Newsletter June 2006

Security or Even Paranoids Have Enemies: Part Two

Last time we proposed three key questions for understanding security:

• Can someone walk in without asking?
• Do you know what walks out the door every day?
• Do you know what you send out the door every day?

We answered the first question last time. So let's move on to number 2.

Do you know what walks out the door every day?

Obvious answer: your employees. More important answer: all kinds of digital information. This starts with the good old floppy disk, moves through Blackberries and other handheld equipment and ends up with laptops. All of these things can have crucial information on them. If you want reminders, click on any of the following links:

• Wells Fargo loses computer with confidential data again
• CPA group says hard drive with data on 330,000 members missing
• Personal data on millions of U.S. veterans stolen

What can you do? Well, you might consider making your employees sleep at their desks with their laptops. Or you might consider telling them that they can't have crucial reports in anything but printed form. Or you could have someone check their disks every day.

All of these options will probably cost you quite a bit of productivity—not to mention morale—and turn those fancy laptops into great DVD players for long plane flights.

A more practical suggestion is to start by determining which data really needs to be protected. Hint: it's more about personal privacy than corporate espionage.

Obviously, if a laptop falls into the wrong hands and your competitors find out your profit margins, that's not good. However, you need to keep in mind that most internal reports make little sense to someone who doesn't understand how the company works.

So what we want you to focus on is any data which could compromise not you but some other person or business. This includes credit card numbers, social security numbers and insurance information. Then go ahead and make sure this data is locked down.

In the era of instant information, this gets complicated. But you should ask yourself these questions:

1. Who has access to such crucial information?
2. Why do they have access?
3. How can that access be controlled?

Often, people have access to things they shouldn't because of sloppiness or laziness in the process of setting up the system. If you have any critical data on your system, you need to ask who can get to this data. If you can't get an answer, you're waiting to become another headline. We'll talk more next time about some other possible solutions, or you can contact us.

Red Three Consulting: Transforming Information Technology into Answer Technology