Newsletter November 2006

Security or Even Paranoids Have Enemies: Part Three

You'll recall that in our last two issues we proposed three key questions for understanding security:

• Can someone walk in without asking?
• Do you know what walks out the door every day?
• Do you know what you send out the door every day?

We answered the first two earlier, so let's move on to question number 3:

Do you know what you send out the door every day?

Businesspeople are constantly reminded that certain data leaves the offic -- they see laptops walk out. However, key information is also transferred in less visible ways -- by e-mail, electronic file transfers, etc. Here are some examples:

1. payroll records
2. information sent to an external Web site
3. clearing and reconciliation (positive pay) records to the bank
4. financial information to an accountant or partner
5. names and addresses to a marketing company

What's the message? When it comes to the electronic world, no company is an island.

Some of the questions here are similar to the ones we raised about the laptop, and the answer is the same: just make sure that critical information doesn't get out.

But there's another issue:
Some information needs to be sent out. Once you've determined what that is, you have to worry about two particular areas. First, are you sure that no one can touch the information before it gets to its destination? For example, if you prepare a list of checks to be sent to your bank for clearing and reconciliation, are you sure that no one who touches the file can modify it before it gets there? I know you don't let just anyone sign your checks, but giving people access to these files is just as bad.

Second, are you sure that the outside party that receives your data has proper controls in place? In general, I wouldn't be worried about your bank or payroll company. Most of these entities have far more knowledge -- and a much higher level of paranoia -- than the average medium-sized business. However, what if you're partnering with someone who will host your Web site? Will your system talk directly to theirs? Do multiple companies share the same server? Again, if it's a large enough company, you're probably O.K. But what if your computer guy tells you he also hosts Web sites and will do it for you on the cheap? How do you know that he will keep your data safe and sound?

It's important to be paranoid, because too often, when you're thinking about these areas, you're focusing on getting the job done (Can the bank do the reconciliation? Can I get a Web site up and running?) and not thinking about what can go wrong and what needs to be secured.

If we've made you nervous, contact us at info@redthreeconsulting.com and we'll help you sleep again.

Red Three Consulting: Transforming Information Technology into Answer Technology