John Lawlor » Internet

Cloud Computing – Security Implications

johnjlawlor — Thu, 06 Oct 2011 21:51:21 +0000

I’ve been working for a while on a policy and associated procedures for Trinity College Dublin to enable us to leverage various cloud technologies and services for the benefit of the college. What has struck me is the complexity of dealing with the topic in a large-scale environment.

As consumers, many of us use cloud services every day; examples are Gmail and Hotmail for email; Amazon Cloud Drive and Dropbox for file storage; Google Docs, Docs.com and Microsoft Skydrive for document processing; Twitter, Facebook, Google+ and LinkedIn for social networking, etc. Many of us tend to use these and other services with little thought being given to security, data protection, privacy, identity theft, ownership of data, etc. When considered from a corporate or business perspective, these issues are significantly more important and take on many complex legal aspects. Yet, in a corporate and, indeed, an educational environment, there is significant pressure to enable these services in the business context, since end users and familiar with them from personal use.

Pursuing another interest of mine this evening – Internet Radio – I came across C-SPAN Radio and just happened to stumble upon the live proceedings of the US Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies, on 6 October 2011, discussing the issue of the security implications of cloud computing. The Committee was addressed by very influential people in the area of information technology, information security, education and regulation:

The Honorable Richard Spires,  Chief Information Officer , U.S. Department of Homeland Security
Dr. David McClure, Ph.D.,  Associate Administrator , Office of Citizen Services and Innovative Technologies,  U.S. General Services Administration
Mr. Greg Wilshusen,  Director of Information Security Issues , Government Accountability Office
Mr. James W. Sheaffer,  President , North American Public Sector , Computer Sciences Corporation
Mr. Timothy Brown , Senior Vice President and Chief Architect for Security,  CA Technologies
Mr. James R. Bottum , Vice Provost for Computing & Information Technology  and Chief Information Officer , Clemson University
Mr. John Curran , Chief Executive Officer , American Registry of Internet Numbers

Each contributor submitted a paper to the Subcommittee and they are all available on the Subcommittee’s website. So if you are looking for what the current areas of concern are in relation to security and cloud computing, why not pick up the papers and listen back to the oral testimony.

Links to the papers (PDF)

What is your organisation doing about security and cloud computing? Do you have a cloud computing policy or are your end users simply using cloud services without regard to existing policy or legislation? Please leave a comment and let me know.

If you found this post interesting, you might also like:

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!

Is “Generation Gmail” Really Putting Businesses at Risk?

johnjlawlor — Thu, 24 Feb 2011 20:46:28 +0000

In my industry talks on Social Media, I mention the challenges presented to organisations by consumer technologies, so-called “shadow IT”, social media and mobile technologies. A new generation of technology users are used to having leading edge, powerful technologies and are not satisfied with the constraints placed by their employers on their technology use, productivity and flexibility. Therefore, many employees (and particularly younger employees) are getting around corporate controls by using personal email accounts, personal hosting services, online storage, Facebook, blogs, etc. The availability of new, powerful consumer technologies and services is putting increasing pressure on corporate IT departments to keep up.

Recent research commissioned by Mimecast, a UK-based email management company, highlights the risks that organisations face from their employees using non-corporate IT to circumvent controls. Carried out by Loudhouse Research, based in London, England, the research found that knowledgeable employees, familiar with social media and frustrated with corporate controls, are compromising corporate data and intellectual property.

Employees have become dissatisfied with the constraints of corporate email rules and mailbox size limitations. To get around these problems, more and more employees are adopting “a slapdash attitude to company intellectual property (IP)” and use personal email accounts to store corporate information on public servers, outside the control of the organisation. The research found that 85% of under 25s admitted that they send work-related emails or documents to or from personal email accounts.

