We're currently preparing some new information risk and security policies for SecAware.com .  It's hard to find gaps in the suite of ~80 policy templates already on sale  (!) but we're working on these four additions: Capacity and performance management : usually, an organization's capacity for information processing is managed by specialists in IT and HR.  They help general management optimise and stay on top of information processing performance too.  If capacity is insufficient and/or performance drops, that obviously affects the availability of information ... but it can harm the quality/ integrity and may lead to changes that compromise confidentiality , making this an information security issue.  The controls in this policy will include engineering, performance monitoring, analysis/projection and flexibility, with the aim of increasing the organisation's resilience. It's not quite as simple as 'moving to the cloud', although that may be part of the...

Today I trawled through our back catalog of information security awareness content for anything pertinent to COVID-19. The "Off-site working" security awareness module published less than a year ago is right on the button.  "Off-site working" complements the "on-site working" awareness module, about the information risk and security aspects of working on corporate premises in conventional offices and similar workplaces. Off-site concerns the information risk and security aspects of working from home or on-the-road ( e.g. from hotels or customer premises), often using portable IT equipment and working independently ... which is exactly the situation many of us are in right now. Off-site working changes the information risks compared to working in purpose-built corporate offices. Mostly, the risks increase in line with the complexities of remote access, portability and physical dispersion … but offsetting that, off-site working can be convenient, productive...

Here's today's update to my COVID-19 information risk P robability I mpact G raphic: I've slightly shifted and revised the wording of some of the risks but there's nothing really new (as far as I know anyway).  Reports of panic buying from the UK and US are concerning, given the possible escalation to social disorder and looting … but hopefully sanity will soon return, aided by the authorities promoting “social distancing” and “self-isolation”.   Meanwhile, I hope those of you responsible for physically securing corporate premises have appropriate security arrangements in place. Remotely monitored alarms and CCTV are all very well, but what if the guards that would be expected to do their rounds and respond to an incident are off sick or isolated at home? Do you have contingency arrangements for physical security? ‘Sanity’ is a fragile condition: there is clearly a lot of anxiety, stress and tension around, due to the sudden social changes, fear about the infectious dis...

Hot off the production line comes May's security awareness and training module about working off-site . The 69th topic in our portfolio was inspired by a subscriber asking for something on home working. It ended up covering not just working at home but  the information risk and security implications of working on the road (digital nomads), in hotels, on supplier or customer sites and so forth , touching on online collaboration and other related areas along the way. Module #193 is 95% brand new, prepared from scratch during April and blended-in with a little updated content recycled from previous modules on workplace security and portable ICT security, plugging the gap, as it were. I'm proud of the guideline (item #04), part of the staff awareness stream .  At 16 pages, i t is lengthier than normal due to the sheer variety.  With the odd touch of humor and stacks of pragmatic security tips for home and mobile workers, it would make a neat little awareness booklet or eDoc...

The  Internet of Things  and  Bring Your Own Device  typically involve the use of small, portable, wireless networked computer systems, big on convenience and utility but small on security.  Striking the right balance between those and other factors is tricky, especially if people don’t understand or willfully ignore the issues – hence education through security awareness on this topic makes a lot of sense. From the average employee’s perspective, BYOD is simply a matter of working on their favorite IT devices rather than being lumbered with the clunky corporate stuff provided by most organizations. In practice, there are substantial implications for information risk and security e.g.: Ownership and control of the BYOD device is distinct from ownership and control of the corporate data and IT services; The lines between business use and personal life, and data, are blurred; The organization and workers may have differing, perhaps even conflicting expectatio...

With near-perfect timing, we're into the final stages of polishing off January's awareness module on IoT and BYOD security.   I say near- perfect because this is the last weekend of 2017 with just over a day remaining until 2018. After a week of chilly and miserable weather, an unseasonal polar blast, I'd rather be out enjoying the fine weather and getting ready for the traditional new year's eve celebrations!  The last section of writing took a bit longer than planned, but I'm confident we'll hit the delivery deadline.  Updates to the website are in hand and we'll be packaging and sending the materials to subscribers tomorrow, electronically that is. Looking forward, we've selected awareness topics for first few months of 2018 and written them up on our distinctly low-tech office whiteboard. We deliberately don't plan too far ahead (who knows what will crop up?) but it takes time to research and draft the materials. Having working titles and outline...

As the end of month deadline looms, we're close to finishing January's awareness module on IoT and BYOD security.  Today I'm working on the awareness seminar slide deck and accompanying briefing paper for the audience group we call 'professionals', blue-collar workers essentially, specialists in IT, risk, security, audit, facilities, control, compliance etc. We dig a bit deeper into topic for that audience, but not too deep. The overriding awareness objective is to inform, intrigue, motivate and set them talking to their colleagues (other professionals plus the general and management audiences) about and around the topic. Awareness is not training, although there is a grey area and the terms are often confused.  Ultimately, we hope the pros will pass on some of their knowledge and enthusiasm for the topic to others, preferably with more than just a casual nod towards the information risk and security aspects.  IoT and BYOD are obviously IT-related, so the pro materi...

