Despite the constant stream of data breaches reported in the press day after day, many organisations are overlooking some essential steps they need to take in ensuring that a data protection culture becomes permanent. Creating a cultural change regarding data protection in an organisation requires them to think holistically and remember that staff awareness of security policies and training need to becomes embedded, and not just a  one-off exercise when a new employee joins or changes job role.

Excelgate Consulting has launched Excelguard :an offering that combines risk assessment and remediation services with 4 key elements organisations need if they are to effect cultural lasting change in their organisations regarding data protection handling:

• Data discovery and audit
• Policy distribution and management reporting on compliance
• Training: both face to face and eLearning
• Secure data disposal

“PixAlert is delighted to be a partner with Excelgate’s Holistic Approach to Data Protection as it is a security initiative that we firmly endorse through our data auditing solutions.” Says Ger Curtin, CEO of PixAlert. “ In order to protect your data you must know where to find it and in implementing a data security framework, visibility into network exposures is a vital first step in assessing risk and an essential component in protecting data as a strategic and valuable corporate asset.”

“At the heart of any compliance regime should be the realisation that prevention is better than cure.  “ says Robert O’Brien, CEO of MetaCompliance. “Getting higher levels of user awareness in the area of Privacy and Compliance is key to mitigating the risk of a compliance incident. Organisations need to use every tool at their disposal, and Excelguard is an invaluable addition to the compliance management armoury.”

“This new offering from Excelgate Consulting allows organisations to take steps to create a data protection culture. Regular training of staff, through a variety of methods, is a key element of this. “ says Mathieu Gorge, CEO of Vigitrust. “eLearning is a good alternative to face to face training where there are time and costs constraints in the business. It allows organisations to train users at their own pace, and suit the training schedule around the demands of the business, rather than an entire department taking several days out of the business for training. Employers can demonstrate compliance with training requirements at a click of a button which is a key requirement of most of these undertakings from the ICO”

“Excelgate’s exciting new initiative provides customers with a 360 degree solution from setting-up simple and practical measures to deploying high-tech defences,” says Julian Fraser, Director of Data Eliminate,   “It’s humans who represent the vulnerability in almost every case.  Excelguard addresses that issue head-on.”

Nearly all of the undertakings issued by the ICO can be attributed to lack of staff awareness of policy, lack of training, no methods for secure disposal of data and no visibility of where the personal data lies within an organisation. This offering provides a good foundation for data protection compliance moving forward. Compliance with standards is a given, but what this offering does is address long-term weaknesses in organisations which in turn helps them maintain their compliance levels and thus reduce their overall costs of compliance.

Excelguard is the new holistic data  protection offering from Excelgate Consulting, Data Eliminate, MetaCompliance, PixAlert and VigiTrust. Further information can be found at:

www.excelgate.co.uk/excelguard.html

2011 was the year that the news made the news. We started the year talking about classified information finding its way into the press and ended the year with an inquiry into the press. Alleged offences under section 55 of the Data Protection Act are at heart of the phone hacking scandal.

Back in January Excelgate reported that following the ongoing WikiLeaks saga, it was necessary to have a coordinated global response across governments if a repeat of such a massive leak of classified material was to be avoided.  The industry is just coming to terms with the ramifications of WikiLeaks, and at the East West Institute in London in June, it was recognised that there needs to be greater co-ordination in the future, not just between technical and legal practitioners and politicians, but also across geographies in drafting new data protection and privacy legislation in the future.

2011 saw the launch of some new standards and assurance schemes in the UK. In March, ISSA UK launched ISSA 5173 – a new security standard aimed at improving information security for small and medium-sized enterprises. I’ve been involved in the formation of the standard since the foundation of the workgroup back in 2010, and in the collation of feedback since the publication of the draft standard in March. To date feedback has been overwhelming positive, as well as being well received by the IT press. 2012 will see the publication of a series of guidance documents to accompany the standard. 2011 also saw the launch of CESG’s Commerical Product Assurance, the replacement product assurance scheme for CCTM for security solutions in the UK public sector. It aims at providing two levels of assurance for security solutions depending on where the proposed solution is to be used. This should open up the market for the relatively closed space of IL3 (for example local authorities) by encouraging competition and innovation in this space.

August saw the rioting across London and other parts of the UK. Social media was widely reported to have been used by some rioters in coordinating some of the riots. As reported in June, the misuse of social media comes in a number of forms: from criminal acts to damaging reputations – both corporate and private. In November, speaking at the London Conference on Cyberspace, The Foreign Secretary, William Hague, whilst warning against the dangers of government censorship with regards to the use of social media, did state that global, coordinated action is needed to deal with social media misuse and cyber attacks. In short he said “that behaviour that is unacceptable offline is also unacceptable online, whether it is carried out by individuals or by governments.”

The Levenson Inquiry, investigating the culture, practice and ethics of the press started its formal evidence hearings in November. At the heart of the phone hacking scandal is that somewhere along the chain personal data was potentially procured illegally. The What Price Privacy? report of 2006, published by the Information Comissioner’s Office already highlighted there was widespread abuse of the Data Protection Act in the UK and recommended a custodial sentence for Section 55 offences. As reported in my interview with Christopher Graham in August, the Information Commissioner will continue to push for custodial sentences for the most serious offences.

The message of the What Price Privacy?  report has somehow become lost and focused on journalists rather than the illegal trade in personal data. I certainly don’t want to see restrictions placed upon a free press: this is the foundation of any democracy. Wrong-doing and fraud should be exposed. There is already a large carve-out of exceptions in the Data Protection Act for journalistic purposes. The trade and procurement of personal data is already illegal, however, and in my view the law is not being enforced severely enough – either in severity of sentence for the most serious cases, or in the number of prosecutions.

I have been impressed with the ICO’s response to date with regards to education and the issuing of fines. They have taken a very reasonable position: that people need education as to how to comply with the Data Protection Act. It would indeed be foolish to adopt a mass fining policy of organisations when the powers of the ICO to issue a monetary penalty notice only came into effect in April 2010. On the other hand, April 2012 will mark the second anniversary of this and to continue indefinitely in this mode would be, in my opinion, be a mistake. I certainly don’t want to see a situation where every single human error results in a fine from the ICO. The Data Protection Act is now, however, a 13 year-old piece of legislation, and organisations have now had two years to ensure they comply with the law in this regard. If HMRC operated on a mainly notice to improve basis, I’m fairly sure we’d see a significant decline in tax revenues (i.e. non-compliance). They don’t however, and operate a sliding scale of penalties depending upon the severity of mistake/ non-compliance. For mistakes on VAT returns, for example, penalties are categorised as follows:

• Careless : you failed to take reasonable care
• Deliberate: you knowingly sent HMRC an incorrect document
• Deliberate and concealed: you knowingly sent HMRC an incorrect document and tried to conceal the inaccuracy

In each category there is also a sub-category: promoted and unprompted (i.e. HMRC discover the discrepancy or you notify HMRC of it). The fines vary from 100% of the tax due for deliberate and concealed and prompted to 0% for careless and unprompted. I’d like to see a similar sliding scale defined for data protection offences and then these enforced, since I simply don’t believe there has only been 7 serious data protection offences in the UK since April 2010. I’ve come across more than that myself this year alone, ranging from the potentially criminal to the careless error.