The “Generation Gmail” research also found that:

36% of incoming email to work inboxes is not work related;
Over 300 work-related emails are sent per person via personal accounts each year;
Typically around half of these emails contain attachments, meaning that the average employee under 25 will send approximately three emails a week containing corporate IP and potentially sensitive information outside of their corporate environment, and
Generation Gmail is particularly predisposed to personal email; 52 per cent rated it as better than work email in terms of mailbox size, compared to just 29 per cent of over 55s.

Working in an academic environment, I am very familiar with these challenges and with many more as well. Younger and well-educated people have come to expect that corporate IT services should be as good as what they can get for free on the Internet and they are impatient when this is not the case. However, it is difficult for organisations to respond either quickly enough or with a similar range of technologies to satisfy the expectations of employees and – in academia – students, researchers and academics.

How can corporate IT respond to these challenges? Are policies and procedures enough? What controls should or can be put in place to ensure that corporate information and IP are safeguarded? Is this even possible in the age of the iPhone, 3G, netbooks, tablets, high-capacity storage and other wireless devices?

It seems to me that the response to these challenges must be try to give users what they expect, no matter how difficult this might seem. Perhaps corporate IT can never be as fast as the giants of the Internet like Facebook, Microsoft and Google but it should look for ways, nevertheless, to provide what it can. This could mean developing a Social Media strategy that identifies how you will provide the communications, collaboration and information sharing technologies that people now expect. Where can you use third parties to deliver services? What partners might you work with? Can you use Facebook or Yammer to enable sharing and collaboration? What about Blogger, Tumblr, Posterous, WordPress or Typepad for blogging? Are your policies, procedures, controls and security constraints still appropriate for the current environment and expectations of users?

We grapple with these issues every day in Trinity College and, to be truthful, we are probably always going to lag behind our users, because that is the nature of the organisation and it reflects the modern experience of technology innovation. Nevertheless, we have tried to meet expectations where we can. We have adopted Google Mail and Google Docs for our students; we are trialling Yammer as a collaboration platform for the college; we recently completed the rollout of internally-hosted Microsoft Exchange for staff; we are implementing SharePoint 2010 as an enterprise collaboration platform; we offer podcasting services and publish material with iTunes and iTunesU; we are about to release WordPress as a blogging platform for all users; and we use Microsoft Enterprise Project Management for project collaboration. We are also working on defining our needs for XaaS and Cloud Computing.

It is a start, and we know we have a long way to go. But if we can meet the expectations of our users, perhaps we can discourage them from using other technologies that might put the enterprise at risk.

What do you think? Are you dealing with these problems as well? Are you giving your users the technologies they want? What solutions have you found and how have you implemented them? This is a challenge that no organisation can avoid, so how are you approaching it? Please leave a comment and let me know your views.

Finally, Mimecast’s Chief Scientist, Nathaniel Borenstein and Cloud Strategist, Justin Pirie; and CEO of First Base Technologies ISACA, Peter Wood will host a webinar at 10 a.m. GMT on 8 March 2011 with the title ‘Generation Gmail: Is business email at risk?’. You can take part in the seminar at http://mediazone.brighttalk.com/event/infosecurity/79cc30c735-4820-intro?TID=MC.

And very lastly, if you would like to talk to me about the use of Social Media in your organisation, please feel free to contact me.

If you liked this post, you might also like:

Would You Like to Get to Inbox Zero?

Social Media Revolution? What’s Your View?

European Commission Announces 1.2 Billion Euros for ICT Research in Europe

johnjlawlor — Tue, 20 Jul 2010 22:47:16 +0000

ICT research in Europe is set to get a major boost in 2011 with the announcement today by the European Commission of a call for proposals for research projects worth 1.2 billion euros.

The projects will include a number of Public Private Partnerships:

The future Internet
ICT for energy efficient buildings
ICT for the fully electric vehicle
ICT for factories of the future.

These four projects have a combined budget of 220 million euros. Details of other budget provisions are available here (PDF).

All documentation is available through the links above. The deadline for submission of proposals is 2 December 2010.