Normally in security circles, the word 'exploitation' has the distinctly negative and foreboding connotation of some evil miscreant wantonly attacking and taking advantage of us ... but we'll be using the word in a much more positive sense in the IoT and BYOD security awareness materials for January. The topic presents a golden opportunity to point out that information security mitigates the substantial information risks associated with IoT and BYOD, risks that would otherwise reduce, negate or even reverse the business advantages. It's not entirely plain sailing, though, since the risks are context-dependent. Someone needs to identify and evaluate the risks and the corresponding security controls, in order to determine firstly whether the risks are truly of concern to the organization (they can't be avoided or accepted), and secondly whether the security controls are necessary and justified since there are costs as well as benefits. We've pump-primed the proces...

Surveys typically show that:  Most organizations have some form of BYOD scheme encouraging or permitting workers to use their own laptops, smartphones and tablets for work; and IoT is spreading fast but still has a long way to go before it peaks. We infosec geeks may throw up our hands in horror ... but the facts remain: BYOD and IoT are popular, now. They are here to stay  and almost certain to expand . It's too late now for us to bleat on about the information risks and security concerns*. The train has long since left the station. So how should we handle this situation? An obvious approach is to retrospectively identify, assess and treat the information risks as best we can, emphasizing threats such as hackers, malware, theft or loss of information, and inappropriate disclosure, and promoting security controls such as - well, that's where it gets tricky because we have limited options for technical controls, and (despite our best efforts!) security awareness is never going ...

From a worker's perspective, BYOD is 'simply' about being allowed to work on his/her own ICT devices, rather than having to use those owned and provided by the organization.  What difference would that make? It's straightforward, isn't it? Good questions! There are numerous differences in fact, some of which have substantial implications for information risk, security and privacy. For example, ownership and control of the device is distinct from ownership and control of the data: so what happens when a worker leaves the organization (resigns or is 'let go'), taking their devices with them? Aside from any corporate data on the devices, they had been permitted access to the corporate network, systems, apps and data.  The corporate IT support professionals had been managing the devices, and probably had access to any personal data on them.  Lines are blurred. In a similar vein, IoT is more than just allowing assorted things to be accessed through the Internet a...

Today we've been working on model policies concerning IoT and BYOD security. We offer two distinct types of policy: Formal information security policies explicitly defining the rules, obligations and requirements that must be satisfied, with a strong compliance imperative relating to management's authority.  These are the internal corporate equivalent of laws ... although we go to great lengths to make them reasonably succinct (about 3 sides), readable and understandable by everyone, not just lawyers familiar with the archaic and arcane legal lexicon (such as has heretofore in the present clause been ably demonstrated, m'lud). Informal - or at least semi-formal - Acceptable Use Policies that are more advisory and motivational in nature. These compare pragmatic examples of acceptable (in green) against unacceptable (red) uses to illustrate the kinds of situation that workers are likely to understand.  They are even more succinct - just a single side of paper. So, we now have...

What's hot in toyland this Christmas? Way back when I was a kid, shortly after the big bang, it was Meccano and Lego for me. I still value the mechanical skills I learnt way back then. Give me a box of thin metal strips full of holes, a plentiful supply of tiny nuts and bolts, and some nobbly plastic bricks, and I'll build you an extraordinary space station complete with spinning artificial gravity module. Or I might just chew them. Today's toys supplement the child's imagination with the software developers'. There are apps for everything, running on diminutive devices more powerful than those fridge-sized beige boxes I tended for a hundred odd scientists (some very odd) in my first real job. Writing about tech toys in the shops this Christmas , Stuart Miles says: "For many, the days of just building a spaceship out of Lego or playing a game of Monopoly are long gone. Today, kids want interactive tech toys that are powered by an app or that connect to the inte...

Conceptual diagrams ('mind maps') are extremely useful for awareness purposes.  This one, for instance, only has about 50 words but expresses a lot more than could be said with ~50 words of conventional prose: Despite it being more than 7 years since I drew that diagram, it immediately makes sense. It still tells a story.  Working clockwise from 1 o'clock, it steps through the main wireless networking technologies that were common in 2010, picking out some of the key information security concerns for each of them.  It's not hard to guess what I was thinking about. The arrows draw the reader's eye in the specified direction along each path linking together related items. Larger font, bold text and the red highlight the main elements, leading towards and emphasizing "New risks" especially.  Sure enough today we have to contend with a raft of personal, local, mesh, community and wide area networks,   in addition  to the those shown.  When the diagram was ...