I’ve also, over the course of 2011, become convinced of the need for a mandatory data breach notification laws for the UK, as is already the case in some US states. The naysayers are already out in full force in the UK, saying the UK doesn’t need another piece of legislation regulating business. It is worth bearing in mind that this legislation originated in California – that US state well-known for over-regulating businesses and stifling innovation -not! Similarly, the criticism of data breach notification laws is not based upon any real-world experience. A study from the University of California-Berkeley of views from CISOs in the US, showed that data breach notification laws has put data protection and information security firmly into the public eye, and actually fostered dialogue in some cases between the consumer and data controller regarding their data. It also empowers consumers to protect themselves, either by asking awkward questions of their data controllers or by simply shopping elsewhere. We need this raising of awareness and dialogue in the UK too. Why should we either trust or trade with an organisation that doesn’t safeguard our privacy?

Phil Stewart is Director, Excelgate Consulting & Secretary & Director, Communications for ISSA-UK

Apple’s iconic logo is as well known as their products are globally today. Many urban myths have sprung up over the years over the origins of the Apple logo: from the apple of knowledge from the Garden of Eden; that the logo resulted from Steve Jobs having worked in an apple orchard; to the death of the founder of computer science, Alan Turing, by biting an apple laced with cyanide. An interview with the logo designer, Rob Janoff in 2009 revealed that none of these were the inspiration for the bitten apple – it was purely a design decision to give the logo scale and make the apple instantly recognisable as such as compared to other fruit, such as a cherry. This version of the logo was used by Apple from the mid 1970s until 1998; the “Think Different” slogan was retired in 2002.

It was interesting to see the huge number of tributes for Steve Jobs, when he passed away in October this year. Has there ever been such a response for the death of a technologist? Steve Jobs’ death produced tributes from people from every walk of life and all corners of the globe: from Presidents to Prime Ministers; from rock stars to every day users of their products. Steve Jobs was a special person, who instinctively knew what his customers wanted – without asking them. He saw the value of technology as an enabler: in improving people’s lives- but he absolutely understood – that most people are not fascinated by the technology in itself but what it can do for them in their everyday lives (in the same way the motor car was an enabler in the last century: few people are concerned with how they work).  Apple’s products all have an underlying intuitiveness about them that really does allow their users to unplug and use them straight away– without assuming any technical knowledge hitherto.

Most of us, however, do not possess that instinctive insight that Steve Jobs’ had – we have to do our market research with our target audience first. Historically, many information security professionals will not engage with end users at all – since these are the people -they believe – will ask for things they can’t have and do all the things they don’t want them to do.

Some years ago I was brought into an American Investment bank as project manager, on a desktop platform refresh program that had previously failed miserably in its objectives. Successive project managers had come and gone on that project, and it always seemed a case of one step forward and two back previously. Typically – for the IT department – the team were kept out of sight and out of mind in the lower dungeons of the bank: safely away from daylight and customers. There wasn’t even a telephone for the team – all communication had been done via email previously!

I decided that as well as talking to the head of each business unit to determine what was their requirements were, I would also – shock horror!- talk to the end users of each team to determine and capture which applications they used and how they used them in their day to day tasks. I also initiated a series of end user tests, and ensured that a representative from each team came down and tested the applications before the desktop builds were approved and shipped back to the respective end-user desks. When business managers asked why we would be asking for 30mins –of one staff member’s time for testing, I explained to them that this was improving staff productivity, by reducing helpdesk calls and eliminating the need for recalled failed builds. This strategy payed off: not only did we retain this business we went onto to win further rollouts for other parts of the bank.

This year I’ve heard and seen things which beggar belief. A consultant proudly boasting that the organisation he was contracted to work for “deserved data breaches” because “their staff were uneducated” (worse still, he meant this in a generic sense, not specifically to information security best practice education). I’ve also heard all security vendors being branded as “snake oil vendors”. An interesting concept – I don’t think we’d have much of an industry without security vendors, and I’ve come across one or two unscrupulous practitioners in my time who have a scant disregard for data privacy themselves to whom the disingenuous adjective could easily apply.

Whilst there certainly are some security vendors around to whom the adjective “snake oil” can easily be applied to (and a reputable re-seller recently reminded me of one): those that have little respect for their customers’ product feedback; who are in the business purely to make money without advancing genuine information security; and whose products are so desperately clunky to use that they require reams of documentation to use them; that greatly reduce user productivity and encourage their end users to find a workaround, and thus bypass security policy. Equally, however, there are some innovative vendors on the market that are genuinely interested in advancing information security, by helping develop new standards; thinking of helping the SME community by taking away the laborious task of log oversight from them and outsourcing it to specialists; or helping to secure the use of the cloud. I’ve come across all these types of vendors too this year. To label all security vendors in the same fashion is not only disingenuous to all vendors but also rather childish.

Earlier this year when I interviewed the UK’s Information Commissioner, Christopher Graham, for the ISSA, he remarked how he felt that end users were just not getting the message regarding data protection.  Too often we see the same old problems: users not being educated, making basic mistakes. Personally, I think we have an industry that’s geared up for messaging aimed mainly at board and manager level and around legal compliance, so is it any wonder? Who is teaching the end users how to handle personal data correctly, and what should and shouldn’t be stored regarding credit cards on a day to day basis in their jobs? Similarly, I’ve always disliked the industry term “evangelist” – widely used in our industry – since that implies preaching! Who on earth likes being preached to? Perhaps that’s why few end users are listening.

We urgently need an approach where information security professionals think about being business enablers, whilst enhancing security, and can talk in a language that their end users understand. For twenty years plus now, we’ve been thinking that all our problems will be solved if only we throw more technology at it. Yet still we see data breaches. Similarly, we need security products that are focused at improving end user productivity, rather than working against the business. Then users might stop looking for workarounds, to both the solutions and hence their security policy.

If only Apple did iSec!

Phil Stewart is Director, Excelgate Consulting  and Secretary and Director, Communications for ISSA UK.

