Over the past few months I’ve seen a major uptick in the number of user inquiries I’m taking on enterprise digital rights management (or enterprise rights management, but I hate that term). Having covered EDRM for something like 8 years or so now, I’m only slightly surprised.
I wouldn’t say there’s a new massive groundswell of sudden desperate motivation to protect corporate intellectual assets. Rather, it seems like a string of knee-jerk reactions related to specific events. What concerns me is that I’ve noticed two consistent trends throughout these discussions:
- EDRM is being mandated from someplace in management. Not, “protect our data”, but EDRM specifically.
- There is no interest in discussing how to best protect the content in question, especially other technologies or process changes.
People are being told to get EDRM, get it now, and nothing else matters.
This is problematic on multiple levels. While rights management is one of the most powerful technologies to protect information assets, it’s also one of the most difficult to manage and implement once you hit a certain scale. It’s also far from a panacea, and in many of these organizations it either needs to be combined with other technologies and processes, or should be considered after other more basic steps are taken. For example, most of these clients haven’t performed any content discovery (manual or with DLP) to find out where the information they want to protect is located in the first place.
Rights management is typically most effective when:
- It’s deployed on a workgroup level.
- The users involved are willing and able to adjust their workflow to incorporate EDRM.
- There is minimal need for information exchange of the working files with external organizations.
- The content to protect is easy to identify, and centrally concentrated at the start of the project.
Where EDRM tends to fail is with enterprise-wide deployments, or when the culture of the user population doesn’t prioritize the value of their content sufficiently to justify the necessary process changes.
I do think that EDRM will play a very large role in the future of information-centric security, but only as its inevitable merging with data loss prevention is complete. The dilemma of rights management is that its very power and flexibility is also its greatest liability (sort of like some epic comic book thing). It’s just too much to ask users to keep track of which user populations map to which rights on which documents. This is changing, especially with the emerging DRM/DLP partnerships, but it’s been the primary reason EDRM deployments have been so self-limiting.
Thus I find myself frequently cautioning EDRM prospects to carefully scope and manage their projects, or look at other technologies first, at the same time I’m telling them it’s the future of information centric security.
Anyone seen my lithium?
Reader interactions
One Reply to “The Rights Management Dilemma”
Rich – couple comments. Data Loss Prevention and Digital Rights Management are two variations on Information Centric Security. As you mention DLP a couple times in the article, I just wanted to make sure it was understood these are not the same things.
DRM’s success is inversely proportional to the number of users in the work group. Because the model is based upon trusted users, the more users, the higher the likelihood someone will misuse the system. But your point that DRM is effective for small work-groups within well defined uses or applications is spot on!
-Adrian