Organizations like us - practically all organizations in fact - create, own, share and exploit a vast wealth of valuable information known as I ntellectual P roperty.  IP generally deserves and often requires proactive protection against threats such as plagiarism and piracy, even if it is deliberately published or disclosed: IP R ights are more than simply a confidentiality or secrecy issue. IPR infringements cause both direct and indirect impacts on the rightful IP owners, including loss of income, brand devaluation and competitive disadvantage.  These are serious commercial issues. If awareness of the risks associated with disclosing IP is an important first step on the way to securing it, finding out how to bring the risks under control and enforce your IPR is step two. IPR-related laws such as copyright, trademarks and patents are the most obvious type of IPR controls but others are covered by agreements and contracts....

What are the most challenging aspects of ISO/IEC 27002 implementation and ISO/IEC 27001 compliance?   The following typical issues are summarised from a paper published in the ISSA Journal by Bil Bragg, a senior consultant from Dionach Ltd., who drew up the list by examining the gap analyses conducted for 20 client organisations.  The first two concern mandatory requirements for ISO/IEC 27001 certification: 4.2  Establishing and managing the ISMS: few organizations had formally stated the scope of their ISMS or documented their risk assessment method and risk acceptance criteria in accordance with the standard. 6.0  Internal ISMS audits: only one organization had an internal ISMS audit program, and none had undertaken a management review of the ISMS. The information security controls succinctly listed in Annex A of ISO/IEC 27001 and explained in more detail in ISO/IEC 27002 are not strictly mandatory for certification but are widely implemented and genera...

Receiving the first working draft of new international standard ISO/IEC 27038 on digital redaction this morning prompted me to think about the risk associated with redaction, more specifically the information security risks associated with the redaction of electronic documents and other digital data files (e.g. digital still photos and video images; spreadsheets and numeric/statistical data sets and databases). Two cups of tea and a bit of head scratching later, here's my 'top 10' list of information security risks associated with redaction: Failing to identify correctly all the sensitive data that must be redacted. Failing to delete all the sensitive data e.g. overlaying or modifying rather than actually deleting the sensitive data using methods that can be completely or partially reversed; accidentally leaving one or more copies of the sensitive data completely unredacted; partially deleting the sensitive data leaving data remnants or cached copies, or sufficient informa...

The victims of another all-too-common physical security incident involving the theft of a laptop are devastated by the loss - not so much the physical value of the Macbook taken from the back seat of a car (doh!) but the far more valuable scientific research data on prostate cancer that it held.  There were no backups.  <Pause for dramatic effect> The victims' offer of a $1,000 bounty for the return of the laptop is presumably based on the assumed value of the stolen hardware to the thief.  If what they claim about the data is true, it's a small fraction of the true value, but still a substantial sum to them (being poor research scientists) and to some crack-head opportunist. I urge all of you reading this to stop whatever you're doing for a moment and consider what will happen when your IT systems are stolen, go up in flames, get flooded out, are dropped on the concrete floor, get hit by static or struck by lightning, fail spectacularly in a strangely beautiful sh...

The robbery of a Vegas casino reminds us not to over-rely on high-tech security controls (such as automatic face recognition systems) if that means neglecting basic physical security. It's also a puzzle that the casinos still use chips. I wonder why they haven't migrated to electronic cash systems, using smartcards? A well-engineered and properly-implemented smartcard system would avoid the need to have cash or chips in the casino. Ah, hang on, I see the problem: 'well-engineered and properly-implemented' is a stretch even for the banks.

Here's something we don't often see: a fraudster caught by strong anti-fraud controls . He was an IT worker for a British supermarket chain who misused his privileged systems access to set up false accounts to receive stolen loyalty card points worth over £8k.  Interestingly, he didn't try collecting on the cards until a few years later, and then just a few trial purchases. Fraudsters commonly test out their scams tentatively at first, building their confidence before pressing ahead with The Big One once they know the tests have succeeded.  Only in this case, he was caught early. For obvious reasons, we're not told much about the anti-fraud controls in the news story so what follows is pure conjecture. Due to the delay between setting up, filling and then using the cards, it looks to me as if the purchases might have triggered some additional fraud checks, perhaps because of an unusual type or value of purchases; otherwise, they may have detected the fraud initially but...

A counterintuitive result emerged from experiments evaluating the best kinds of font for classroom presentations. Fonts described as 'difficult to read' presumably made students concentrate harder. They scored better on subsequent tests than their peers using elegant, easy-on-the-eye fonts such as Arial.  Of course it could also be that those 'difficult to read' fonts gave a welcome boost to the banality and blandness of most presentations. We do our level best to make our security awareness seminar slides more interesting and engaging to stand out from the norm. We mostly avoid bullet points, preferring images and mind maps to put across important information such as the relationships between parts of the topic at hand, not just the words themselves.  Where appropriate we enjoy using simple v i su a l tr ic k e r y to emphasize the most important bits, but most of all we research the content to make it relevant and hence inherently engaging to our customers' a...