The ubiquitous term “cloud computing” merely refers to applications, services or data that are managed outside the boundaries of the corporate network by a third party. Many large organisations have already outsourced applications or data storage as a way to cut costs. Many SMEs too have already widely adopted cloud computing, using it for a variety of services including web and email hosting; CRM; and invoice processing.

Earlier this year I was invited to attend the Cloud Computing World Forum in London. What came as no surprise is that cloud computing is already widely adopted by many large organisations. As one CISO put it so succinctly:  when your boss asks you to reduce costs by over 20% – we’ve already bought the cheaper coffee and reduced headcount, we now need to outsource our IT – both to reduce operating costs and free up valuable floorspace for other purposes. Whilst there were some good sessions in the conference on security in the cloud, what struck me is how few vendors present were focused on security.

In many ways the challenges of security in the cloud are no different to what the information security professional has always had to face: confidentiality of data; integrity of data and availability of data and services.  The three challenges I would argue that cloud computing presents that are new, however are: due diligence of suppliers to ensure there aren’t legal and compliance issues; user authentication – within the context of being managed by a third-party; and the unique threat that virtualisation plays when used in Cloud Computing.

Due Diligence of Suppliers

Before you can even consider migrating to the cloud, you need to identify and classify your data in-house. What data is customer and business sensitive data? Where is it stored currently? Are you storing personal data and/ or credit card data? Think about the implications for compliance, for example, with the Data Protection Act 1998 and PCI DSS. If you are storing credit card details and you outsource operations, you may well increase the scope of PCI DSS. Usually, for most organisations, it makes sense to outsource credit card payment transactions to a PCI DSS compliant provider. Regarding the Data Protection Act 1998 here in the UK, it is worth bearing in mind the 8^th principle of the Act:

“8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.”

As the law currently stands, at the time of writing, in the UK you remain the data controller for personal data  – outsourcing the data storage and management to a third party doesn’t change this.  You therefore need to make sure you ask appropriate questions of your proposed suppliers.  A good starting point –but not exhaustive list:

• Where is the data hosted?
• Where is the data replicated to?
• What technical, physical and procedural controls are in place to protect the outsourced assets?
• Ask whether the proposed provider is certified against any internationally recognised standard. ISO 27001 certified and PCI DSS compliant providers are helpful in this case
• What are the local data protection laws in the country(ies) where the data is hosted and replicated?

It must be stressed that you should always seek legal advice when determining if the proposed supplier offers the same levels of protection as defined under your own jurisdiction regarding data protection.

You should also do a valid risk assessment to identify what services are business critical and what makes business sense to outsource,  and what is simply too risky or cost ineffective outsource. What are the legal implications of outsourcing the data? The International standard  ISO 31000  -risk management – principles & guidelines –  forms an extremely useful reference material for the implementation of a risk management process.

User Authentication in the Cloud

Secure user authentication is not a new challenge in itself; but when combined with a remote network being hosted by a third party it does represent some new challenges. One is for example, if the user is already authenticated internally on your network, perhaps via a directory service, can they be seamlessly recognised by the third party’s network without compromising security?  Mobile workers, increasing both in number and from a increasing variety of mobile devices, also need to be able to authenticated by the cloud provider’s network securely without in any way compromising the security of your data on their network or indeed your own network itself.

One vendor which has impressed me in this space is Ping Identity – who offer identity management software to enable Single Sign On as a service for cloud resources. It integrates both with mobile devices and web browsers and integrates with Active Directory or cloud identity providers. In addition, Ping Identity extends the capabilities of Active Directory — enabling control of user management, policies, and access, and integrates with over with 30 identity and infrastructure platforms. I was impressed with their demonstrations at the show and it is worth a look for their innovative offering.

Vitualisation posses a Unique Threat

In cloud computing, a program called a hypervisor allows multiple operating systems to have access to the same hardware resources. In essence the program is controlling access to these resources amongst the different operating systems. Whilst the operating system at the client (the guest OS) thinks it has full access at all times to the resources it requires, in essence what is going on behind the scenes is that the hypervisor program is carefully managing access to the host (cloud hosted) resources of processes and memory, so that each guest operating system gets the resources it requires at that moment in time, without disrupting access to the other guest systems. It is partly this principle that allows the better utilisation of resources that makes cloud computing cost effective (along with economies of scale).

One key concern – rarely addressed to date – is that malicious code could infect one customer’s machine and then spread – via the underlying hypervisor – to other customer’s machines. There was a lot of talk around this time last year of a collaboration between NC State University and IBM, of a prototype product – HyperSentry – that specifically addressed this threat, but it seems to have gone quiet recently. I hope that IBM, as well as other vendors look at ways of addressing this unique threat.

Cloud Security Initiatives

I have no doubt that most large organisations have both the legal and technical resource available to do an effective due diligence process, should they choose to do so. However, when it comes to SMEs, they don’t have access to in-house technical and legal resources. What is required to address these issues effectively for organisations –  is a cloud assurance scheme. There are currently two major initiatives in this space:

• STAR – Security Trust & Assurance Registry from the CSA (Cloud Security Alliance)
• CAMM – Common Assurance Maturity Model

In the case of STAR, CSA have created a free, online repository of documents that list the security controls by cloud computing providers who have gone through a self-assessment. The documents list a series of controls and whether or not the provider has them. CSA are currently urging all cloud security providers, large and small, to provide a complete self-assessment for publication.

CAMM’s pilot is currently in its alpha pilot phase, which aims to provide framework in support of the information assurance maturity of a third party provider or supplier (of which cloud providers are currently a major part). These will then be published in an open and transparent manner.

Whilst both initiatives are to be welcomed,  both need to address the challenges of SME due diligence (given their constraints) and the unique threat posed by the hypervisor threat. A cloud assurance model that effectively addresses these issues is definitely needed for the industry.

CSA’s STAR is available from the CSA website ; CAMM is currently undergoing its alpha pilot and more information is available at the CAMM website.

Phil Stewart is Director, Excelgate Consulting  and Secretary and Director, Communications for ISSA UK.

In 2006, the ICO uncovered the organised and illegal trade of confidential personal information in the report, What Price Privacy? How widespread do you believe this problem is today in the UK?

“I’ve described it as a modern scourge. The headlines, both in 2006 and more recently, have all been about the behaviour of the press, but I think it goes much further … Basically we’ve got pretty systematic trashing of our rights under the Data Protection Act.  My predecessor, in flagging the blagging, made the case for a much stronger penalty that would act as a deterrent but also send a very strong signal that data protection offences are not a victimless crime. It’s very important now that parliament gets on and activates section 77 of the Criminal Justice & Immigration Act 2008 which allows for the custodial penalty of up to 6 months in a magistrates court and up to 2 years in the crown court, but has not been commenced. It wasn’t commenced because of a stand-off between the politicians and the press.  I think we can now get through that, because the terms of the debate have changed a bit.  This isn’t something that should wait for the Leveson Inquiry because frankly it isn’t about newspapers – it’s about debt recovery, claims management companies, matrimonial disputes, child custody battles, you name it.”