The research funding is part of Europe’s Digital Agenda (launched in May 2010) and is the first significant increase for EU ICT research in more than 10 years. The digital agenda has seven priority areas:

Creating a digital Single Market
Greater interoperability
Boosting Internet trust and security
Much faster Internet access
More investment in research and development
Enhancing digital literacy skills and inclusion and
Applying information and communications technologies to address challenges facing society like climate change and the ageing population.

Further details on the Digital Agenda and the seven priority action areas are available here.

The Commission expects that SMEs will benefit from the work programmes funded from the research funding, which will be welcome in the current economic climate.

There are many opportuities for funding available on the EU Information Society website, which is always worth keeping an eye on. Let’s hope the research under these calls is successful and leads to an improvement in the lives of European citizens. We still have a long way to go to catch up on our American and Asian competitors.

If you liked this post, you might also like:

eCall In-Vehicle System Could Save 2,500 Lives Each Year

Society’s Grand Challenges: What Is The Role of Science and Technology?

Inspiring Talk by Venky Narayanamurti at Science Gallery

johnjlawlor — Wed, 24 Mar 2010 23:58:40 +0000

I went along this evening to a pretty full lecture theatre in Trinity College’s Science Gallery to listen to Venky Narayanamurti of the Harvard Kennedy School speaking on the subject of science, technology and society. He is a man clearly passionate about his topic and spoke with conviction, vigour, animation and not a little humour. Venky spoke about the great inventors – Edison, Watt, Einstein, Pasteur- and how invention and innovation come from applied science, research, experimentation, use cases and what he termed “grand challenges”. He spoke passionately about the need for an understanding of science among our leaders and hailed Obama’s commitment to the sciences in his inaugural speech:

“We will build the roads and bridges, the electric grids and digital lines that feed our commerce and bind us together. We will restore science to its rightful place, and wield technology’s wonders to raise health care’s quality and lower its cost. We will harness the sun and the winds and the soil to fuel our cars and run our factories. And we will transform our schools and colleges and universities to meet the demands of a new age. All this we can do. All this we will do.”

Vekny spoke about how innovation does not always have to come from inventing something new, but can also come from finding new and imaginative ways of using something that already exists. He cited the case of Ushahidi, an open source, ”crowdsourcing” system that uses simple mobile technology, such as phone, SMS, and web, combined with geolocation and mapping software on the Internet to track emergency and crisis information. Ushahidi is a fantastic example of how collaboration and innovation, coupled with existing technology, can come together to solve real world problems. It was used in Kenya to map incidents of violence and peace efforts throughout the country based on reports submitted via the web and mobile phone after the 2008 elections. It was used in India to monitor elections and it was used in Washington DC to deal with the aftermath of their snow this year. It is now being used to monitor the crisis in Haiti after the earthquake.

In question and answer following his speech, Venky’s answer to one question stuck with me. Asked about invention and about how and whether people should focus their efforts, Venky said, ” You can’t be everywhere, because then you are nowhere.” How true.

It was a wonderful evening in the Science Gallery and I look forward to attending more lectures there. The lecture was recorded, so I hope it will find its way to YouTube or iTunesU.

If you were at Venky’s lecture and would like to add your thoughts, please leave a comment and add to the record. If you have used Ushahidi, or know about the application, I’d also love to hear from you. And, finally, if you have had experience of crowdsourcing, please share your thoughts and experience here.

If you liked this post, you might also like:

Society’s Grand Challenges: What Is The Role of Science and Technology?

Social Media: Creating Collaborative Conversations

ActiveWords Makes Life Simpler On The Desktop

johnjlawlor — Mon, 13 Jul 2009 20:37:24 +0000

ActiveWords, is a computer desktop productivity tool that automates many common activities that users perform every day. As you type, ActiveWords logs each word, even if a text editor is not being used. Once the appropriate function key (F8) is pressed, the action associated with that key word is performed. Actions can be any of the following:

Substitute text
Launch a programme
Open a document
Navigate to an Internet site
Send an email
Open a folder
Run a script.

