BD&F Information Security

Bit by Bit

“Lil bit by lil bit, does make big bit!” How many times has my mother repeated that to me? It was most often aimed at improving my habits with money. I use it all the time now to approach life as it comes.

I started weight training early this year. It was my first step back into a gym since I found myself with my face stuck to the sandy floor of Saga’s gym, decades ago, unable to complete a pushup. The first question this time was “Why do you want to weight train?”, “I want to be strong.”

I have been manoeuvring towards weights for some time. Year before I spent each weekday morning doing self-resistance workouts and strengthening my body and my habits. It’s been a good year on the weight machine under supervision. I am getting strong. We take measurements every eight weeks and the improvements are welcomed!

I always leave home early enough to arrive at the machine in a relaxed focused state. Habits are essential to success. When a goal is decided and a route is determined, planning should include the incremental habits that help accomplish the objectives. Habits carry out the support of the surface processes.

At work I use technology to help maintain good security habits around the information used by the business. I design ways to do the right thing in an efficient manner which is supported by constant awareness training.

We now work with automated systems to complete regular tasks for preserving data accuracy. Awareness training creates appreciation of the value of exact information and why it is important to guard the data’s integrity.

I am still using my mother’s advice when I design these solutions. There are no simple solutions that will work everywhere. Each goal is unique and should be treated likewise. Within each project there are new challenges that are better solved with equally new solutions. Remember to include the essential and the incremental.

Masks

Today my son is at a mask making workshop at the UK Centre for Carnival Arts. Hopefully he will get an idea of the transformation mask wearers report when they don a mask. He is planning to make a set for the family, perhaps for the Christmas dinner, which will be nice.

I made costumes in Trinidad but never wore one. The nearest I’ve gotten was in workshops with the great Peter Minshall. In those theatrical workshops I got the chance to wear his masks and I must say I felt a freedom to be an other from under the disguise.

On the first day of the Trinidad Carnival there is J’Ouvert which starts about 2am on the Monday. It’s dark, you get to cover yourself in mud and party in the streets through the sunrise into the mid-morning. When I did this, I will walk up to friends and not be recognised. That was a new feeling, being a genuine stranger to those I knew.

The word ‘mask’ reminded me of my work where at times information is masked to protect it from unauthorised access. The most prevalent example is that of test data. When an application is built or upgraded, it has to be checked before it is placed into the working environment. The changeover from old to new must appear seamless to the user.

The best way to check an application is by running it with the data that it will process for the business. This creates a problem of confidentiality because the people testing the application will now have access to real data. Imagine a developer having the same view of the company’s salaries as the people working in the Finance department.

The Data Protection Act does not allow this. If a company collects a customer’s information in order to process a transaction, it is expected that the use of that information will be limited to the transaction only.

This is where data masking comes in. There are different software techniques that will take real information and prepare it to be legally processed. This is not the end of the problem though as testers must also put an application through the rigorous testing of unlikely scenarios which will crash a program if certain conditions ever come together, such as, three John Smiths sharing the same post code.

Data masking is analogous to a Carnival headdress in that it can either simply render the original unrecognisable or it can be used to present an entirely new essence for novel effect.

WowWee Knows Some Things

WowWee was a gift for my son in 2008. I felt it best to let him interact with machines from an early age. I was in for a surprise. WowWee was more machine than interactive.

Today WowWee is a doorman. Buffed like most, stoic as well. We’ve removed the batteries so WowWee does not take in any data anymore and has no ability to react. Perfect for the job! Stands there all day and keeps the door open. When the door needs closing, gets picked up, placed next to the sofa and stays there until the door is open again.

WowWee is programmed to follow instructions from a remote control unit which we’ve lost long ago. Could walk like a human, sees things in colour including infrared and has a sense of touch. Altogether not impressive when put into action. The sparkle wears out in a few days when it becomes apparent that WowWee knows some things but understands nothing.

WowWee will do pretty much the same thing, to the same remote command, every time.  Data in, action out. That’s the level of understanding, the theory being that information is the understanding of relationships in data and knowledge is the understanding of patterns in information. WowWee is appreciated, as an early step towards machine intelligence that deciphers data.

Businesses benefit when they can derive knowledge from the information they process. When information is mined to help make tactical decisions, more value, in the form of knowledge, is extracted from the information and the patterns within. If WowWee for example decides to move next to the sofa when I get to the door at around 10:00pm, we can say there is understanding.

Businesses want to detect the patterns contained in their information. If they be confident that the information is accurate, the answers to queries can be trusted. Imagine a company running a promotion to all the Johns on John St in the parish of St John, already aware of how many there are and what they will most likely be interested in. Micro campaigns.

To effectively do this, the initial data has to be accurate and when information is moved around the company it has to maintain integrity. It is a perpetual challenge to spread information to where it is needed, in the correct state.

The solutions to accomplish this are not limited to expensive software systems. To maintain information integrity, a culture of awareness and custody has to become part of the organisation. When information is interrogated and its results are valued, the necessity for accuracy is recognised.

Life Cycle

Autumn is surely here. Clocks have gone back, it’s dark on leaving the office and the streets are covered in soggy leaves. A walk in the countryside last Sunday was fun with the children shovelling through the heavy leafy carpets with their feet making that once a year shug, shug sound.

I grew up in Trinidad, 10 degrees north of the Equator where the pronounced seasons are Rainy and Dry, spread near evenly across the year. The temperature range is small and so are the daylight differences. In the UK there are more seasons and the effects of their differences are numerous.

Cycles of life can be observed everywhere. With an average life span of 70 years, humans are perhaps tuned into those cycles that are crucial to having a good life but of course there are many others that are to the extremes of either side of that range. Mosquitoes might live just a couple days, the leaves on the trees are annual while our Sun has an expected 14 billion year lifespan. It’s only halfway through that so need for a 70 year lifer to worry.

Inanimate objects have a lifespan also. The ‘life’ might be debatable but the span is definitely limited. Everything we see around us was once something else and will be something different in the future. Things we create will span a fixed amount of time and then no longer be.

Data is like this. We create information to fulfil a purpose. When it is no longer useful it comes to the end of its lifecycle. The usefulness though is not limited to its intended purpose because information can be re-purposed. The biggest concern is that the new purpose will be criminal.

When a process is designed, the lifecycle of the information used must be included and preparations must be made for security at all stages. When that data is no longer needed it must be discarded after an agreed time and in a manner that gives assurance to all that there is no possibility that it can end up in the wrong hands and re-purposed to the disadvantage of the original data owners.