Yes, I remember when you became Information Commissioner in 2009, at a Parliamentary select Committee you re-iterated the need for a custodial sentence for convictions under section 55 of the Data Protection Act.

“Indeed, I did.  I didn’t get very far, though, because basically the politicians and the press had agreed this was going to be a sort of Sword of Damocles hanging over the press and if they misbehaved then it would be activated. I think the whole point was the 2006 report – yes, it talks about the behaviour of the tabloid press because the particular private investigator that the ICO raided, that was his main line of business.  But that’s  not what all the report was about. The idea that you don’t have to take any action against staff in NHS walk-in centres selling information to claims management companies because of some arcane dispute about investigative journalism is clearly nonsense. I didn’t get very far two years ago but I’m determined to go on pushing. There’s the human factor in all of this. We can have wonderful systems and policies for data protection and data security, but if the men and women on the ground don’t take it seriously and don’t think it matters – none of those systems are going to work. A small fine in a magistrates court is simply not a deterrent. I think understanding that you might go to prison is more like it, but it also enables the courts to look at the whole range of possible penalties which might be somewhere between a small fine and the threat of going to prison or having a community sentence.”

I noticed that in the ICO’s latest annual report – you mentioned the NHS – as an organisation they had the largest number of data breaches

 ”They are about the largest organisation so I’m not surprised by that – they are quite good at reporting breaches, it’s part of their procedure. I recently met with the chief executive of the National Health Service,  Sir David Nicholson.  We had a very good, workmanlike discussion. There’s a lot of change in the NHS and that makes for a particularly dangerous time but you’ve got to distinguish between the trucks and the tracks. We’re much better at thinking about the trucks: these are the great security initiatives and projects. The tracks are the routine: the day-to-day. My experience of a lot of organisations, not just the NHS, is that the messages haven’t got down to the grassroots. Data protection is seen as the sole concern of a few geeks, and as a result terrible things happen.  People have heard the messages but haven’t internalised them. Every week I’m dealing with laptops going missing, not encrypted; portable devices and papers left on the bus; sensitive files dumped in a skip. In the health service of course by definition the information is almost certainly going to be sensitive information so we’re working very closely with the NHS so that they can get the big things right – summary care records etc, but they can also get the smaller things – which actually aren’t that small – such as persuading the receptionist in the GP surgery you don’t give things out over the phone just because somebody rings you up and sounds persuasive.”

What can be done in the health sector and other sectors to generate a culture where data protection becomes second nature, rather than seen as an annual event, or a burdensome task?

“I think organisations both in the public sector and the private sector have so much at stake in terms of their reputation, which of course in commercial terms you can put a value on, and in the public sector it’s all about the threat of reversing all the work that’s gone into citizen engagement.  The fact that it’s a real issue at the top of the organisation means that the message then needs to be taken to the whole organisation: it’s not just something of peripheral concern. Yes, it’s about training, but then it’s about auditing, it’s about going back and making sure people are practising what they know they are supposed to be doing – it’s about mainstreaming the whole thing. It should be absolutely part of the performance review system. We shouldn’t have the situations we’ve had over the past few years or so where people dealing with very sensitive information are treating it in such a cavalier way.  Our first civil monetary penalty was imposed on Hertfordshire County Council where they’d faxed highly sensitive court papers in a child welfare case to what they thought was Watford County Court but unfortunately it wasn’t and they’d got the number wrong. You wouldn’t do that if you were thinking about what the material was you were handling, that it was very sensitive, personal information about vulnerable children, so faxing wasn’t a very good idea anyway. You needed to have made sure you had got the right fax number, and that someone was waiting for the fax at the other end and that you didn’t just have finger trouble and were about to send it elsewhere. The civil monetary penalties which we’ve had at [the ICO’s] disposal since April of last year have certainly had a sobering effect and made people sit up and take notice. We’ve only imposed 6 of them – we’re not trigger happy – but it’s certainly made it very real to organisations who have focused on the reputational damage – being hit with a penalty.”

Following the use of social networking sites such as Twitter to reveal the details of super-injunctions earlier this year, the Prime Minister has called for a review of Data Privacy legislation in the UK. Will the ICO be contributing to the work of any new parliamentary committee in shaping any new data privacy legislation?

“Well, the Data Privacy legislation will be reviewed anyway in the context of the European Directive – that’s a process that’s going ahead. The Commissioner Viviane Reding is leading that process and the ICO is very much engaged with our European colleagues in the Article 29 working party – we’ve been inputting into that study. We expect to see a draft of a directive in about November and then the legislative process will follow. In a few years’ time there will be changes to data protection law, because the directive on which it’s based will have changed. We don’t think there is much wrong with the principles, but we’re looking for legislation that is much more modern and realistic in terms of what actually happens in the world of global information exchange.”

The legislation has been behind the technology in terms of usage of it, hasn’t it?

“Absolutely. It’s very important that Brussels produces a legislative proposal which is reasonably future-proof – if you get the principles right then the principles can take the technological changes on board. If you’re overly prescriptive then you’ll come up with something that is highly relevant for 2013 but by the time it comes into law it’s probably outdated because of all of these other developments. The ICO, working with anyone who will listen to us, is stressing the accountability principle – that the legal responsibilities lie with the data controller, and that the role of the data protection authority is to regulate that relationship and intervene as and when necessary on the basis of risk, rather than pretend the data protection authorities can be like some latter day King Canute holding back the waves, and let’s not kid ourselves that no information moves across borders without some tick in the box from the Data Protection Authority. The current Directive, of course, is pre-cloud, but it ought to be clear that’s it’s a very outdated text that doesn’t take into account the realities of the modern world.”

Would you like to see greater powers for the ICO, such as the power to audit an organisation to investigate a serious data breach?

“We gained some extra powers under the Coroner’s & Justice Act, and we have found that doing consensual audits is going really well, more in the public sector than the private sector. We can run the ruler over a company’s compliance which can then be a badge of pride: “we’ve been checked over by the ICO”. There are powers to compulsorily audit government departments. I will go as far and as fast with the existing powers that I’ve got, but if I come to the conclusion that I’m not able to get anywhere-  that I can‘t audit  organisations – then I will certainly return to the Secretary of State. I can get warrants – I signed a warrant today. It would be more satisfactory to require an audit, probably as part of an undertaking to improve.”