This is a great time saver and I have become a fan already. It cuts out a lot of pointing and clicking and makes life on the desktop just that little bit easier.

I use the keyword “outlook”, followed by F8 to open Outlook. I email several people regularly and by associating a keyword with them, in seconds I can open up a new Outlook email already addressed to them. I also use a few documents regularly and a short keyword opens each of them for me. There are a number of add-ons available for the product that are quite useful. These provide pre-defined keywords and menus for use with popular Internet services such as Google, MSN and Yahoo.

At the moment, I understand that ActiveWords is only available for the Windows platform.

You can download a free 60-day trial from the ActiveWords website. I was very pleased, shortly after downloading the programme, to be contacted by Buzz Bruggeman, one of the owners of the business, offering to go through the programme with me on a Skype call. Now that’s what I call service!

So why not check it out and if you like it, leave a comment and let me know.

More Laptops Stolen – And This Time It’s Personal!

johnjlawlor — Wed, 17 Jun 2009 19:56:52 +0000

I had not intended this blog to become a security-related publication, or one dealing exclusively with theft of laptops and storage media. But there is certainly a trend developing; let’s hope it does not last.

Following on from yesterday’s post, and from my post of 24 August 2008, we learn today from a report on RTE, Ireland’s national broadcaster, that a laptop computer containing the records of some 75,000 customers of Bord Gais Eireann (BGE – the Irish Gas Board) was was one of four stolen on 5 June 2009, although news of the theft was only released today, 17 June 2009. The records relate to customers who signed up for the BGE “Big Switch” campaign, which encouraged them to move their account for electricity supply from the Electricity Supply Board (ESB) to BGE. Like previous incidents, data on this laptop was reported not to have been encrypted.

This time it’s personal, as I have been potentially affected by this latest security failing.

It appears to me that many (I suspect a very, very large number) organisations that process personal information simply do not take the issue of electronic data security and data privacy seriously enough. Throughout the world, we learn regularly of significant breaches of customer confidentiality. As I wrote in my August 2008 post, many of these incidents occur through the failure to manage portable devices and removable media effectively. But there is also a lack of appropriate polices, procedures, practices, guidelines and controls. Indeed, in many organisations, there appears to be little or no attention paid to security at all, except for template procedures and documents.

The 2008 Annual Report of the Irish Data Protection Commissioner provides information on the top ten threats to individual privacy as identified by his staff. The unscientific list represents perceptions of Commission staff of the major threats to privacy at the close of the year 2008, based on the queries and issues they deal with on a day to day basis. The top ten threats are identified as follows:

Failure of organisations to have even the most basic protocols in place to minimise the loss of customer and employee data.
Continued lack of proper procedures in public and private sector bodies to limit access by their employees to personal data on a ‘need to know’ basis.
Failure to take due account of the legitimate privacy expectations of members of the public when moving towards greater efficiency of public services.
The tendency of new legislation to seek ever more personal data from the public and the sharing of that data between organisations without (in many cases) any real business case to justify such sharing.
Criminals using increasingly sophisticated methods to part individuals from their personal data for criminal and fraudulent use.
The extended use of the Personal Public Service Number (PPSN). This is the number given to each citizen by the Government to identify them when they interact with public bodies. More and more services seek to use this identifying number, often without any credible justification.
Publication and availability of excessive personal data on the internet (sometimes placed there by the individuals themselves on social networking sites etc).
Continued lack of awareness among data controllers of their data protection obligations.
Indifference on the part of data controllers to the consequences of their actions when they deliberately and persistently refuse to respect the data protection rights of their customers.
Continued lack of awareness on the part of members of the general public (who, as a result, give away their personal information too easily, don’t ask why personal information is needed or fail to ‘tick the box’ to say that we don’t want to be contacted).

