I’ve been working for a while on a policy and associated procedures for Trinity College Dublin to enable us to leverage various cloud technologies and services for the benefit of the college. What has struck me is the complexity of dealing with the topic in a large-scale environment.

As consumers, many of us use cloud services every day; examples are Gmail and Hotmail for email; Amazon Cloud Drive and Dropbox for file storage; Google Docs, Docs.com and Microsoft Skydrive for document processing; Twitter, Facebook, Google+ and LinkedIn for social networking, etc. Many of us tend to use these and other services with little thought being given to security, data protection, privacy, identity theft, ownership of data, etc. When considered from a corporate or business perspective, these issues are significantly more important and take on many complex legal aspects. Yet, in a corporate and, indeed, an educational environment, there is significant pressure to enable these services in the business context, since end users and familiar with them from personal use.

Pursuing another interest of mine this evening – Internet Radio – I came across C-SPAN Radio and just happened to stumble upon the live proceedings of the US Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies, on 6 October 2011, discussing the issue of the security implications of cloud computing. The Committee was addressed by very influential people in the area of information technology, information security, education and regulation:

• The Honorable Richard Spires, 
Chief Information Officer
, U.S. Department of Homeland Security
• Dr. David McClure, Ph.D., 
Associate Administrator
, Office of Citizen Services and Innovative Technologies, 
U.S. General Services Administration
• Mr. Greg Wilshusen, 
Director of Information Security Issues
, Government Accountability Office
• Mr. James W. Sheaffer, 
President
, North American Public Sector
, Computer Sciences Corporation
• Mr. Timothy Brown
, Senior Vice President and Chief Architect for Security, 
CA Technologies
• Mr. James R. Bottum
, Vice Provost for Computing & Information Technology
 and Chief Information Officer
, Clemson University
• Mr. John Curran
, Chief Executive Officer
, American Registry of Internet Numbers

Each contributor submitted a paper to the Subcommittee and they are all available on the Subcommittee’s website. So if you are looking for what the current areas of concern are in relation to security and cloud computing, why not pick up the papers and listen back to the oral testimony.

Links to the papers (PDF)

• Richard Spires
• David McClure
• Greg Wilshusen
• James W. Sheaffer
• Timothy Brown
• James R. Bottum
• John Curran

What is your organisation doing about security and cloud computing? Do you have a cloud computing policy or are your end users simply using cloud services without regard to existing policy or legislation? Please leave a comment and let me know.

If you found this post interesting, you might also like:

• Data Loss by PA Consulting
• Laptop Theft and Data Loss By Irish Health Service Executive
• More Laptops Stolen – And This Time It’s Personal

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!

I went along this evening to a pretty full lecture theatre in Trinity College’s Science Gallery to listen to Venky Narayanamurti of the Harvard Kennedy School speaking on the subject of science, technology and society. He is a man clearly passionate about his topic and spoke with conviction, vigour, animation and not a little humour. Venky spoke about the great inventors – Edison, Watt, Einstein, Pasteur- and how invention and innovation come from applied science, research, experimentation, use cases and what he termed “grand challenges”. He spoke passionately about the need for an understanding of science among our leaders and hailed Obama’s commitment to the sciences in his inaugural speech:

“We will build the roads and bridges, the electric grids and digital lines that feed our commerce and bind us together. We will restore science to its rightful place, and wield technology’s wonders to raise health care’s quality and lower its cost. We will harness the sun and the winds and the soil to fuel our cars and run our factories. And we will transform our schools and colleges and universities to meet the demands of a new age. All this we can do. All this we will do.”