At a recent ISSA chapter meeting, one speaker remarked that social engineering over the phone is often the seed for an attacker that allows them  either to guess a password or a weakness in a system or a process to exploit.  Many of the data breaches we have touched on this afternoon all start from an internal employee in an organisation. Do you think we are doing enough to educate employees in organisations to create a security culture?

“No I think we’re not and you absolutely put your finger on it when, in relation to this row about hacking, you have to ask the question: ‘how is it possible for the phones to be hacked?’ and the answer is: somebody has blagged, which they shouldn’t have done. That gets us back to section 55 of the Data Protection Act – it’s just too easy to blag and the penalty isn’t very impressive if you get caught. So I believe very strongly we’ve got to push for that [a custodial sentence] and I’m trying to get the politicians to see that this is something we need to do anyway – it’s going to take some time. Frankly we can’t wait [for the Leveson Inquiry] . We’ve got information leaking from databases, every day – and not, as I said earlier, to journalists particularly – because information is valuable and it’s making people a lot of money.  That’s the root of our problems – so if we’re concerned about cyber security then getting these basic things right is absolutely essential, and members of staff in all organisations need to see the connection between something which seems to them as a bit naughty, but not terribly bad, and the terrible things that happen as a result.”

Christopher Graham – thank you for your time this afternoon and we look forward to your address at the ISSA next month.

The Information Commissioner, Christopher Graham, was talking to Phil Stewart, Director, External Communications, ISSA UK. Christopher Graham will be addressing the ISSA at their next meeting on 8^th September 2011 in London.

2011 has seen a steady stream of data breaches at large organisations: from Sony to Citibank, to RSA, Google and Epsilon Marketing and the Pentagon. Lockheed Martin also thwarted an intrusion attempt into their network to steal data.

Lack of Board Engagement

Opinion differs in the industry as to whether the fault lies with the information security industry itself in convincing board level of the need to act; or whether boards are actively engaged with information security professionals in the first place. Harvey Nash’s CIO 2011 Survey published earlier this year generated responses from 2,000 CIOs and industry leaders worldwide. Its findings showed that 50% of respondents sit at the operational management or board level of their organisation – meaning that the other half do not.

When Sony’s breach involving 77m Playstation user details came to light, it was subsequently revealed that Sony did not have a CIO/CISO at the time, and indeed for a number of years preceding the attack. It’s not just sufficient for board visibility of information security but also that the CIO has genuine influence and is able to raise awareness to the board and influence decisions on a regular basis. Good information security awareness starts from the top : you cannot expect your employees to have awareness of an issue that has no visibility at board level.

Taking a Holistic View

It is important for every organisation to take a holistic view of information security (technology, processes, people) and not focus on a sole product, standard or the “next greatest thing” and believe that all will be well. The culture of chasing the current standard or solution, currently in vogue, has been largely vendor-driven, where advice is given with a heavy slant towards their own solutions as the sole solution. I’m keen on vendors and professionals who see the bigger picture beyond their own product or standard or area of expertise and are keen to educate, or in those vendors who, in developing their own solution are keen to help improve upon existing standards. I’ve been particularly impressed with Sophos in this regard, who regularly give out advice via their security blogs on a whole host of issues ranging from Facebook scams, phishing attacks, credit card scams, and botnets. They are to be commended not only for taking a holistic view of the industry but commenting on the various social media scams for which social media users clearly need educating. It also did not surprise me that Sophos won the award for best speaker at the recent ISSA event onboard HMS President.

To illustrate why a holistic approach is important – for years Intrusion Detection & Intrusion Prevention systems for years has been sold as the panacea for detecting all malicious intrusions on your network. Without proper examination and collation of these logs on a regular basis – having IDS / IPS alone is nearly as bad as no IDS/IPS at all. Consider a “go-slow” attack where an attacker tries to gain access using 2 logon attempts per hour. Typically, this would not trip either an account lockout situation or an IPS detection – it needs some intelligence behind it to raise that alarm (be that human or automated – via SIEM ). For a large organisation, do you really expect a human operator to sift through thousand of event logs looking for a needle in an electronic haystack? Are you properly and intelligently monitoring your logs and can you take evasive action quickly should you come under attack? (rather than after the data has bolted, as is frequently the case).

Avoiding the “Checkbox Culture” that Standards Compliance Alone Generates.

There’s too much noise and focus on standards compliance in the industry in the mistaken belief this alone will generate security. It doesn’t: when taken in isolation, it generates a false sense of security. Information security cannot be seen as an annual tick box event, with a string of recommendations and good intentions: to be done at some later date.

Whilst standards compliance is a necessary part of good governance, the industry really should be talking about generating good security cultures. An interesting study would be of those companies mentioned above (and others) which have suffered a breach, the percentage which had recently undertaken compliance with a particular standard, combined with whether they have a CIO/CISO in place and had regular staff training in place. It would make interesting reading.

A security culture is something that starts in an organisation from top-down: the board is updated at regular and frequent intervals about what is being done across the organisation – what business processes need improving and what staff education programmes are in place or are being updated. CIOs / CISO should be constantly improving their skill sets and awareness by attending conferences, reading the latest security articles and being aware of innovative solutions that challenge the established way of thinking in the industry. The human factor – and education of staff is an area that is often overlooked: in the Information Security Breaches Survey of 2010 by PWC, it showed that 80% of large organisations reported an incident caused by staff, yet very rarely do we hear of the need to regularly educate users. It simply isn’t good enough to keep blaming staff if you don’t have a regular training programme in place. It also isn’t good enough to “educate and forget” i.e. only train when a new person joins an organisation and never again – there needs to be a programme in place to educate users at regular intervals – to accommodate new threats, changes to legislation and best working practices.

Taking Professionalism Seriously

It’s long past time that our industry took professionalism seriously. Think of a visit to a doctor or a surgeon performing an operation. Would you let a surgeon operate on you who hadn’t bothered to attend medical school or didn’t think the exams were “really that important or necessary”? There certainly are some bad doctors out there, but the reverse argument of not bothering with professional qualifications to practice in the medical profession doesn’t hold water. Yet that is exactly what a small portion of our industry is doing!

As if to illustrate the point, last week I heard a hilarious story from a journalist who told me how he had uncovered someone who had been blagging their way around the industry as a “security consultant” (incidentally the journalist has given permission for me to repeat this, and the information was obtained via publishable sources and not via phone blagging or phone hacking!). Not only did the ‘consultant’ have no information security qualifications or certifications, but he had previously been working in… the hair products industry!  After containing our laughter in the restaurant, I remarked: “Securing hair braids yesterday, securing data tomorrow!” It would be a funnier joke if it wasn’t happening in our industry.

