BD&F Information Security

Hold01

I ran my textile design business from my home for over 15yrs. The house was a modern ruin. It was built in the late 60s with fundamental flaws which plagued its life. By the 90s it was back to bare essentials. The yard was well maintained, the front gate worked, there were locks on two of the five outer doors. Sunlight and Moonlight streamed through the holes in the roof.

I will travel singly with goods to different parts of the Caribbean. I had a PomPek named Woogie as a guard dog. Friends looked after her and the house when I was away. That place was regularly stocked with raw material worth a lot of money and essential for the business to continue.

My mother once shouted back to the empty house “Sean, remember to turn off the oven!” when she spotted a group of strangers walking the street as she was leaving home. A neighbour once told me they knew when I came home on evenings because that was when the house lights went out. It was one of my tactics to avoid being a victim in a country where crime was rapidly increasing.

The house was burgled once, a friend, an insider job! Some primary school children threw a rock through the front window, thinking the house was already abandoned. I learnt a lesson from both incidents. I sectioned off the business from the living area and I kept the garden in top condition. When the lights went out at night, the music started.

Security does not have to be expensive. Camouflage can be effective enough to form another layer of defence. Hiding an asset buys time when someone is determined to find it and eliminates the threat of opportunists? Steganography is the technique for hiding data in images but that is not what’s being discussed.

An electronic staff card is an example. It is best to leave the company unidentified. The layout of your premises will also go a long way to protect your assets. The ISO 27001 standard layers start at the building’s perimeter and closes in to the data hosted on the internal systems. It’s a great standard to base security efforts but it must not remain as the final say on security in your organisation.

Understand the threats, add simple, easy to maintain hurdles and hold a unique security culture.

As Good As

Returned to Gatwick on Sunday morning greeted by genuine winter weather. The deicers were preparing a plane for taxiing, the jetty for our flight was stuck and the old skool steps were iced over. A cold punctual train took us to a warm taxi, soon after, home.

The view that afternoon was exciting. Real snow piled higher than most times and set to last for days. The light was changing rapidly and the traffic died down to leave a twilight quiet street.  I started to think about the New Year and what changes I wanted for BD&F in 2013.

Last year I started designing InfoSec governance solutions, automated to help line managers with governing InfoSec compliance. These applications presented users with aggregated interfaces triggered by events translated from legacy functions.

I worked with in-house developers and small budgets to produce, host and deploy these programs to the benefit of all staff involved with the targeted processes. My contribution was my InfoSec knowledge and the analysis of the work flows.

This year I will learn to program in .NET as I think it will broaden my skill set and give me the capability to be more hands on in the development process. I used Reporting Services years ago and enjoyed it.

It is a commitment I debated for some time, weighing up pros and cons of spending the time to learn to code. I thought about focusing on design and project management but figured that coding will inform my practice in those areas including how I communicate with fellow developers.

Looking out on the street Sunday evening I decided to commit to this because the holiday trip was seen as the hand over point for plans that were earmarked for action this year. I was thinking a change was as good as a rest.

Reward

In Standard 3, Mr Howard and I had a deal. He’d delivery 6 lashes to my palm and I will forsake all homework. That worked out happily for me as I got the freedom on afternoons to play until the sun went down and after a short while there was no major pain from the morning ritual.

My school work suffered of course but my reasoning was that remaining in the A stream was a good enough result for the all the fun I had during the term. I spent my afternoons playing cricket, climbing trees, pitching marbles, going to funerals as my school was next to a church, playing at other friends’ houses and on the whole having a blast of a time.

I ignored the initial ignominy of doing something that was considered a breach in order to gain a reward that I considered important. After some time Mr Howard just did not bother with the lashes and I continued to enjoy my schools days.

If that perspective is applied to business and Information Security, there will be an assessment of the penalty for breaching a law/standard against a commercial gain. The cost of losing customer data might be high in terms of trust, reputation and goodwill but the cost of a fine for not putting a control in place might be affordable.

The resolving of risk vs. reward comes up often in the discussion of Cloud services. Hosting information in a supplier’s network can seem full of risks. There are the laws and standards to consider where obligatory prescriptive controls can have punitive actions attached. There are risks to the information’s Confidentiality, Integrity and Availability from the systems’ architecture, suppliers’ InfoSec cultures and the paucity of contracts.

Cloud services provide a menu of functions that many businesses are not willing to fund in house. Getting an analysis of the demographic information contained in records of your customers’ purchases can lead to higher profits. The protection of that data during exchange is prescribed but a business might decide that a costly level of encryption might be overkill and accept the risk of fines when viewed against the commercial advantage of outsourcing.

Companies must recognise they have a duty of care towards their customers as data in the wrong hands can be dangerous. Businesses are always seeking advantages to enhance profits and are quick to accept technology that supports that effort. When laws and standards lag behind innovation, organisations must keep their customers safety paramount while exercising judgement on ‘good enough’ security practices.

Time Flies

Time flies like an arrow.  This is the first part of two statements that illustrate the challenge to get computers to grasp context. If decision systems are to be fully automated, programs will have to grasp the meaning of words in situ.

Fruit flies like a banana. The second part, throws out all the previous peculiarities and you have to start building the meanings again. To make decisions where the desired result depends on context, a program will have to read between the lines as we do when supplied data. Without this ability the risk of miscalculation is higher.

Information Security Governance will benefit from automation tools that can handle the discrete tasks such as audits for access, server patching and 3^rd Party links. There are many more functions that can be analysed and described in formal languages and executed automatically. This will give InfoSec more time to spend at the initiation of projects to have a greater impact.

Automation will also help with the communication needed across the organisation with event driven procedures. When an application is submitted it can signal the start of template correspondences, schedules and reports which will require human intervention to various degrees.

The level of human involvement will depend on the reach and accuracy of the systems deployed. There are many methodologies for managing such projects where an operation is studied and then automated. There is also a lot of technology available to IT consumers that will deliver gains in time and consistency for tasks that are recognisably repetitious.

Macros for example can be built to help with almost any tasks regularly handled in spread sheets. The quality assurance has to be high because once built these programs are often left to run without regular exposure to criticism. If the function fails because of an unusual event, the mistake becomes a potential threat.

Automate what is easily understood, keep analysing the process, and allow for human veto.