities, generally used to identify content (including content on hold) to be exported and presented as evidence as needed by regulatory authorities or legal counsels.

The eDiscovery solution from SphereShield allows for data to be immediately available to any regulatory organizations or commissions by giving advanced search capabilities to quickly retrieve and export data. This solution can also be integrated to other existing eDiscovery systems.

Categories
blog Ethical Wall Microsoft Teams

Are Microsoft E5 and E3 Licenses worth the money?

In this article, we will talk about the best ways to address important security and compliance issues with SaaS products, and review some solutions available within plans like Microsoft E5 or E3.

Table of contents

  1. The paradox of reducing cost while maintaining high compliance and security standards
  2. The range of solutions within Microsoft licenses E3 and E5
  3. Is the Microsoft E5 license really worth the money?
  4. Alternatives to a Microsoft E5 License
  5. AGAT’s SphereShield for compliance
This image has an empty alt attribute; its file name is image3.png

1- The paradox of reducing costs while maintaining high compliance and security standards

It’s 2022 and the global scenario is one of economic uncertainty. Companies are starting to pull back on developments while others look for ways into reducing operational costs before starting to lay off employees.

While the global stagflation keeps on developing, many chiefs of compliance, security, and technology officers are facing the same question: How is it possible to reduce the overall SAAS spending while not sacrificing any security or compliance requirements?

On one hand, it’s impossible to get rid of essential paid services such as corporate emails, servers, cybersecurity, collaboration software, and the like. But on the other hand, there is a tremendous risk associated with the idea of replacing functioning solutions developed by well-known vendors with home-made not-so-effective patches.

2- The range of solutions within Microsoft licenses E3 and E5  

Microsoft 365 is the market leader in SaaS, offering a complete suite of business productivity tools for easier communication and collaboration. We know that Microsoft 365 includes Windows OS and the whole Office product line in its subscription, also allowing the use of diverse cloud-based services for business environments, such as hosted Exchange Server, Skype for Business, MS Teams and SharePoint, among others.

With a good price/value ratio, the E3 license is one of the most popular options between small to mid-sized organizations. But Microsoft E3 offers only limited solutions around identity and access management, threat protection and information protection, and it lacks compliance solutions.

Then there’s Microsoft E5, a more than significant step-up from Microsoft 365 E3 that includes important security features such as, Identity Management, Cloud App security, Auto Labeling for sensitive content, etc., as well as it can address some compliance requirements. But this plan also includes other functionalities like Power BI and Teams Phone that add up to the price unnecessarily for companies if they won’t use them.

This image has an empty alt attribute; its file name is image2-1024x390.png

3- Is the Microsoft E5 license really worth the money?

The difference between the features provided by E3 and E5 is clearly reflected in the monthly subscriptions price jump of $21. Taking a look at their published prices, if a company with 500 employees decides to contract E3 it would incur an annual cost of 216,000.00 USD, and that price ascends to 342,000.00 for the Microsoft E5 plan.

But the bottom line is, getting access to the newest compliance and data governance technology developments by Microsoft demands high-end licensesThe Microsoft 365 Enterprise packages E3 and E5 are aimed at organizations that need more information protection and compliance capabilities.

Microsoft E3 and E5 licenses prices list

Microsoft also offers separate plans for security and compliance that can be added to an E3 license. There’s the Microsoft 365 E5 Security add-on (formerly Identity & Threat Protection) priced at $12/user/month, and the Microsoft 365 E5 Compliance add-on, also priced at $12/user/month, both requiring annual commitments.

It’s not necessary to dive into the details of the solutions provided by each of those add-ons knowing that, by adding the two of them to an E3 plan, the total price ends up paired to E5. So if your organization is interested in both the security and the compliance solutions by Microsoft it’s still preferable to purchase the complete E5 bundle.

I know what you’re thinking, is it possible to purchase the E5 security and compliance add-ons for a cheaper license than E3? No, Microsoft makes these packages available only for E3-level subscriptions. Smaller companies with plans like Business Premium (limited to 300 hundred users) don’t get the option of incorporating Microsoft’s wider compliance and security features.

For the case of Office 365 (the subscriptions without Windows and EMS) the conclusion remains the same, an Office 365 E5 license will give you a better bundle than adding security and compliance separately to Office 365 E3.

4- Alternatives to a Microsoft E5 License

Ultimately, decision makers should know that it’s not impossible to drop down and optimize SaaS software licensing if certain features aren’t essential for their organization’s particular needs. More so, many users choose to turn to third party providers for alternatives to some of Microsoft’s native capabilities.

It’s also important to address that organizations with specific needs, like the ones in tightly regulated sectors or those subject to data protection legislation need to secure their environments with the right technology to manage and protect sensitive data, and even though the E5 license offers a good complete set of security and risk mitigation features it’s not necessarily the only way, or the most effective, to address your compliance needs.

In past articles, we have taken a look into the limitations that the native capabilities of products such as Microsoft Teams have when it comes to compliance. You may find that important functionalities, for example the ones regarding Information Barriers, are very limited with a Microsoft E5 license and not available in E3.