“Don’t worry sir, I’m fully unqualified! I’m good with people though and ...... I used to cut hair for a living, so you have nothing to fear. How hard can this medical thing be?”

The industry needs to think about standardising on acceptable criteria for practicing in this field. I would propose that people wanting to employ someone in our industry insists on a CISSP certification as a minimum benchmark certification, as it demonstrates many of the areas previously discussed – such as taking a holistic view, relevant experience, and it encourages and requires constant improvement and education. It also demonstrates a commitment to the industry. Getting information security wrong can have a really serious impact on your business, and it certainly isn’t about just selling security solutions as a quick ‘fix’. I would also urge organisations to ensure that people at all levels are qualified – from CISO/ CIO & CTO down: it’s not good enough to ensure your junior staff are qualified whilst your security leaders are not – lead by example.

Changes to Legislation Are Required

I both welcome and support a change in the law to include mandatory breach notification for the UK – as is already the case in US states such as California. I would like to see also as part of filing a company’s annual accounts or statutory annual return a list of security measures they are taking / will be undertaking to safeguard personal data in their organisation. If there’s a statutory requirement to report annual financial accounts, why not something (albeit more sophisticated) in place for information security as well? If people have to sign off on security measures that subsequently turn out to be false or inadequate (and face subsequent prosecution), it may just make boards wake up that inaction is not an option and that people’s data and privacy is something we value as a society. Granted, this alone isn’t going to be a panacea or an easy thing to legislate (a one size fits all policy for all organisations is not appropriate in terms of their obligations – but then we already accommodate different annual accounting requirements with the Companies Act of 2006 for different sized organisations).

Without enforcement, legislation alone is unlikely to succeed in changing culture. I would also like to see stiffer penalties for breaches of section 55 of the Data Protection Act enforced in the UK. In May 2006, the Information Commissioner in the UK published a report “What Price Privacy?” which uncovered the illegal trade in personal information, with a follow-up report published 6 months later. The act of blagging, (which has been the root of all the problems with the phone hacking scandal) is a criminal offence under section 55 of the Data Protection Act 1998. Currently, however, it carries a fine of up to £5,000 in a Magistrate’s Court but does not include a custodial sentence. Whilst Section 77 of the Criminal Justice and Immigration Act 2008 (CJIA) subsequently included provision for a custodial sentence of up to two years, this provision cannot come into effect until the Secretary of State makes a relevant order. Whilst the recent phone hacking scandal has focused on some journalists using blagging to obtain personal information, the “What Price Privacy?” report of 2006 showed the practice is far from confined to the journalism sector – this is just the visible tip of a much bigger iceberg lurking below – and I urge people to read that report from the ICO.

To conclude, whilst I don’t share the pessimism of some in the industry by the same token I’m not complacent either in thinking that there isn’t much still to be done: both in changing and enforcing the law, educating both board members and employees and ensuring the industry thinks holistically as individuals and organisations.

Phil Stewart is Director of Excelgate Consulting and Director of External Communications, ISSA UK

Twitter celebrated its fifth birthday on 21st March 2011. Twitter users now send more than 140 million tweets a day.

Twitter Tourette’s, to coin a phrase, is used in this context to describe a phenomenon which has been increasing on the Internet regarding a (seemingly unknown) compulsion to publicise private or inappropriate material online (not to make light of Tourette’s Syndrome, in which 10% of people with Tourette’s swear uncontrollably). Serious thought needs to be given to not only the use of social networking tools within the workplace, but training to employees as to how they use it within their private lives.

High Profile Cases:

Bomb ‘joke’ on Twitter results in conviction under the Communications Act 2003

On 6^th January 2010 Paul Chambers, a 27-year old accountant, posted on Twitter a ‘joke’ regarding threatening to blow Robin Hood airport “sky high” . He was arrested at work a week later and subsequently convicted of an offence under section 127 of the Communications Act 2003 (for “sending a public electronic message that was grossly offensive or of an indecent, obscene or menacing character”). Paul was fined £1,000 and lost his job as a result of the tweet, and lost his subsequent appeal against the conviction at Doncaster Crown Court.

Press Complaints Commission rules Twitter messages are “not private”

Sarah Baskerville, a Department of Transport official, filed a complaint to the press regulator, arguing that her tweets regarding comments about being her being hung-over at work were private for her 700 Twitter followers, and not meant for publication in the press (the Daily Mail and Independent on Sunday both reported this story). The Press Complaints Commission ruled that as Twitter was publically accessible and that the potential audience was actually much further than her own followers, (since messages on Twitter can be re-tweeted to others) the publication of the story in the press did not constitute an invasion of privacy.

IT Consultant unwittingly tweets details of the raid on Osama Bin Laden hide-out live

An IT Consultant, Sohaib Athar, living in Abottobad, Pakistan, was the first person to unwittingly tweet about the raid on the hide-out of Osama Bin Laden. He reported live as events unfolded that a helicopter was hovering over Abottobad, followed by a loud explosion. He pondered: “Since Taliban (probably) don’t have helicopters, and since they’re saying it was not “ours”, so must be a complicated situation”. Later that day, after the White House Press conference on the raid, it dawned on him he had tweeted the operation live: “Uh oh, now I’m the guy who liveblogged the Osama raid without knowing it”. Within hours of his initial tweets his followers surged by over 15,000.

European head of Twitter indicates revealing to police details of Twitter users who broke superinjuction

Lawyers acting for a UK Premiership footballer, filed court papers against Twitter and a number of its members last week after they allegedly broke the terms of a “super-injunction” banning publication of details of his private life. Tony Wang, the new European head of Twitter, has indicated that it could give police details of users who broke the gagging order, in line with its global policy for dealing with legal requests. In a statement at the e-G8 forum in Paris, Mr Wang said that it was Twitter’s policy was to comply with local laws to hand over details where it was “legally required” to do so.

South Tyneside Council acts in US Court to reveal identity of Twitter users behind allegedly libellous statements

South Tyneside council went to court in California to request Twitter release details of the identity of five twitter users who were allegedly libelling a number of councillors at South Tyneside Council via Twitter. The “Mr Monkey” blog had made a number of accusations against the council leaders. Council spokesman Paul Robinson has revealed information has been disclosed by Twitter to its lawyers including IP addresses and email addresses.

A Tweet is a publication, not a private message!

Twitter should be regarded as a publishing platform, not a means of private communication. All the examples mentioned illustrate  the dangers of the unguarded use of Twitter and social networking sites, from revealing the details of secret military operations; opening the way for legal action either by defamation or breaking the terms of a gagging order; uncontrolled release of new media into the press; or damage to reputation: corporate or private.

