re: Keeping a lid on secure data

Francis Trist — Sat, 08 Dec 2007 15:39:35 GMT

The Law of The Land defines responsibilities for the care of data. The Data Protection Act clearly charges organisations that hold personal infomation with its protection.

This is a simple requirement yet one that leaves many bewildered - often because of the acronym you refer to - "IT".

Information Security (IS to give you another acronym) does not implicitly involve IT neither do the controls required to manage it per se.

What is evidenced by the recent Revenue and customs fiasco is several failings in procedure, notably:

1 - Had any consideration been given to the consequences of the loss of data of this type and of this order of magnitude? - i.e. was this loss a known risk and was the impact appreciated?

2 - Had any consideration been given as to how such a risk might be mitigated? - i.e. accepting the need to make this data available to the Audit Office, how might it be done securely?

3 - Had due consideration been given to the purpose of the request for data on this scale?

If we assume that the answer to any of the above questions is "yes", then what communication of process and procedure had been made to those charged with the task and was the effectiveness of any such procedures tested?

If we again assume that such tests were made, were the findings fed back in to the review of process?

These few considerations encapsulate the good practice that is promoted by adherence to accepted standards of working - such as those provided for by ISO27001, the international standard on Information Security.

Whilst in the modern age IT will almost always be involved in data-related processes, it only does so as a mechanism to hold, process and communicate the information in question. In other words, IT considerations are relatively low-level within IS management.

Successful IS management requires an objective understanding of the potential threats to the data held; a commercial valuation of the consequences of that data being disclosed, lost or corrupted; a commitment to mitigate such threats and a means of monitoring the effectiveness of such mitigation.

Information Security has already become an implicit component within Industry in many parts of the world. We seem to be lagging rather a long way behind in the UK.

re: News in print is here to stay

will pollard — Tue, 20 Nov 2007 16:37:08 GMT

Print and online are not mutually exclusive. Amazon are promoting a digital reader but expect to sell more hard copy as well, probably from the same authors.

RIT have a project around 'print in the mix' as if print needs to make a case as one option of many.

Could there be space here for this sort of approach? this is a blog after all.

Girl on print - Business thinking behind the Printing World - All Comments

re: Keeping a lid on secure data

re: News in print is here to stay