5- AGAT’s SphereShield for compliance

With costs that represent only 10% of a Microsoft E5 license, AGAT’s SphereShield offers a complete compliance set of solutions that can be integrated to Microsoft Teams, expanding some crucial functionalities.

This image has an empty alt attribute; its file name is image4-1024x446.png

Among its most important characteristics there’s the inclusion of an advanced information barriers solution: SphereShield’s Ethical Wall, that allows extra control over guest user capabilities, granular control over specific operations, incident auditing for compliance awareness, and more.

We have addressed before how Microsoft’s DLP solution is only near-real time, and the risks involved in that kind of reactive approach. AGAT’s SphereShield DLP engine offers real-time inspection of content and context-aware policies for data loss prevention, identifying and blocking sensitive data before it reaches the end user.

AGAT has also developed features that extend Microsoft Teams’ governance capabilities for better control over user permissions and preventing information leakage. SphereShield also offers eDiscoveryadvanced search capabilities that can be implemented online or on-site.

Finally, the whole range of compliance solutions developed by AGAT can be licensed separately, allowing companies to further tailor their subscription plans to meet their exact needs.

We encourage you to contact us to get a free trial of AGAT’s SphereShield

Categories
blog DLP

Profanity Filters in Microsoft Teams and Webex

kmp47kGyf 0GUO1D9g6Jyf2n2HPdjqEyrX2LFE ad0DM wTlWlHH5UbF8yikoMzw8hwfaLqJJwQeoQ1K rVaR4xtcCgvlCKKTzUMlIoaBdql04i Tl2VuZMVzJ8ETLRxGTj3D0SW RJN3erUaw

Profanity filters might sound completely passé or something your grandparents would want you to install in all their devices, however, they are fundamental for protecting your company while using Microsoft Teams or Webex.

History

Back when the internet still was the wild wild west, profanity filters were used in online forums and chat rooms for blocking words deemed offensive by the administrator or community. The big caudal of expletives quickly became overbearing and custom-programmed blockers were put in place in chat rooms and online videogames.

Once the internet became a massive tool for companies, hospitals and schools, the need for these blockers became even more evident.

image5 1 1

Law

United States of America:

The First Amendment to the United States Constitution protects the freedom of speech against government censorship. This also applies to cyberspace thus having a minimal filtering of online content in the United States. However, due to complex legal and private mandates, the internet is regulated.

Direct censorship is prohibited by the First Amendment with some exceptions of obscenity such as child pornography. However, in the past few years, several acts were attempted to regulate children’s ability to access harmful material: The Communications Decency Act of 1996 and the Child Online Protection Act of 1998. Other similar acts were passed through, including the Children’s Online Privacy Protection Act of 2000 and the Children’s Internet Protection Act of 2000, protecting the privacy of minors online and also requiring K-12 schools and libraries receiving Federal assistance for Internet access to restrict minor’s access to unsuitable material.

European Union:

This is not only an American phenomenon, in Germany “The Federal Review Board for Media Harmful to Minors” (German: Bundesprüfstelle für jugendgefährdende Medien or BPjM) estates that “The basic rights of freedom of expression and artistic freedom in Article 5 of the German Grundgesetz are not guaranteed without limits. Along with the “provisions of general laws” and “provisions […] in the right of personal honor”, “provisions for the protection of young persons” may restrict freedom of expression (Article 5 Paragraph 2).”

This applies not only to physical media (printed works, videos, CD-ROMs etc.) but to distribution of broadcasts and virtual media too.

image1 1 1

Digital Service Act:

The DSA is meant to improve content moderation on social media platforms to address concerns about illegal content. It is organized in five chapters, with the most important Chapters regulating the liability exemption of intermediaries (Chapter 2), the obligations on intermediaries (Chapter 3), and the cooperation and enforcement framework between the commission and national authorities (Chapter 4).

The DSA proposal maintains the current rule according to which companies that host other’s data are not liable for the content unless they actually know it is illegal, and upon obtaining such knowledge do not act to remove it. This so-called “conditional liability exemption” is fundamentally different from the broad immunities given to intermediaries under the equivalent rule (“Section 230 CDA”) in the United States.

In addition to the liability exemptions, the DSA would introduce a wide-ranging set of new obligations on platforms, including some that aim to disclose to regulators how their algorithms work, while other obligations would create transparency on how decisions to remove content are taken and on the way advertisers target users.

Dangers of lacking profanity filters in the workplace

Detecting offensive words and actions in the workplace before they occur is mandatory for providing a positive environment for your company. Filtering foul language and commands is extremely important in collaborative work.

NSFW material in the cloud

Whatever happens inside the channels of a company is a direct responsibility of the organization, therefore, whatever filth your employees might be saying or searching can lead to horrible results for everyone involved.

Right now there is a bunch of articles about how to surpass censorship and blockers at your job (i.e. “How Not To Get Caught Looking at NSFW Content on the Job”) and frankly, if any dangerous filth is found in the company’s server it could mean a whole investigation on every single computer.

NSFW content could be fatal for business as employers could also be paying to store questionable data in the corporate cloud.