New e-learning Course

Excelgate Consulting has teamed up with Ira Winkler & VigiTrust to provide an e-learning solution training course: Security of Social Networks. The e-learning solutions can be run using a standard web browser and completed in stages at the participant’s pace.

The Security of Social Networking elearning course model: introduction.

Upon completion of the course, your employees will participate in a test to determine their awareness and upon passing the course will generate a certificate. On successful completion of the Security of Social Networks course, users will:

• Be able to distinguish between direct and indirect attacks from hackers and other unscrupulous individuals and how to avoid exposure to them

• Recognise the threats posed by seemingly inconsequential personal or confidential work information and identify the various ways in which criminals may exploit social networks

• Gain a good understanding of the main features of the major social networking sites, and how careless activity can impact negatively on corporate applications and customer sensitive information

The new Security of Social Networks e-Learning course is available now, and a short demo is available here: . Please contact us for further information.

I was involved with the pilot of the (then CSIA) Claims Test Mark Scheme,  back in 2004: SecureWave was invited to participate in the pilot phase, (then run by Cabinet Office), to produce working Claims Documents that could be easily turned into test plans from their marketing collateral. We, together with our test lab IBM, achieved two of the first three certificates awarded for the scheme launch in September 2005. The scheme addressed a market need at that time: a UK government backed assurance scheme that was effectively a hallmark of security software: up to  Impact Level 2.

Six years later and the security landscape is greatly different to that of 2005. Threats emerge at a much faster rate, so any new scheme needs to be able be both flexible and adaptive in its approach. Long lead times to certify a solution will undermine the scheme itself, and the new scheme also needs to have a mechanism in place to deal with patching of solutions as new threats emerge and vulnerabilities are identified. From a vendor perspective too: the market has also changed. Security solutions have become commoditised: and the huge sums to spend on assurance schemes available in 2005 are now under close scrutiny for their long-term return as an investment in 2011.

Being involved with the CCTM pilot and launch, I’ve taken a keen interest in the development of this new scheme, and particularly welcome the responsiveness of CESG to the concerns expressed by vendors and consultants at the workshop at CIPCOG 2010 on their existing assurance schemes. What I believe this new scheme addresses:

• To provide a scheme for product assurance for the “missing” part of product assurance – at Impact Level 3 (CCTM evaluated products were up to IL2 ). CAPS, suitable for higher impact levels was seen as too costly and time-consuming by vendors who had engineered a solution suitable for say local government, but had no desire to operate/ engineer for the higher impact levels. This prevented some vendors from entering the UK government market at all.
• To recognise that vendors may have already submitted their products through other certification schemes, such as Common Criteria, and recognise the evidence in that submission, where appropriate
• It recognises that not all data at Impact Level 3 should be treated in exactly the same way. Depending upon the threat level, either a Foundation or Augmented grade CPA evaluation will be required, reflecting the threat model and product usage.
• It encourages competition in the industry by opening up the relatively closed space of IL3 to more players.
• It addresses the need to select a product relevant to the risk profile associated with a particular organisation. Over-engineered solutions for a relatively lower risk profile will have a credible alternative solution.

In the new scheme there are, at the time of writing, 26 categories (“security characteristics”) of security products eligible for entry into the CPA scheme. These include: software full disk encryption and VPNs for remote working (the categories this time around for the pilot phase); data destruction and desktop email encryption (priority A) ; SSL VPN and desktop virtualisation (priority B); and client AV product and bootable media for remote working (priority C).

There are two levels of entry into the scheme: foundation and augmented. Foundation level involves predominantly “black-box” testing and examination of the product, whereas Augmented levels involves more specialised testing, and analysis of source code and other low-level artefacts. These take into account that not all data at Impact level 3 is subject to the same nature of threats (e.g. aggregation of citizen data in a local authority; a central government payment system; an intelligence agency’s RESTRICTED email system). It does raise the question whether Impact Levels have been a good way of reflecting the threat landscape and as a guidance means, if such a rider is needed to re-iterate that impact levels  represent the impact to the organisation of a breach; not necessarily the environment or nature of data to be protected.

Testing will be done by a CESG approved CPA Testing lab, where upon  the test lab will submit the results of a questionnaire concerning the product on behalf of the vendor to CESG. Provided CESG confirm the eligibility of the solution for foundation grade then the test lab will evaluate the solution against the security characteristic specified for that solution; and CESG will review the deliverables. It is a pre-requisite of the augmented level entry, to have passed foundation level evaluation. Due to the more detailed analysis required for augmented level, the contract for evaluation will be between CESG and the developer.

As far as the existing CCTM scheme is concerned, there will be a gradual phase out transition of the scheme. Products already in CCTM evaluation will continue. New submissions to CCTM have been/ will be rejected as follows:

1. Products that could be tested against ‘Priority A’ CPA SCs will not be accepted into CCTM from 14th February 2011.
2. Products that could be tested against ‘Priority B’ CPA SCs will not be accepted into CCTM from 31st March 2011.
3. Products that could be tested against ‘Priority C’ CPA SCs will not be accepted into CCTM from 31st December 2011.

I am supportive of the new scheme but would stress the need to ensure that the new scheme delivers on the key concerns of reducing time to certify and the costs of the scheme (particularly for foundation level). Although CESG are not responsible for the costs of the new scheme, it is in the interests of all concerned to deliver in this regard. Towards the end of the CCTM scheme, the average cost to the vendor was £18k-£20k in submitting a product through CCTM. I’ve heard similar figures being mentioned for the new scheme. A streamlined process that takes into account existing schemes ought to reduce costs for foundation level (augmented level evaluations will obviously be at the higher end owing to the more vigorous evaluation required).

It is true that this new scheme also includes a higher level of assurance greater than did CCTM, but on the other hand it is the foundation level that is likely to be of most interest to vendors: reducing the time and costs to certify a solution over CCTM, as well as taking into account existing certification schemes, where appropriate. It is this also which will open up the large local government market to more competition, which hitherto has seen a near monopoly/ duopoly in certain key product areas. Lack of competition is at risk of creating a dangerous monoculture in government.  This assurance scheme will encourage innovation in the industry, as well as delivering value for money for the taxpayer.

CPA is the new product assurance scheme from CESG and launches Spring 2011. More information can be found at CESG’s website.

Phil Stewart is director of Excelgate Consulting and
Director, External Communications, of the UK Chapter of the ISSA

A year ago, at March 2010’s ISSA AGM and chapter meeting, David Lacey, Director of Research at ISSA UK presented the need for action in the SME community regarding information security. This resonated with many members of the audience, and as a result, a workgroup was set up comprised of vendors, consultants, directors, researchers and chief security officers.

