With the resurgence of global security threats including terrorism, international tensions, and cyberwarfare, it’s no surprise the United States recently increased enforcement of ITAR (International Traffic in Arms Regulations). These are rules designed to prevent the sharing of technology and information with foreign nationals that might compromise U.S. security.
ITAR applies to all defense manufacturers, exporters, and brokers (a $2 trillion global industry), many of whom will need help complying with ITAR. BlackBerry Workspaces and its secure Digital Rights Management (DRM) technology can help.
(Check out our webinar, BlackBerry Workspaces: Enabling Export Control Compliance on July 13 at 9 AM PT. We’ll discuss the challenges of regulations such as ITAR, and explain how, through BlackBerry Workspaces, they can be overcome. Sign up here. And visit our Web page describing our overall approach to complying with ITAR.)
The ITAR Compliance Checklist
ITAR stipulates that all technical data related to defense products – including blueprints (right), drawings, photographs, plans, instructions, and documentation – must be well-protected, strictly controlled, and thoroughly-documented. The penalties for failing to adhere are steep. Five companies in the past five years have been fined a total of $172 million for violating ITAR regulations. Besides money, ITAR violators can also lose export privileges, be forced to hire a Special Compliance Officer, endure a series of comprehensive audits, or even face criminal charges.
Basically, ITAR isn’t something you can afford to ignore. So how do you comply? By combining the ITAR’s sample technical policy for electronic transmission and data storage with advice from data compliance experts, we can glean that you must:
- Protect controlled data with strong encryption such as FIPS 140-2 at all times, including at-rest and during transmission.
- Maintain complete control over your encryption keys.
- Restrict access to a small group of authorized individuals, and enforce this access with strong authentication.
- Prevent employees from transmitting data without permission or to a barred party/nation.
- Routinely review individual access rights, and update them based on your ongoing needs. For instance, de-authenticate terminated employees
- Log, monitor, and report all events pertaining to data access. This includes who, what, and where.
- Set up notifications or alerts that are sent to authorized individuals or groups when data is changed in any way.
There are multiple challenges at each level. How do you ensure that sensitive files remain safe in the hands of a third party or a remote agent? How do you deal with insecurely synced folders and email leaks? Perhaps most importantly, how do you ensure your organization stays compliant without restricting productivity?
It’s easier than you’d expect.
Work Safer with BlackBerry Workspaces
With its industry-leading DRM technology, BlackBerry Workspaces provides the foundation for complying with ITAR rules. And it does so without sacrificing productivity or impeding collaboration. It’s able to achieve this through:
- File-level security. All Workspaces files are protected by 256-bit encryption and can only be accessed by authorized users. Workspaces DRM travels with the file wherever it goes, and administrators control everything a user can do with a file, even after it’s downloaded.
- Advanced access controls. Individual users or user groups can be restricted or allowed to access a file or repository with a few clicks, and security rules can be set at either the user, group, or domain level. Workspaces can also serve as a secure access portal for existing repositories.
- The Workspaces API/SDK. The Workspaces API and SDKs allow its functionality to be integrated directly into custom applications.
- Simple collaboration. Through Workspaces, staff can collaborate with external users without risking a breach. Users can easily edit documents either in-app or on their device.
- Automatic logging. Workspaces tracks all file activity – what device someone used, where they used it, and what they did. A flexible, powerful reporting system gives administrators full access to this information.
- Compliance reporting. The reporting functionality of Workspaces can be segregated from other administrative functions, allowing the creation of a Compliance Officer role that can access activity records without exposing administrative functions or secure files.
- Email Protector. Available as part of Workspaces or a standalone offering, Email Protector automatically wraps every outbound email attachment in Workspaces’ DRM – no more need to worry about critical data leaking via email.
You might wonder: why not use a consumer-grade hosting solution such as Box or Dropbox? For one, we do a much better job on security. Second, most consumer and even EFSS solutions require you to move your files into their cloud, which can be time-consuming and costly. We protect your files in place, letting you secure, extend and mobilize your existing infrastructure. Workspaces works with any existing major file repository, including Microsoft SharePoint, OpenText, Alfresco, and more
Protect Your Data or Pay the Price
We live in dangerous times, and regulations like ITAR are designed to keep us safe. Complying with them, though challenging, is necessary. And ignoring them is a costly, potentially crippling mistake.
BlackBerry Workspaces – recognized for its security by analysts such as Gartner and Forrester – ensures that it’s one you’ll never make. Better yet, it integrates seamlessly with several other products that can help you stay compliant, including BBM Enterprise, SecuSUITE for Enterprise (secure voice) and BlackBerry UEM (endpoint management). Together, they form a full suite with which you can protect your data, people, and brand, no matter what risks they face.
Learn all about BlackBerry’s approach to helping your business comply with ITAR here. You can also visit the official BlackBerry Workspaces page or take a look at the Workspaces Email Protector product page.