e-Discovery work involves an organization’s most sensitive data, and the stakes can be incredibly high—even without considering the risks of a data breach.
Organizations choose RelativityOne for many reasons, but security is a big one: they want to spend as much time analyzing and understanding their data as possible, and that means spending less time configuring their systems to compensate for the latest security threats.
Isn’t that the way it should be? Processing pros, analytics gurus, case strategists, and courtroom marvels shouldn’t have to lose sleep over whether their environment is as bulletproof as possible. They lose enough sleep over these cases as it is.
It’s been six months since I joined Relativity as chief security officer, and it’s clear to me that this mindset is at the core of our team here. We are the keepers of the RelativityOne cloud, and it’s our job to keep it safe—not yours.
So what have we done since New Year’s Day to execute on that philosophy? We recently achieved a new security certification—SOC 2—and the milestone has inspired us to look back at our efforts so far.
So Far in 2018
1. Make security more digestible.
A good security strategy is holistic—it’s setting up defensive lines, yes, but proactive efforts as well.
A big part of doing that is empowering the people you’re protecting. Users need to have confidence in the software they use every day, but it’s also critical to develop good personal habits to protect their data (habits like good password hygiene and being cautious about phishing scams).
To that end, we’ve spent a lot of time this year sharing content that helps build that awareness. Our security white paper is a big one, and we’ve published a lot right here on The Relativity Blog. This content is meant to teach teams that they don’t need to be highly trained security engineers to understand, at a high level, what’s what when it comes to data protection.
Additionally, we have started work on white papers to help answer customer questions and more articles to explain pivotal security decisions we’ve made, and we’ve attended, led, or moderated many panels and engagements in Chicago. We are in an amazing city for technology and security, and we want to help keep the momentum going.
Ultimately, a security team can be amazing, but if we aren’t banding together with partners and customers to help improve the way we all approach cloud, product, and cybersecurity, we end up like the tree falling in the forest: never making enough noise to be heard. We want to have a positive impact within our own community, but also externally.
2. Offer a transparent look into our strategy.
Aside from teaching users about security best practices and how they can protect themselves, we want them to know how our team of experts is working each day to keep them safe from bad actors.
A major focus for us this year, in addition to formalizing our processes and growing our team, is to be transparent with customers about what we’re doing and why. This is about building that trust not just in our software, but the humans behind it.
Cue Calder7. This is the name we’ve given our security team here at Relativity, inspired by the environment we work in every day (learn more about the origins of our name by watching the “RelativityOne Promise” portion of the Relativity Fest London keynote here). We didn’t want to be a behind-the-scenes, black box force in the Relativity community. We want to help you see who we really are.
Our product and cybersecurity experts have a threefold philosophy when it comes to keeping Relativity safe: anticipate threats, scrutinize suspicious events, and integrate what we learn back into the software and our processes in a truly iterative way. That’s how you keep up with modern threats.
Those types of threats include insider threats, intellectual property exfiltration (where critical information leaves the security of your company), and supply chain attacks (the type of disaster Target suffered a few years back, for example).
Calder7 includes three main teams who apply their unique skillsets to these challenges, and all three have grown this year. Compliance has added specializations in additional frameworks and toolsets; the product team has added new folks in the development of Relativity as well as cloud security in general; and our cyber team has added to their intel, risk reduction, security awareness, and investigations and analytics divisions.
Sharing what these teams do is integral to staying visible in our community. We also seek out relevant industry certifications to give our strategy recognized, well-respected “stamps of approval.”
For example, we achieved ISO 27001 certification last year—a common measure of robust security for information systems.
This year, we’ve added SOC 2 certification to our resume. SOC 2 is a widely recognized standard for security, and evaluation results in a lengthy report for the qualifying company. The certification covers operational control systems, following predefined Trust Services Principles and Criteria around security, availability, process integrity, privacy, and confidentiality. The report assures our customers that what we say we’ve implemented to safeguard their data really is in place. Successfully achieving SOC 2 shows our customers that we are investing a ton in operating a solid SaaS offering.
3. Relying on a broad network of modern-day heroes.
Finally, we recognize that everything in the cyber world is constantly changing. There are millions of people interacting with the internet every day—for better or worse. We can’t work in isolation and expect to deliver the best results.
Every organization must decide what kind of strategy it wants to execute upon. We have chosen to focus on preventative measures and an intel-driven program, incorporating automation where it can be applied. It's not easy, so we rely on a handful of affiliations and partnerships to help strengthen our strategy with additional expertise and perspective.
We receive a lot of resources and insight from organizations like the IT-ISAC and Cloud Security Alliance, where our memberships help us benefit from knowledge sharing with their communities. Additionally, the system alignments we have chosen—specifically Splunk, Palo Alto Networks, Recorded Future, Proofpoint, and Expel—are the result of lengthy vetting. These folks reflect the same focus on prevention with an intel-driven approach to security, so we’re all fighting the good fight together.
Because RelativityOne lives on Azure, we also partner closely with Microsoft to ensure we’re sharing the right knowledge and continuing to optimize RelativityOne for security and effectiveness in the cloud. Check out a few of our collaborations with the gang at Microsoft here and here.
Why You Can Trust Us
We’re here to serve you and your clients, and we take that responsibility seriously. You can be confident that we’re always in your corner, because:
- We have the resources. Our team is dedicated to a single product: Relativity. All of our expertise and the support we glean from our partners is thrown right at the platform. It’s what we live and breathe.
- We’re the developers. We know Relativity at its core, so we have a deep understanding of what’s there and full transparency into the development process. That means we can get to the root of any issues and implement change quickly.
- We work with Microsoft. They’ve embedded security and privacy into Azure, which meets a broad set of international standards. The foundation for security in RelativityOne was laid by some of the world’s best and brightest computer science and cybersecurity minds.
In all these efforts, we use advanced analytics and intelligence technology and techniques to prevent incidents, respond quickly as soon as a threat begins to appear, and quickly incorporate lessons right back into the platform.
Our mission is to accept the challenges of tomorrow’s threats so you can do more with your e-discovery solution today. We feel honored to be an extension of your team and we thank you for putting your trust in Relativity.