SMEs (typically defined as 250 employees or less) make up 99.9% of the UK businesses, according to BIS’s Small and Medium Enterprise Statistics for SMEs, published in October 2010, and account for 49% of the UK turnover. Too often, the need for information security within SMEs is regarded as a “grudge purchase” and too often is perceived as “someone else’s problem”. In the UK, the definition of a small and medium business for accounting purposes is defined in the Companies Act of 2006. A small company has “a turnover of not more than £6.5 million, a balance sheet total of not more than £3.26 million and not more than 50 employees.” A medium company has “a turnover of not more than £25.9 million, a balance sheet total of not more than £12.9 million”. These companies clearly have intellectual property of considerable worth, and there is a clear need for SMEs to take action: not just for the sake of compliance but also to safeguard their own assets. Information in the 21^st century has considerable value, and the loss of it, as recent events have shown, can be very damaging for reputation. In the case of a small business, it may well put it out of business.

Part of the problem has been a general lack of innovation in the industry in recent times. In creating this draft standard, whilst the ISSA has looked at existing standards, the consensus was that a fresh approach was needed to deal with information security for SMEs. Clearly, the situation for SMEs is not getting any better: in fact, it’s getting worse. In the bi-annual Information Security and Breaches Survey (ISBS) published in 2010 by PWC, in 2008, 35% small businesses surveyed had suffered a malicious attack; this rose to 74% in 2010. Similarly, the average number and cost of a security breach in a small organisation rose from an average of 6 incidents with the worst one costing an of average £20,000 in 2008 to 11 incidents in 2010, with the worst one costing £55,000 on average.

The way that security has been pitched to the SME has been completely wrong in the past and fails to understand the difference both in the key drivers for, and the way a small business operates. Large corporates have huge resources at their disposal in terms of time, staff and expertise – both in IT and in law. Their board is driven by compliance because they are both aware of appropriate legislation and the need to comply with it. SMEs by contrast, unless operating within our own industry, are unlikely to be aware of key legislation or have the necessary IT expertise to act on it. Drowning a small business in mountains of paperwork and a complex risk assessment is not appropriate to all but the largest SMEs. The drum of “regulatory compliance” as the pitch has no resonance either to the small business owner. The irony of course is that compliance with key legislation is not optional, and that the Data Protection Act applies to all businesses, large and small. Similarly, any company offering payments via credit cards need to review their PCI DSS compliance.

Even if the SME owner is inclined to do something about information security, where do they go for up to date guidance? There is certainly  a great deal of information available online, but it is spread across numerous websites; it is focused primarily at large corporates or government bodies where huge processes and large amounts of paperwork are the norm; and is often out of date and does not address current threats and security issues. The guidance too is often completely out of date – not by months but in some cases a whole decade. For example: is dial-back access security or cloud computing security considerations more appropriate for the security landscape in 2011?

In drafting the new standard the ISSA have looked closely at the status quo and decided that the only option was to create a new standard from scratch, specifically for the SME market. It has been written in language that is appropriate for the small business owner. Over the coming months we will be reviewing the feedback received after a consultation exercise. Moving forward the ISSA UK chapter sees the need to provide up to date guidance on the key issues affecting small businesses.

ISSA 5173 is the new draft standard for information security from the ISSA UK Chapter, and is available for review and download. Feedback on the new standard is welcome at: SMESecurity@issa-uk.org

Phil Stewart is Director of Excelgate Consulting and Director, External Communications, at the UK Chapter of the ISSA.

The diversity of its membership comes from not only industry sector (government, finance, legal, security vendor, reseller, academia, and consultancy all represented) but also job role (architect, CSO, CTO, CEO, consultant, director, researcher, student).  Our current advisory board contains Members of Parliament, peers, members of Cabinet  Office, SOCA and various vendors, financial institutions and academia. This allows for a holistic view of the industry.

The UK’s chapter of the ISSA is the second largest chapter worldwide and continues to be an innovate chapter for information security.  We are currently working on a new standard for SME security: details of this will be announced later this year.

Membership Benefits

By joining the ISSA, as a member you will have free access to the events hosted in 2011. These events reflect the diversity of the membership of the ISSA and make for engaging debate. In addition, they also count towards CPE credits for those wishing to maintain their certifications. Each event typically counts for 3 CPE, whilst the security days typically counting for 6.

2011 ISSA-UK Events:

10th March 2011, London:
“Through the Barricades” – infrastructure security

12th May, 2011, Bletchley Park:
Security Training Day: Ethical Hacking & Forensics

17th May, 2011, Edinburgh:
The Emerging Threat

9th June, 2011, London:
Trusted Computing

14th July, 2011, HMS President, London:
Security Training Day: Anti-malware Dragon’s Den

8th September 2011, London:
Regulatory Compliance

1st November, Glasgow:
Trends In Information Security

22nd November, Leeds:
Trends In Information Security

8th December, London:
Chapter Meeting & Festive Drinks

13th December, London:
Microsoft Security Training Day

Geoff Harris, former ISSA-UK President (2007 - 2010) addressing the UK Chapter in 2010

Discounts on Conferences & Training

Membership of the ISSA provides discount on attending numerous partner events including:

• RSA Europe
• SANS
• MISTi
• Gartner
• ASIS
• (ISC)2

Webcasts and eSymposiums

The ISSA run webcasts which cover current topics of discussion in the information security industry. Attendance at these webcasts is free and webcast attendance typically counts towards CPE credits for maintaining current eligible certifications.

Periodicals

Membership provides a number of periodicals:

• A monthly e-newsletter updating members on ISSA news and events
• A bi-annual magazine “The ISSA Journal” delivered to your door
• A monthly e-magazine “The Journal”

Networking

The strength of the ISSA lies in the diversity of its membership. This provides a holistic view of the information security industry and provides excellent networking opportunities:

• Participate in innovative workgroups (e.g. the new initiative on security for SMEs)
• Share advice with your peers
• Broaden your knowledge by exposure to new technologies, legislation and industry sectors

Summary

Membership of the ISSA signifies that you are:

• Connected to a highly regarded organisation
• Part of a network of global information security peers
• Committed to professional growth and development

Membership is extremely good value for the money with annual membership fees for general membership at $95. Student membership is at the discounted rate of $30. The UK chapter is one of the few chapters to provide attendance of events for free for current members. Online joining instructions can be found at the ISSA’s website: https://www.issa.org/page/?p=Join_Online_8

Our next event is on March 10th in London – “Through the Barricades” (Infrastructure Security). Details of this event are online at: http://tinyurl.com/6xhg7sq.  This first event of 2011 is free for both non members and members (AGM section for members only).

For any membership enquiries please get in touch: administration@issa-uk.org

Follow the ISSA-UK on Twitter

Phil Stewart is Director of External Communications at the ISSA-UK