Vekny spoke about how innovation does not always have to come from inventing something new, but can also come from finding new and imaginative ways of using something that already exists. He cited the case of Ushahidi, an open source, ”crowdsourcing” system that uses simple mobile technology, such as phone, SMS, and web, combined with geolocation and mapping software on the Internet to track emergency and crisis information. Ushahidi is a fantastic example of how collaboration and innovation, coupled with existing technology, can come together to solve real world problems. It was used in Kenya to map incidents of violence and peace efforts throughout the country based on reports submitted via the web and mobile phone after the 2008 elections. It was used in India to monitor elections and it was used in Washington DC to deal with the aftermath of their snow this year. It is now being used to monitor the crisis in Haiti after the earthquake.

In question and answer following his speech, Venky’s answer to one question stuck with me. Asked about invention and about how and whether people should focus their efforts, Venky said, ” You can’t be everywhere, because then you are nowhere.” How true.

It was a wonderful evening in the Science Gallery and I look forward to attending more lectures there. The lecture was recorded, so I hope it will find its way to YouTube or iTunesU.

If you were at Venky’s lecture and would like to add your thoughts, please leave a comment and add to the record.  If you have used Ushahidi, or know about the application, I’d also love to hear from you. And, finally, if you have had experience of crowdsourcing, please share your thoughts and experience here.

If you liked this post, you might also like:

Society’s Grand Challenges: What Is The Role of Science and Technology?

Social Media: Creating Collaborative Conversations

Receive new articles from  johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!

This surely is a big question, some answers to which I look forward to hearing at Trinity College’s Science Gallery next Wednesday, 24 March 2010, at 18.00 UTC/GMT.

Professor Venkatesh Narayanamurti, Harvard Kennedy School Director of Science, Technology and Public Policy will speak on “The Role of Science and Technology in Meeting Societal Grand Challenges” in the Science Gallery’s Culture of Science lecture series. The lecture is presented in association with the TCD/UCD Innovation Aliance, which is a partnership between both Trinity College Dublin and University College Dublin that will work with the education sector, the State and its agencies and the business and venture capital communities to develop a world-class ecosystem for innovation that will drive enterprise development and the creation of sustainable high value jobs. Wow!

Entrance is free for members (SG members and on production of a valid TCD and UCD id card) and a mere €5 euros for other guests.

You can keep up with events at the Science Gallery on their website, follow them on Twitter @sciencegallery, or join their 740+ fans on Facebook.

Trinity College is also on Twitter @tcdublin and has many sites on Facebook.

If you’d like to connect with me, check out the contact details on the right.

If you liked this post, you might also like:

Inspiring Talk by Venky Narayanamurti at Science Gallery

Social Media: Creating Collaborative Conversations

Receive new articles from  johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!

The Twittersphere was loaded tonight with Tweeters complaining about a major failure in Eircom’s DNS service. I have been having ongoing problems with Eirom, which is one of Ireland’s main ISPs, and have little satisfaction in getting my problems resolved. It is clear from tonight’s events that I am not alone. I had to rely on O2′s mobile broadband service for much of the evening.

Thanks to a number of Tweeters, I was referred to OpenDNS, which is a provider of free security and infrastructure services that make the Internet safer through integrated Web content filtering, anti-phishing and DNS. I had to sign up for a free account, which was very easy to do and took just a few minutes. Once this was done, I changed the DNS entries in my broadband router and I was up and running on the web again.

I am still looking forward to the day when I can dispense with Eircom’s “service” all together.

What has your experience with Eircom’s broadband service been? Leave a comment and let me know, though I expect I already know the answer.

I discovered this great programme from Evernote over the weekend. Available in both free and premium editions, it enables users with an Evernote account to store snippets of information, thoughts, pictures, documents, etc on the web. I regularly write notes and post-its to myself but often lose, mislay or simply forget about them. With Evernote, all those notes can now be stored simply and conveniently in one place on the Web for later processing. It is also possible to share your online notes with other Evernote users.

The service is available on a wide range of platforms, which is one of its most attractive features. There is a client for Windows and Mac, a version for the iPhone and other smartphones, a browser service and an email service. This means that it is pretty easy to capture and store a note, picture or document on any device no matter where you are. I tried to install it on my Blackberry but had problems with the Blackberry software. However, it was not a problem, as there is a mobile web version as well and the email service can be used with equal convenience.