BGE issued a short press release advising that it had promptly informed the Irish Police and the Data Protection Commissionerof the theft and that it will be contacting all affected customers. However, since there has been almost a two-week lag between the occurrence of the theft and the issue of the press release today, it is possible that customers’ financial or other personal information could have already been compromised. This is simly not good enough. It is no good doing things right (if you can call a two week delay in advising affected customers “right”) after an incident has occurred; appropriate steps must be taken to ensure that such incidents do not occur in the first place and that, if they do, the risk to information security is minimised or removed entirely. Time will tell whether the “risk assessment” referred to in the BGE statement led them to a correct decision not to advise customers sooner; I hope they got that right.

Organisations must take serious steps to improve security now. Some of the steps they take might include:

Raising security awareness among all staff and providing appropriate training.
Assigning responsibility for information security to the right people, not just to the IT department.
Implementing appropriate and effective security policies, procedures and practices.
Implementing adequate and effective information security controls and risk management systems.
Carrying out regular audits of information security practices.
Encrypting data on laptops, portable devices, tapes, removable storage and other vulnerable media.
Implementing appropriate controls over removable media and devices.
Introducing strict penalties for staff who breach security requirements including, for serious breaches, dismissal.
Revisiting my post of August 2008 for further information on information security.
Visiting the web site of the Irish Data Protection Commissioner, which is full of good information on information security.
Reading the 2008 Annual Report of the Data Protection Commissioner, which is an excellent document and gives an overview of the activities of the Commissioner and provides information on prosecutions, investigations, summary data, etc.

Organisations and individuals must realise and accept that information security is not an issue for the IT department alone; it is a business issue and needs to be treated as such. Staff who use laptops, portable devices and removable media must understand that it is their responsibility, not the IT department’s, to keep data safe. And basic security, like locking these devices away or securing them appropriately, as well as encrypting them, must become the norm, not the exception.

Under Irish Data Protection Legislation, penalties for breaches of the law can be severe and encompass both civil and criminal proceedings, fines and forefeiture and destruction of equipment. Bodies corporate and individuals are subject to the provisions of the legislation. Fines of up to 250,000 euros can be imposed. Maybe it is time that fines of this magnitude were imposed. Without tough enforcement, I fear that breaches of the law and loss of personal data will continue to occur.

Kevin Kehoe, who I thank for commenting on my previous post, mentioned that organisations need to assess their appetite for risk. Perhaps it is time to dampen that appetite dramatically and, when it comes to handling the personal private information of customers, staff, prisoners, benefit applicants, etc, accept that no appetite for risk at all is the desired attitude to have.

If you have been affected by the BGE failing and feel strongly enough about the matter to complain, you can get all the information you need to make a complaint from the Data Protection Commissioner’s website.

What do you think? Are you concerned at how easily and how often personal private information is stolen, disclosed or otherwise compromised? Have you been personally affected by a breach of your privacy? Have you lost money or suffered other negative consequences? Have you been responsible for a breach of data security?

New .tel Top Level Domain

johnjlawlor — Tue, 19 May 2009 21:21:57 +0000

johnlawlor.tel

.tel is a new top level domain (TLD), launched between December 2008 and March 2009. Operated by Telnic, a UK-based company, the TLD enables users (organisations and individuals) to publish contact information about themselves in a fairly simple, structured manner. While it is possible to access a .tel domain over the web, the suggested power of the system is that it can be accessed quickly and easily using mobile devices like phones, Blackberries and iPhones; it does not require a web site.

The basic idea behind .tel is that it will become an Internet-based directory, keeping all personal or organisation contact information in one place. For example, if a company changes phone number or address, it would only be necessary to change the entries in their .tel account and publish this information immediately to the Internet. With its “free text” feature, an organisation or individual can also post current information, say, about an upcoming sale or event, or a company profile.

The type of information that can be stored in a .tel account includes personal information such as name, address, hobbies and interests; phone numbers; websites; Flickr sites; Skype and Google accounts, and geolocation information. A user can decide what information to make public and what to show to selected people only (Telfriends), who must also be .tel account holders. Organisations can publish similar information as individuals and, using an internal directory structure, can add specific information, such as details of regional or branch offices. This makes it easier to navigate the .tel site.