Employees could use unstructured sync and share applications to upload unsuitable content into cloud storage servers. A recent Veritas report found that 62% of employees use such services.

Even worse, 54% of all data is “dark”, meaning it is unclassified and invisible to administrators. Video usually takes the more storage, which could lead to a significant extra cost for the maintenance of dubious content

Harassment

We are not just talking about a few mishaps, (you can filter those too!) We are talking about serious issues like harassment.

Managers can bully employees, employees could insult one another and the dreaded sexual harassment may threaten the safety of the workplace. When bullying, insults, and sexual harassment occur in the workplace, a hostile work environment is created damaging morale and productivity.

Organizations are liable to prevent any and all types of harassment

With profanity filters you can avoid these hurtful messages from ever reaching their destination and also flag and investigate repetitive offenders.

image4 1 1

The economic costs of sexual harassment in the workplace:

Deloitte has published a paper about the costs of sexual harrasment in the workplace and stated that only in 2018, workplace sexual harassment imposed a number of costs.

The costs included in the model were: $2.6 billion in lost productivity, or $1,053 on average per victim. $0.9 billion in other costs, or $375 on average per victim.

the economic cost of workplace sexual harassment is shared by different groups.

The largest productivity-related costs were imposed on employers ($1,840.1 million), which is driven by turnover costs, as well as friction costs associated with short-term absences from work, and manager time spent responding to complaints. Government loses $611.6 million in taxes through reduced individual and company taxes.

The largest sources of other costs are the deadweight losses ($423.5 million), which are incurred by society.

The other major source of costs in this category are costs to the government for courts, jails and police; and legal fees for individuals.

Microsoft options

Microsoft is working on a new mechanism that filters threatening or rude messages sent by employees.

A new entry in the company’s roadmap promises an upgrade to the Microsoft 365 Compliance Center which may allow administrators to “detect threat, targeted harassment and profanities”

This is not only possible in English, but the trainable classifiers will be able to detect profanity in French, Spanish, German, Portuguese, Italian, Japanese and Chinese as well.

Another imminent update for admins to consider is titled alert exclusion in Microsoft 365 security center. The new feature aims to filter the number of security alerts issued by Microsoft Defender for Identity, so that users are only bothered by the ones that matter.

How to implement profanity filters for Microsoft Teams and Webex

While Microsoft is still working on the idea, the responsibility of keeping content safe lies on each company and lucky for them AGAT already offers Safe Content Inspection for Microsoft Teams

Using state of the art technology AGAT’s Safe Content inspection can detect unsafe content in all the important categories such as racy, adult, spoof, medical and violence.

image2 1 1
  • Adult Content: Detects elements such as nudity, pornographic images or cartoons, or sexual activities.
  • Racy: Detects racy content that may include revealing or transparent clothing, strategically covered nudity, lewd or provocative poses, or close-ups of sensitive body areas.
  • Spoof: Detects if an image has been modified to make it appear funny or offensive
  • Medical: Detects medical content
  • Violence: Detects violent content

In real time, the software detects and blocks the content before it reaches its destination, no matter the format (Text or images). The AI matches the image content to the categories set and takes action by blocking, deleting or notifying on incidents notified.

Every incident identified raises flags with messages and pop-ups alerting the parties involved and/or the administrators, again, crucial to avoid any kind of repetitive offender or possible work harassment.

Detecting unsafe content is not an easy task, not everything is defined by clear rules, especially when dealing with images and videos. Addressing these issues require a serious machine learning involved to be able to detect awful content lurking around and to avoid false positives.

False positives:

Another problem that might be encountered is paying for a lackluster censor. The Internet is full of false positives, it needs a very competent AI to differentiate between safe content and utter filth.

Technology sometimes can’t keep up with the intricacies of human language. Your filter might work due to a blanket list of forbidden words, but what happens if a completely safe text contains a string (or substring) of letters that appear to have an obscene or unacceptable meaning?

You might face the Scunthorpe problem, where AI can detect words but can’t detect context, therefore it might block words that are completely safe and leave a lot of potential clients out of the loop.

For example, the Scunthorpe problem is called like that because in 1996 AOL prevented the whole town of Scunthorpe, North Lincolnshire, England, from creating accounts

In the early 2000s, Google’s opt-in SafeSearch filters made the same error, preventing people from searching for local businesses or URLs that included Scunthorpe in their names.

It might seem silly but this tiny mistake can make a company lose clients and money.

And what about images? There is a popular game on the internet where you have to guess if you are looking at a blueberry muffin or a chihuahua. As you can see, it might be difficult even for humans, so how can an AI keep up? 

image6

You need to be able to regulate how moderate you want your filter to be, i.e. from something absolutely pornographic to peoples faces, and you can do that by aplying the desires filters to AGAT’s Safe Content Inspection.

Safe Content Inspection

Safe Content Inspection was designed to help companies and organizations achieve a level of regulation and ethics needed to operate business as it should be done.

As of today we’re on the way to develop this feature further to include video inspecting and soon more UC platforms like Slack, Skype For Business and Zoom, so stay tuned for more updates.

For more information about AGAT’s Real Time DLP and Ethical Walls contact us today!