The free service is pretty generous. It gives 40Mb of storage a month, which should be plenty to capture and store short notes or a few pictures. You can later move them into your preferred tool or system, or delete them when you have dealt with them. The subscription service costs $5 per month or $45 per year and gives 500 Mb of storage, more options and added security. I’m going to stick to the free service for the moment and see how it goes.

So why not check it out and if you like it, leave a comment and let me know.

ActiveWords, is a computer desktop productivity tool that automates many common activities that users perform every day. As you type, ActiveWords logs each word, even if a text editor is not being used. Once the appropriate function key (F8) is pressed, the action associated with that key word is performed. Actions can be any of the following:

• Substitute text
• Launch a programme
• Open a document
• Navigate to an Internet site
• Send an email
• Open a folder
• Run a script.

This is a great time saver and I have become a fan already. It cuts out a lot of pointing and clicking and makes life on the desktop just that little bit easier.

I use the keyword “outlook”, followed by F8 to open Outlook. I email several people regularly and by associating a keyword with them, in seconds I can open up a new Outlook email already addressed to them. I also use a few documents regularly and a short keyword opens each of them for me. There are a number of add-ons available for the product that are quite useful. These provide pre-defined keywords and menus for use with popular Internet services such as Google, MSN and Yahoo.

At the moment, I understand that ActiveWords is only available for the Windows platform.

You can download a free 60-day trial from the ActiveWords website. I was very pleased, shortly after downloading the programme, to be contacted by Buzz Bruggeman, one of the owners of the business, offering to go through the programme with me on a Skype call. Now that’s what I call service!

So why not check it out and if you like it, leave a comment and let me know.

I had not intended this blog to become a security-related publication, or one dealing exclusively with theft of laptops and storage media. But there is certainly a trend developing; let’s hope it does not last.

Following on from yesterday’s post, and from my post of 24 August 2008, we learn today from a report on RTE, Ireland’s national broadcaster, that a laptop computer containing  the records of some 75,000 customers of Bord Gais Eireann (BGE – the Irish Gas Board) was was one of four stolen on 5 June 2009, although news of the theft was only released today, 17 June 2009. The records relate to customers who signed up for the BGE “Big Switch” campaign, which encouraged them to move their account for electricity supply from the Electricity Supply Board (ESB) to BGE. Like previous incidents, data on this laptop was reported not to have been encrypted.

This time it’s personal, as I have been potentially affected by this latest security failing.

It appears to me that many (I suspect a very, very large number) organisations that process personal information simply do not take the issue of electronic data security and data privacy seriously enough. Throughout the world, we learn regularly of significant breaches of customer confidentiality. As  I wrote in my August 2008 post, many of these incidents occur through the failure to manage portable devices and removable media effectively. But there is also a lack of appropriate polices, procedures, practices, guidelines and controls. Indeed, in many organisations, there appears to be little or no attention paid to security at all, except for template procedures and documents.

The 2008 Annual Report of the Irish Data Protection Commissioner provides information on the top ten threats to individual privacy as identified by his staff. The unscientific list represents perceptions of Commission staff of the major threats to privacy at the close of the year 2008, based on the queries and issues they deal with on a day to day basis. The top ten threats are identified as follows:

