BD&F Information Security

Media Obsolescence

My wife put together a photo album for my birthday this week. It was a very good idea because we possess a large number of photos, all digital, and they are all saved on the computer. We got an external hard drive where some photos go but to be honest, we never had a process for saving all our data to one location.

I used to save images to CDs and lost some of those already because for some reason my new computer does not read those CDs. I should have checked before getting rid of the old PC. Had I printed them, those images will have been with me today. So I’m very thankful for the huge effort my wife made of choosing images, taking them to a print shop and placing them in an album.

This is a common challenge faced when the information technology is changing rapidly. Storage capacity is now in the Terabytes and we all are producing information on formats that require more and more storage volumes. If we intend to retrieve this information in the future, how do we ensure that it is readable then?

After carved stone, the most durable medium to date is print. Paper has proven to be very good at carrying forward information. It is not practical to transfer all present day data to paper as a matter of record but it is important to set criteria as to what is critical for future reference.

Cloud providers can be a viable option for data storage as they offer ubiquitous access, expanding volume and the capability to update storage formats to that of the day. This goes hand in hand with the fact that data in the Cloud is controlled and secured by the provider and not the data owner so caveat emptor!

Another strategy will be to own a large storage device and put in place a regiment of uploading important documents there. If the technology for retrieving documents change, it would be easier to transform and then transfer those files to the latest medium.

Personal Custody

My wife and I went shopping for a new bag recently. For her it is important that there is a zippered top because it is more secure. That made it difficult because most of what we saw were without.

I felt it was not needed because a bag is so personal that you will always guard it closely. She disagreed saying there are always situations where it would be exposed without total supervision and a zippered top buys that extra security and time needed then.

I have to agree because it is an example of using a technology to supplement good security practice. My wife’s bag is almost always slung over her shoulders when she is out and she hardly ever puts it down and the zip remains shut. It might be considered overkill and looking at the choice of bags most people seem to think a zip is not necessary.

I can think of two reasons why the zip is a good idea. It makes it a tougher target for opportunistic thieves who can easily look elsewhere especially with so many zipless bags about. It also prevents the contents of the bag from falling out and this avoids a heap of pain when it comes to replacing things like driver’s licence, credit cards and the lot.

When something is considered worthy of protection, the security habits and technologies that surround it have to be considered. The habits can be taught and practised until they are 2^nd nature. The technology can be chosen to support the habits but only to the point that the activity is not unduly affected.

You can make a habit of keeping your bag closely tucked to you. You can add a zip for those times when you are unable to guard it fully and to securely contain what’s in there. But you won’t use a lock, which is most times overkill.

Protecting information has many parallels with this situation. The debate about the effectiveness of user awareness training versus the use of technology still carries on. I think both are necessary. User awareness has to be done constantly in an effort to develop secure habits surrounding information.

Technology has to be assessed for its suitability to the business process. There are most likely more than one option for protecting data in a situation and it is the duty of the company to choose the solution that allows them to realise commercial activity in the safest possible manner.

Central Data

Woke up today to 3C temperature outside. The seasons are changing and the length of the days is shortening. Soon the clocks will “Fall back” and the journey to and from work will be done in the dark.

Come the 28^th October at 2:00am this year, British Summer Time ends and the time changes to 1:00am. This always involved an arduous ritual of setting all the house clocks and watches to the correct time. Of course you might always forget one, the clock in the car being the best example, and you never know when that mistake can be costly.

If all were changed, they still weren’t in sync. In the case of domestic clocks the few seconds difference might not be critical but there are situations where seconds count. Now more timepieces are centrally controlled either by radio signals or via the Internet. The list includes my computers, smartphones and watches. Life is easy!

In businesses, information experiences the same type of challenge, accurately reporting an update to all users. When a change is not centrally distributed, you are in a similar situation as having to manually change clocks.

Companies must employ ways of centralising information to ensure that an update is broadcasted to all endpoints. It is more efficient in many respects. Takes less time and avoids many mistakes down the line.

Master data management is a discipline designed to address this problem. The idea being that properly tagged and centrally stored information and its changes will always be visible to users. The best starting point will be to design procedures that allow users to access one copy of a document, edit it and have the changes available to all. Think SharePoint, DropBox…

I see the NHS has moved to radio controlled clocks in the hospitals. The savings made by that move must be tremendous and the punctuality benefits immeasurable. This is a good example for businesses to consider when planning how they will process data across the company.

Brand Loyalty

When I was a child in Trinidad the two main imported bicycles were Raleigh and Humber. Both were from the same company but Raleigh was the ‘must have’ brand and my first bike was a Chopper. Looking at my family’s collection of bikes today I realised that they were all Raleighs.

During my cycle racing days I always kept an eye out for Raleigh but thought they weren’t up to the performance level of the Continental and newer American brands. A few years ago I started taking the English brand seriously again and the selection for 2013 looks the business. There might be another addition to the collection soon.

As an InfoSec consultant I am always talking about the protection of reputation and how important to is for companies to maintain their public perception intact. With eCommerce it is more important that customers trust that their purchases will be secure and the exchange of goods for money will be seamless.

I am always hesitant to buy from a new online seller. I always check that my trusted online retailers stock what I looking for and if the price is right, I buy from my tried and tested. I am not too sure what I will do if one of those retailers reports/is reported losing my information. It all comes down to how the situation is handled and what treatment is meted out to me as a valued customer.

Coming back to Raleigh, in my opinion they have always portrayed themselves as a trustworthy bicycle company with the widest range of products, tuned for each sector. During the 80s and 90s they maintained that image although the products were not at the forefront of the market. Now that the company is on the rebound, I take pride in being a close witness to that journey.