Today we went on a tiki-tour of the forest in search of a few pine saplings of just the right size, shape and density to serve as Christmas trees. Naturally, the best ones were in the brambles or on the side of a near vertical slope but, hey, that's all part of the fun. I guess ' Web-enabled remotely-controllable LED Christmas tree lights ' are The Thing this year.  Ooh the sheer luxury of being able to program an amazing light show from your mobile phone! So what are the information risks in that scenario? Let's run through a conventional risk analysis. THREATS Elves meddling with the light show, causing frustration and puzzlement. Pixies making the lights flash at a specific frequency known to trigger epileptic attacks. Naughty pixies intent on infecting mobile phones with malware, taking control of them and stealing information, via the light show app. Hackers using yet-another-insecure- Thing as an entry point into assorted home ... and corporate networks (because, ...

Next up on our production conveyor belt is an awareness module on the security aspects of BYOD and IoT. Aside from being topical IT acronyms, both (largely) involve portable ICT devices - wireless-networked self-contained portable electronic gizmos.  We've covered BYOD and IoT security before, separately, but it makes sense to put them together for a change of focus. As things steadily  proliferate, workers are increasingly likely to want to wear or bring them to work, and carry on using them. The security implications are what we'll be exploring in the next module.

August's security awareness topic is "pocket ICT security", referring to the information risks associated with portable Information and Communications Technology devices: the smartphones, laptops, tablets, USB sticks, wearables and other high-tech stuff we carry about our person. Risks such as walking into the road and being hit by a car. Yes, seriously.  It is both on-topic and highly topical in the case of Pokemon Go players, young and old, being so focused on the virtual world on the smartphone screen that they neglect the real world hazards around them. The lucky ones are spotted and avoided by alert drivers. The unlucky ones are injured, perhaps even mown down by a vehicle driven by a similarly distracted driver. Distraction is the more general information risk, a modern-day affliction. The more portable ICT we use, the more distracted we become. Wearables are the latest trend, long predicted but curiously slow to take off, perhaps because of the distraction factor? ...

Employees are increasingly using their personally-owned ICT devices at work, whether for personal or work purposes.  Organizations with BYOD ( Bring Your Own Device ) schemes and policies typically insist that employee's smartphones, laptops, tablets etc.  are secured and managed by IT, requiring the use of MDM (Mobile Device Management) software, AV (antivirus)  etc. So what happens as employees start bringing in their personal IoT toys (BYOT - Bring Your Own Things ) in the same way - their fitness trackers, Google Glasses and other wearables, perhaps control pods for their home IoT systems, and so forth?   Good luck to anyone trying to insist that IT installs MDM, AV and all that jazz on a gazillion things ! One approach to BYOT security I guess is to prohibit all unapproved and unauthorized devices/things from connecting to corporate networks, at the same time preventing corporate devices/things from connecting to non-corporate networks (including ad hoc  or...

Controversial plans to replace two Surrey/South London hospitals with a new one were prematurely and inappropriately disclosed on a train: "The proposals were revealed by management consultants who held a conference call on a commuter train after meeting the trust chief executive Daniel Elkeles.  The call was heard and recorded on a mobile phone by a BBC London reporter." Someone being overheard discussing sensitive stuff on their mobile phone in a public place is nothing new, an everyday common-or-garden information security incident.  The factors that make this particular one notable include: The disclosure involved trusted third parties possessing (and disclosing!) valuable information belonging to an organization, having been disclosed to them by senior management.  This begs lots of questions about roles and responsibilities, compliance obligations, non-disclosure agreements, ethics, accountability and governance, as well as the information risks and security contro...

In the dying days of August, just as we were busily finishing-off September's awareness module on application security, what should pop on to my screen but a new survey from Ponemon Institute on that very topic.  With some trepidation, I opened the report to see how its findings compared to our own research ... and was relieved to see that we had picked up on all seven of Ponemon's key issues, plus a few more due to our slightly wider scope.   Does your security awareness and training program cover the information security aspects of application development, acquisition, management and use?  Does it even mention mobile apps, BYOD and cloud computing?  Go ahead, dust it off and take a look.  Does it talk to business and project managers, IT pros and employees in general about relevant security aspects that matter to them, in terms that make sense and resonate?  Does it successfully prompt a productive dialogue between executives and practitioners concerning...

[Cynicism: high] We have just delivered June's security awareness module to subscribers, covering portable ICT, BYOD (Bake|Bury|Bash|Bring Your Own Device|Disaster|Dog), mobile and home working, and various associated matters. One of those 'associated matters' concerns the social changes that are going on around us, thanks in large measure to the freedom that comes from workers no longer being leashed to the office like so many dogs.  I've been pondering this issue for quite a while now, sitting here in my modest home office looking out over the beautiful New Zealand countryside.   When I think back to the days when I commuted to the city every day to sit in a series of dreary offices and stuffy meeting rooms, looking forward to a chance to escape to a nearby cafe or go for a lunchtime walk in the local park, I wonder how I put up with it - those seemingly endless wasted hours of traffic jams and pointless committees and (in some cases) ignorant, pig-headed bosses tryin...