BD&F Information Security

From My Point Of View

My primary background is fashion design. For close to fifteen years I coloured lengths of cloth, took them to garment factories to be made mostly into shirts and also women’s two piece outfits. My main market was direct customers that I built up from making the rounds of the offices in Port of Spain, Trinidad, at the end of each month. 

I also supplied tourist shops in Tobago, Grenada and Barbados always looking to differentiate my products with design, quality or price. This made my sales trips easier and buyers were always excited to carry my line.

I moved to the UK and shifted to soft furnishings with a stall at Covent Garden and the chance to supply my cushions to stores. I then wanted a change of career and thought computing was a challenge I should take up.

My first computer was bought in 1999 and I remember taking it home, puzzled about how to turn it on! An IT newbie. I did a BSc in A.I. and then moved into InfoSec for a MSc. My first job in this field was as a Web Application Analyst helping a development team to write secure code.

Throughout my career I have always maintained the idea that InfoSec is about protecting information as it travels across an organisation. This should be done in such a way that all staff can contribute at their point of contact with the data and the interaction should be as abstract as possible so that more attention can be paid to the business aspect of the function.

I changed cars a few months ago and only recently opened the bonnet to top up the windscreen washing liquid. This is how I envision InfoSec should appear to most members of staff. Focus on the driving and not the mechanics. I trust that if the engine needs oil, the oil light will flash. Pretty much as I expect the fuel gauge to let me know when to fill up.

A lot of the language of InfoSec is inside speak and this can be self-defeating for practitioners because it focuses on the technology and misses the point of the entire exercise, which I believe is to safely conduct business with digital information.

A couple years ago I was driving on the Autobahn and saw whenever we had to make a sudden stop, the hazard lights on the other cars will go on. I thought the German drivers were really skilled, to have the presence of mind to hit that switch in an emergency situation. Don’t laugh!

How Fast Do You Want To Go

In motor racing, they say you could go as fast as you can
afford and that the best drivers win races as slow as they can.

This apparent paradox has its parallels in the approach to
securing information. While the mantra of “Security must be good enough!” lies
at the basis of any strategic approach to building a defence around an
information system, it is often trumped by the idea that more is better.

Information Security students often propose a double
encryption solution as the best protection for data. Of course they choose the
two strongest ciphers they can find. I always have to point out the costs of
this, the energy and time it takes to encrypt and decrypt each time. I also ask
why will there ever be a need to make a near unreadable piece of information
only slightly more unreadable.

The promise of top encryption algorithms are that it will
take too long to guess the key that decrypts the information and therefore make
the effort worthless. Criminals do cost-benefit analysis too. If I have to send
sensitive information over the Internet, I will encrypt it and, if possible, use
a secure channel such as SSL. While in transit the data will be double encrypted
but my main reason for the first encryption was to protect the data at rest, when
it crosses to the other network and has to be treated discretely. There it can
only be read by those to whom I’ve given the key.

Information Security as a practice should see itself as a risk
enabler. Almost all companies that pay attention to InfoSec will have policies
that prescribe best practices for data protection. Most for example will set a
standard for transmission and SSL will be one of them.

Does this mean that when a piece of information is encrypted
at rest, it cannot be transmitted on a non-secure medium such as HTTP? There
may be other risks that come with HTTP that have to be considered but from a
privacy point of view, why not?

And if the answer is that there is no difference, what
should be InfoSec’s response? Should the policy take priority over the fact
that there is an alternative cheaper medium that is secure enough for the business?

Moving

Last few weeks have been hectic. We moved to a new house,
just about a mile away from the old one where we have been for the last eight
years. For those who have never done this, multiply all your expectations in
every aspect by ten!!

We are still straddled between houses. The old one has been
repainted to return to the landlord. It is serving as a laundrette and a
holding bay for stuff that is earmarked for the new attic. In the new house,
there is some plumbing that had to be upgraded, access to the attic is more
basic than before and the many workarounds practised by the previous owners are
still invisible to us so many things are still a decision to spend to suit us or not spend
and learn the correct modus operandi.

One huge task that we have only addressed (hint) where we
have had to is the updating of our profile details with everyone we do business
with. We started with an ambitious list made up in one sitting that included
the obvious stuff like the Borough Council, our banks, Amazon(!), and the two
main utilities.

The rest of the list is a mix of the obvious and the few
seldom remembered organisations that we deal with. Last night I remembered
Companies House and today my CISSP reminder to update my credits came so that
got added to the list. I think I will buy a six month redirect at the Post
Office and hope that acts as a catch-all for all snail mail that I need to
update.

The forth principle of the DPA states: Personal data shall
be accurate and, where necessary, kept up to date.

I consider it my duty to update my records with all firms in
order to avoid any mistakes in the future. It also serves to cut down on
possible fraud that can take advantage of using my name along with an address
that I no longer occupy. Did I mention my bank?!