Given the type of information that a .tel domain holds: contact information; web sites; identities; location information and searchable keywords, it is a little difficult to see how .tel is a lot different from an informational web page, blog, or OpenID profile. Indeed, I have stored all that type of information on many of my websites, blogs, social media sites, etc. I also set up a VeriSign Personal Information Portal (Beta) that provides much the same information as .tel, although it is web-based. It would also be very easy to set up a single web page on your existing domain with all of the information you want on it; by simply changing details on this page, you could, in theory, achieve the same end as a .tel account. However, Telnic say that the benefit of a .tel account is that a website is not needed and that a user’s account can be accessed easily over mobile devices, using very little bandwidth and low amounts of data transfer. They also suggest that there will be many new applications developed to exploit the features of .tel and that, for this reason, it is a useful service.

They offer ten reasons to use a .tel domain:

Controlling your information hub
Being part of a global online directory
Routing customers to your departments and locations
Increasing online discoverability
Connecting with customers from any device
Having an effective online presence
Performing live updates anytime from anywhere
Promoting premium rate numbers
Generating revenue from generic domain names
Driving traffic to e-commerce shops.

Before deciding whether to open a .tel account, I did a little research on the web and in discussion groups to see what the chatter in the community was. I found mixed views on the whole concept. Many companies who were selling domains or services were positive about .tel, while many individuals and IT professionals were more sceptical. Some people felt that it was just another over-hyped product. Concerns have also been expressed about privacy and identity theft. I share, to a degree, the views of the sceptics and wonder how useful and secure this service will be. Nevertheless, I decided to get my own domains, johnlawlor.tel and lawlor.tel, to test their utility. All of the information I have added to my account (johnlawlor.tel only; lawlor.tel is not completed yet) is already publicly available on the Internet, so I am not too worried about publishing it in the one place. However, I have some concerns about the possibility of suffering an increase in spam or phishing attacks and will monitor my email, in particular, to see if there is an increase in these nuisances.

.tel domains cost from around 10 to 15 euros per year. There is no associated hosting cost, as all .tel accounts are hosted by Telnic as part of the domain registration. It’s very easy to register a domain and I registered mine with Blacknight Solutions in Ireland. If you’d like to have a look, check out http://johnlawlor.tel/.

Data loss by PA Consulting

johnjlawlor — Sun, 24 Aug 2008 11:23:00 +0000

The recent loss by PA Consulting of data about criminals in Britain raises many questions about data security and highlights the difficult of guaranteeing privacy and security of data. With the proliferation of portable storage devices, coupled with their increasing capacity and low cost, the challenges of maintaining data privacy and security are considerable.

I expect that PA signed all the necessary confidentiality agreements, security policies, data management policies, etc, when agreeing the contract with the Home Office. I expect that they also provided the necessary assurances to the client when negotiating the work. And I expect that the client took assurance from all of this. And yet, despite that, a significant breach of confidentiality and data security occurred, exposing both the contractor and the Home Office to being sued. So, if policies and procedures, signed declaration and undertakings aren’t adequate protections, what can a client do when engaging third parties, or, indeed, protecting data from disclosure by staff?

Insist on encryption

Naturally, following incidents like the Home Office one, there is a strong focus on the need to encrypt data held on computer disks. However, this does not often lead to action. It is really not that hard to encrypt information at the entire device level, i.e. at disk level, at folder level, or at file level. There are many open source encryption systems available, such as TrueCrypt and Cryptainer. Commercial products are available from PGP Corporation, Symantec, McAfee and others. Even the ubiquitous WinZip allows users to encrypt files.

If users could get into the habit of encrypting all removable media and laptops immediately on acquisition, this would make a significant difference to data security. At a corporate level, all purchased devices should include provision for encryption at the point of purchase.

