BD&F Information Security

Hold04

My daughter is at the drawing age. At pre-school she does these pieces of art and brings them home for us to adore and if they are truly adorable, they are hung up for display. She can now compare her work to her older brother’s and seems chuffed when hers is placed next to his.

I’ve lived off painting for many years and still think it is an enjoyable way to make a living so I do what I can to encourage them to practise as often as possible. From friends and family we get a lot of art material for them to work with. One of the most frequent gifts is the sketch book. It is not the most popular though because they seem to pile up remaining empty while the loose A4s get all the mileage.

I now collect scrap paper wherever I go and place them conveniently around the house for whenever they feel the urge to express themselves. It seems like opening a scrap book is a step too far when compared to grabbing a loose sheet and feeling free to orient it however they wish. They have forgone the discipline of creating an archive for the informal convenience of drawing on scraps.

If middle level managers can find it just as easy to perform the governance of InfoSec, they can become champions of the cultural changes needed to make securing company information part of doing business.

Many of the governance tasks are tedious and built into applications that require too many authentication points. If these applications are brought under central control perhaps with single sign-on, it means that to run a governance task will no longer require minutes to get to the file.

Many of the applications require specialised knowledge to ‘operate’. When a spreadsheet is custom built it can also mean custom operate. Skills for maintaining the ‘Starters Leavers’ workbook might be different from those needed for the ‘BYOD Register’. Having to update these two workbooks within one morning can weigh heavily on the mind of a busy person. This can lead to Subjective Productive Procrastination!

Hold03

In the 70s Trinidad expanded its road infrastructure by building motorways between the three main towns of Port of Spain, San Fernando and Arima. Arima was 20 miles from the capitol, Port of Spain, and a morning commute was usually two hours. That decade of road building had a major impact on the types of cars Trinidadians bought.

It was common to drive a stick shift before then. They were the norm and in some cases seen as sporty and an advantage to adventurous drivers. When the traffic jams reached epic proportions, drivers opted for the automatics to avoid the constant changing among the lower gears to match the lunges and halts of the daily procession. By the 90s a manual was very rare and had to be specially ordered and it was of course, pricier.

The Information Security governance traffic jam is reaching similar conditions. Managers are becoming aware of the importance of InfoSec and engage with InfoSec more readily. Each project adds more governance tasks from the basic Plan Do Check Act cycle maintenance to particular efforts such as tracking third party data transfers.

The processes to govern what is happening to the company’s information will benefit from automation. Much of the work is repetitive and regular, Triplicate! MS Excel is still the lingua franca of record keeping and reporting and there are heroic efforts where spreadsheets are near enough operating as databases with GUIs.

When the number of processing functions increases so too does the complexity of working in Excel. The user will have an easier time if the tasks are presented in a Tonka-like manner. Much like an automatic gear. You want to drive, choose drive.

Custom built web applications can make a difference. The access and subsequent screens can be role based, limiting the information to only what is needed. The automation will be logical, event driven and human decision where needed. The application will be designed to save time by presenting the information in the format required without users having to ‘cook’ from one stage to another.

With automation there can be easier scheduling. The key functions are initiated and the results are returned within a predictable time frame. The user is free to focus on outcomes and use that information to maintain the InfoSec effort.

Spending two man days to navigate through Excel to extract a piece of knowledge and update a weekly report is so 90s!!

Hold02

When offices were entirely paper based there was a process of copying documents in triplicate. You had two sheets of carbon paper placed equally between three A4s. These were placed in a typewriter to record the information. The A4 at the bottom was kept for record while the other two copies will go out into the world to serve their purpose.

Receipt books worked like that also with blue copying paper to create the company’s record while the customer kept the ‘original’. These systems worked well for their time. I still consider some of the old office processes to be ingenious and some are still valued today.

With the advent of information technology those systems were digitised to gain speed. That has been a success and allowed an increase in the volume of information produced and processed across all aspects of life. The approach to information processing is still influenced by those old office practices and this cross threading of ideas and technologies is proving costly.

Most companies maintain external network links with suppliers in order to exchange information. These collaborations are increasing as Cloud offerings become specialised, easy to adopt and cost efficient. There are three main types of links; send, receive and remote access.

These links into the company’s network must be recorded when they are set up and tracked until they are no longer needed. This record keeping is often handled in Excel. If there is a governance regime in place where the links have to be vetted via an iterative process, Excel begins to resemble a triplicate process that will not scale.

Here is a real world example: A team requests and fills out a form giving information on a proposed third party link; what type and class of information, who is responsible and how long it is needed, among other questions. The form requires access to the company’s policies and standards. Some of the standards are classified so users have to request a copy.

The governance team reviews the form and either approves immediately or enters into an interview via email, telephone or meetings. Email is the preferred method as it documents the discussion. This usually concludes with the link being approved whereby the applicant and the team responsible for installing the link are informed, via email.

The link form is entered into a database where the form’s information is copied into a header table to allow search.

The process is designed to allow information to be gathered via a dialogue and this is successful because the initial questions can sometimes lead to peculiar discussions as the nature of the project is explained. The email exchanges to a widening audience and the pulling together of multiple sourced data is where a costly bottleneck is formed. The classified standards are also exposed.

This is a problem that can be fixed by making better use of IT’s capability to mimic repetitive tasks, limit access, control versions of a document, broadcast a single version of the truth, act on events, schedule events and make information available when needed, how needed.