1. Failure of organisations to have even the most basic protocols in place to minimise the loss of customer and employee data.
2. Continued lack of proper procedures in public and private sector bodies to limit access by their employees to personal data on a ‘need to know’ basis.
3. Failure to take due account of the legitimate privacy expectations of members of the public when moving towards greater efficiency of public services.
4. The tendency of new legislation to seek ever more personal data from the public and the sharing of that data between organisations without (in many cases) any real business case to justify such sharing.
5. Criminals using increasingly sophisticated methods to part individuals from their personal data for criminal and fraudulent use.
6. The extended use of the Personal Public Service Number (PPSN). This is the number given to each citizen by the Government to identify them when they interact with public bodies. More and more services seek to use this identifying number, often without any credible justification.
7. Publication and availability of excessive personal data on the internet (sometimes placed there by the individuals themselves on social networking sites etc).
8. Continued lack of awareness among data controllers of their data protection obligations.
9. Indifference on the part of data controllers to the consequences of their actions when they deliberately and persistently refuse to respect the data protection rights of their customers.
10. Continued lack of awareness on the part of members of the general public (who, as a result, give away their personal information too easily, don’t ask why personal information is needed or fail to ‘tick the box’ to say that we don’t want to be contacted).

BGE issued a short press release advising that it had promptly informed the Irish Police and the Data Protection Commissionerof the theft and that it will be contacting all affected customers. However, since there has been almost a two-week lag between the occurrence of the theft and the issue of the press release today, it is possible that customers’ financial or other personal information could have already been compromised. This is simly not good enough. It is no good doing things right (if you can call a two week delay in advising affected customers “right”) after an incident has occurred; appropriate steps must be taken to ensure that such incidents do not occur in the first place and that, if they do, the risk to information security is minimised or removed entirely. Time will tell whether the “risk assessment” referred to in the BGE statement led them to a correct decision not to advise customers sooner; I hope they got that right.

Organisations must take serious steps to improve security now. Some of the steps they take might include:

• Raising security awareness among all staff and providing appropriate training.
• Assigning responsibility for information security to the right people, not just to the IT department.
• Implementing appropriate and effective security policies, procedures and practices.
• Implementing adequate and effective information security controls and risk management systems.
• Carrying out regular audits of information security practices.
• Encrypting data on laptops, portable devices, tapes, removable storage and other vulnerable media.
• Implementing appropriate controls over removable media and devices.
• Introducing strict penalties for staff who breach security requirements including, for serious breaches, dismissal.
• Revisiting my post of August 2008 for further information on information security.
• Visiting the web site of the Irish Data Protection Commissioner, which is full of good information on information security.
• Reading the 2008 Annual Report of the Data Protection Commissioner, which is an excellent document and gives an overview of the activities of the Commissioner and provides information on prosecutions, investigations, summary data, etc.

Organisations and individuals must realise and accept that information security is not an issue for the IT department alone; it is a business issue and needs to be treated as such. Staff who use laptops, portable devices and removable media must understand that it is their responsibility, not the IT department’s, to keep data safe. And basic security, like locking these devices away or securing them appropriately, as well as encrypting them, must become the norm, not the exception.

Under Irish Data Protection Legislation, penalties for breaches of the law can be severe and encompass both civil and criminal proceedings, fines and forefeiture and destruction of equipment. Bodies corporate and individuals are subject to the provisions of the legislation. Fines of up to 250,000 euros can be imposed. Maybe it is time that fines of this magnitude were imposed. Without tough enforcement, I fear that breaches of the law and loss of personal data will continue to occur.

Kevin Kehoe, who I thank for commenting on my previous post, mentioned that organisations need to assess their appetite for risk. Perhaps it is time to dampen that appetite dramatically and, when it comes to handling the personal private information of customers, staff, prisoners, benefit applicants, etc, accept that no appetite for risk at all is the desired attitude to have.

If you have been affected by the BGE failing and feel strongly enough about the matter to complain, you can get all the information you need to make a complaint from the Data Protection Commissioner’s website.

What do you think? Are you concerned at how easily and how often personal private information is stolen, disclosed or otherwise compromised? Have you been personally affected by a breach of your privacy? Have you lost money or suffered other negative consequences? Have you been responsible for a breach of data security?

Leave a comment and let me know.

If you liked this post, you might also like:

Laptop Theft and Data Loss By Irish Health Service Executive

Data loss by PA Consulting

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!