Ban data exchange and removal

A more extreme approach might be to ban all electronic data exchange between a client and a contractor or supplier, including banning the use of email, laptops, modems, wireless connections, etc. In this scenario, all work would be carried out on the client’s site, with all computer equipment, network facilities, storage, printers, paper, etc, provided by the client. Even this would be difficult to police, however, as a contractor could easily bring in a portable storage device and connect it to the client’s computer. This might be avoided by providing equipment with all external ports and wireless features disabled, but the difficulty of doing this should be evident. However, in today’s connected world, where business happens at the speed of light, this option would not be really practical.

Ban use of own data processing equipment by contractors

Many, many years ago, a friend of mine worked in the vaults of a very large bank in Ireland. Before starting every day, he had to remove all valuables and money from his person and leave them in secure custody with the bank. At the end of the day he was searched and, when confirmed as penniless as when he went in, his valuables were returned to him and he was escorted off the premises. This happened every day he worked there. Similar procedures could be implemented with regard to contractors and computing equipment, ensuring that they did not have any data processing or storage equipment in their possession when they entered or left the client’s premises. But, once again, the difficulty of policing this is quite apparent. With contractors working in almost every area of large businesses and the public sector, it would be difficult to get uniform implementation (or, indeed, awareness) of security policies. Nevertheless, it might be necessary to consider measures like these to adequately protect sensitive data.

Control issue and use of portable storage devices and laptops

This would not be easy to do but, coupled with other controls, would be an effective way of ensuring that data is not removed from a client premises. Tight procurement procedures would be required but, as portable devices are now so cheap, individuals can simply buy them themselves. Therefore, it may also be necessary to lock down external ports on machines but, understandably, this would make effective working quite difficult.

Control or prevent access to Internet storage sites

Many companies now offer free or cheap storage over the Internet, which anyone can subscribe to. These enable users to back files up to these sites on demand, or on a schedule. Similarly, Gmail and Hotmail accounts enable users to store up to 5Gb of data on the Intenet. Therefore, these sites create a new weakness in corporate networks and, where possible, access to them should be denied.

Prevent use of Internet-based email accounts such as Gmail, Hotmail and Yahoo!

Difficult to do, but, if possible, prevent use of free Internet-based mail accounts like Gmail, Hotmail and Yahoo! Do not provide contractors with access to or accounts on your email service so that they cannot mail files to their own work email accounts.

Identify someone in the client organisation responsible for data security and handling contractor requests

Contractors might have a legitimate reason for requiring data to be provided on portable devices; for example, to carry out testing on an application at their own premises. A single person in the client organisation should be responsible for providing such data and ensuring that the request is appropriate, that only data that is absolutely necessary is provided and that it is properly secured. Appropriate undertakings (however shaky) should be received from the contractor, including undertakings concerning the storage, security and encryption of data.

Get contractors to disclose any previous breaches of data security that affected them or their clients

As part of the due diligence process in any contract negotiation, clients should ask contractors to disclose any breaches of data security that affected them or their clients in the last number of years, say three years. Contractors could be held liable for failure to disclose any breaches. If a contractor has suffered breaches of security, perhaps it would be better to avoid using them, particularly on very sensitive contracts.

Make sure your contractor has adequate insurance cover

Make sure that your contractor has adequate professional indemnity insurance and that you are indemnified against any loss or damages arising out of negligence or omission by the contractor. This should not only extend to the professional execution of the contracted work but also to such eventualities as data loss or security breach, as in the PA case.

Learn about information security standards

The information security landscape is changing and becoming more complex all the time. The key international standard is ISO 27000 and, if you are concerned with security and data privacy, you should become familiar with this standard. Also pay attention to sites like the SANS Institute, CoBIT, ISACA, etc.

Conclusion

There’s a lot more to information security and data privacy than I have covered here. As more and more of our personal and corporate information is transmitted over the Internet, we should all pay far more attention to this issue.

If you liked this post, you might also like:

Laptop Theft and Data Loss By Irish Health Service Executive

More Laptops Stolen – And This Time It’s Personal!