BD&F Information Security

Is a Pig

Information Security Governance is a pig to get right. The size and age of the organisation does not matter. A startup faces onerous challenges just as large mature businesses. It is tempting to expect that the problems scale proportionately.

At the outset a decision has to be made about how data is going to be received, what special processes will be performed on that data, how the resulting information will be used to advantage and what to do with it when it is no longer needed.

When information is produced, whether as needed to perform commerce or as a product, there must be a process to decide what labels will be attached to the item. This goes beyond confidentiality classes and declares the information’s purpose in the organisation. How is it created? Is it for Finance, HR, Facilities, Marketing? Where can it be exported? How old can it get? Is it an asset?

The answers to those questions will determine how the information is protected. There is a lot of technology to help secure data. The basic tools, many of them free, will go a long way but to do so they have to be supported with custodial procedures carried out by staff.

Those habits are difficult to establish. When the organisation is small, information security can be easily discounted as low priority. When it grows without those foundational habits, it is very difficult to track what data the organisation is running on, where it is and how best to secure it.

There are also standard approaches for getting to grips with information exposure such as asset and risk registers and many other tactics to report the state of the network and the data on it. Coordinating all these efforts is the challenge. Departments set about ordering their security efforts and run out of steam when the information is shown to be trans departmental and possibly carrying a different asset rating in different locations.

Taking the mile high view helps. Look at what the organisation takes in and what it puts out. Data and process flow diagrams will show how data meanders in and out the organisation and identify where the information crosses boundaries, where it becomes vulnerable.

Governing all these disparate efforts may be even bigger than a pig. Even if handled one leg at time, it is best to know it is a pig you’re dealing with.

10 Downing

Imagine 10 Downing being sign posted with “There are no Firearms at these Premises.“ That is a bold statement for anyone to advertise. If an elected official is a very important person, we can apply that perception to ourselves also and do our best to protect our valuables.

I have no signs outside of my house. I consider my family precious and will like to continue living in safety. A big consideration is the risk of burglary while at home. Yet I feel safe enough. This is because I consider that there are enough layers of defence that keep me out of harm.

Enough protection relies on enough effectiveness at each defence point. A Neighbourhood Watch is a remote defence point while locking my bedroom door is very near to my dear. How many layers I care to put in place and maintain will depend on how much of a risk I am facing and how much protection I want to afford. My tactics will be physical, behavioural and attitudinal.

A firearm is a confidential piece of defence. The fastest personal attack response might be use of the body as in martial arts, after that a firearm comes close to the speed. It also amplifies human power. To advertise that my house contains no firearms, I will have to be certain that I can match an attacker’s power with alternative measures.

In the digital world, owners and thieves constantly chase advantages from emerging technologies. The Internet is allowing information to be exchanged in real time. We create, process and publish information on many different platforms. The purposes are endless. The information needs to be promiscuous and intact at the same time.

Protecting data integrity is a good strategy. Wherever the data goes, it carries a certainty that is relied on to maintain proper behaviour.  Hashing is an example of making a volume of data unique and giving assurance that the information has not been tampered with.

Encryption renders the data unreadable without authentication. Another guarantee that abuse of data will be at least costly and at best useless. These two technologies protect the data at a level where the effects of an attack are immediate. They are widely available, easy to use, offer good protection in a wide range of environments and it is a good habit to protect your assets as best as you could.

How'd It Get To This

I am tall enough to have difficulty finding the right size clothes. With the success from this year’s weight training I now have to update my wardrobe and that led to a long search for a shop that will supply me with what I need.

I found such a place and have been there a couple of times, even got talked into signing up for their loyalty card. I have a knee jerk reaction to these cards because it seems I’m giving away too much information about myself for too little in return. I took it thinking that I will be back often enough for it to make financial sense.

Recently I got a ‘Welcome to our loyalty scheme’ letter sent to my address. I’ve paid for my purchases with my bank card and I wrote my details for the loyalty scheme in capitals to avoid any errors but yet still I am addressed as Ms Jean Pollonals. How did it ever get to this?

When a new way of using information is started in a company, data integrity must be designed into the process for relaying information from one point to another. We see in this case the shop had two accurate records of my information and yet the marketing department got a corrupted version.

It seems simple to accept the customer’s card payment, give notice that the information will be used for marketing and always refer to that single source. The consequences for this inaccurate information are endless. The Data Protection Act can be called into question here but my take on this is that it’s my responsibility to inform them of the mistake.

I would not like to put a store clerk on the spot having to decide if Mr Sean Pollonais should get the Loyalty Scheme benefits accrued by Ms Jean Pollonals. If that turns out to be a ‘No’, the shop will lose a customer for what was an avoidable reason.

Habits

Computers have instilled habits into staff at every business processing digital data. There are few systems that never require an initial log on. Web based accounts use a username and password for access. A truly global habit.

Application developers have been applying security functions that force user behaviours that will safeguard information. When users’ input is verified against a strong password policy, it is forcing a habit on users. The choice in the matter is removed and the system gets what it requires. The promise is that this alignment of input and policy improves security across the system.

Habits can be easily formed when there is a supportive culture and an accepted argument for the necessity. When information awareness training includes the value of the information processed on the system, the demand for its protection is made clear.

Strong passwords, encrypting emails, locking machines on leaving the desk and classifying documents are examples of good habits that are difficult to embed in a group. Technology could be used further to enhance the experience of the habit because in some cases, the user is being asked to do too much to comply for no apparent gain.

Automating as much of the process makes it easier for users to contribute to the security effort. I hold a piece of information that depreciates daily each month ending with a final value of £15. For me it is worth a lot even at its lowest. I created a habit that assures me of its ease of use and safety.

My train card is kept in a ticket wallet. I use the ticket at all barriers and replace it to the wallet each time I pass through a barrier. There are many times I question why I am replacing the ticket when I have to use it again at the next end of a station.

Putting the card back in the wallet is now automatic and I never have to search my belongings for it. I am also assured that I will not drop it anywhere far from a ticket point along my journeys. The practice is expensive but no longer onerous.

I do this because I appreciate the value of the ticket. The security habit that surrounds it is ‘good enough’ because it answers a common need in my particular circumstance.

Files

My first job after O’Levels was at National Housing Authority. My mother worked in the computer room taping punch cards. I was part of a new team updating incorrect customer records in preparation for a planned project.

The training period went well, the learning materials were properly prepared and the team was set to go at the end of it. We produced good results for one week only. We were unable to source vital records to begin any new files.

For the next month Alison Harris and I designed, got management support and budget to install a new cross–NHA filing platform. All customer files were placed into one folder per customer. When a department wants a file, they can go to that folder to select and compare information.

We worked with pens, paper and cardboard folders, all in a cage vault which served as the new storage centre. The computers were only used for the records department, the rest of the NHA was paper based. The new filing system lasted a couple years before it was computerised and staff work moved digital. So the team’s objective was completed eventually.

The problem today is same. Information becomes conventional within a group and it is a challenge to maintain a single mode in a large and disperse group. The team that manages email accounts uses short names only and will need a translator whenever that form of ID is used as a pointer to the same person’s records in Finance.

The data storage, processing and transmitting formats used in either department are not always compatible. If the practice is to work on localised information, a dialect forms, so to speak. Departments exchange less information and the entire group develops costly processes.

The solution is the same. IT uses the advantages of scale and makes it possible to maintain standards across large groups. The storage capacity, multiple transfer methods, multiple devices and the ease of publishing, all make the communication of knowledge and ideas easier. Centralising the data reduces the need for translators.