BD&F Information Security

Files

My first job after O’Levels was at National Housing Authority. My mother worked in the computer room taping punch cards. I was part of a new team updating incorrect customer records in preparation for a planned project.

The training period went well, the learning materials were properly prepared and the team was set to go at the end of it. We produced good results for one week only. We were unable to source vital records to begin any new files.

For the next month Alison Harris and I designed, got management support and budget to install a new cross–NHA filing platform. All customer files were placed into one folder per customer. When a department wants a file, they can go to that folder to select and compare information.

We worked with pens, paper and cardboard folders, all in a cage vault which served as the new storage centre. The computers were only used for the records department, the rest of the NHA was paper based. The new filing system lasted a couple years before it was computerised and staff work moved digital. So the team’s objective was completed eventually.

The problem today is same. Information becomes conventional within a group and it is a challenge to maintain a single mode in a large and disperse group. The team that manages email accounts uses short names only and will need a translator whenever that form of ID is used as a pointer to the same person’s records in Finance.

The data storage, processing and transmitting formats used in either department are not always compatible. If the practice is to work on localised information, a dialect forms, so to speak. Departments exchange less information and the entire group develops costly processes.

The solution is the same. IT uses the advantages of scale and makes it possible to maintain standards across large groups. The storage capacity, multiple transfer methods, multiple devices and the ease of publishing, all make the communication of knowledge and ideas easier. Centralising the data reduces the need for translators.

How Secure Do You Want To Get

I lived on a farm in the countryside where we never locked
the doors. The house was up a 1km track and we were already living where the
crows turn back. Locking the doors seemed a waste of time. Over 2 years there
was never an incident. It was the wind that blew off the roof in a February storm.
We had to move for months while it was repaired.

One risk was covered by our knowledge of the area and the
other was covered by a contract with the landlord. Keeping all our stuff intact
was very important to us and so was having a warm dry house.

Information Security uses a triad of targets to base all its
efforts when protecting data. The Confidentiality, Integrity and Availability
of information are the three. Systems are analysed for their ability to provide
a desired combination for each process within.

Each organisation will decide on the different combinations.
Within a business, sub-divisions will have their own versions of the
combinations. The requirements depend on the value of what item is being
protected and what means are available to lower the risks of not being able to
continue operating.

There are formulas and frameworks to help with these
decisions but my farmhouse experience shows they can be judgements made on the
ground. The common driving factors I believe are the commitment to protect
value and compliance with the laws and regulations.

The trick as in most things is achieving efficiency in
outcomes. To keep an item safe the protection should be as little as needed and
as strong as it should be.

The Guys who set up the Typewriters

Q: Do all employees (permanent staff and staff contracted from other organisations) all receive information security awareness training?

A: Not all staff receive this training but the key
Technical staff do

Ran across this Q&A this week and it led to a thought; we are struggling to set a place for InfoSec Awareness in the arsenal. If there is agreement to support such training, there is still the discussion - to whom to focus it on.

I try to think of Information Security as an eternal endeavour. Humans have been keeping secrets for competitive advantage for a very long time. The change in technology is a constant. If there is a group of people working towards a goal, all should understand the value of the operating information.

If the question above was asked at a large company in the 1920s, will it have been okay to say that the technicians were aware of the value of the information and not the rest of staff? Organisations receive, generate, process, store and dispose of information in numerous formats.

InfoSec efforts should be applied at all points where valuable information and a risk of exposure intersect. The profile and potency of each effort will depend on choices made by the organisation.

One of the weakest points will be staff members who do not appreciate what information means to the business. Training those people will go a long way in increasing the defence of the company’s prime asset, information.