Infosec Data Analytics and Visualisation

I gave this talk at the IISYG last Friday. It was well received thanks to the reading of Raffael Marty's excellent work and blogging on loggly.

It's a nice idea but the key to success is getting application developers to adopt the logging mechanism and for team leaders to understand transactions and enforce teams to use them. There were many questions, mainly about the security of sending your logs to a third party.

Object-Orientated Security Policy

Information Security - Email Management

I've just finished a fascinating tranche of work on mail management, in my particular clients case, using MIMESweeper which works by a "stop" list, i.e. a list of banned words/phrases/regular expressions. First issue to understand was legal compliance, secondly, effective operational procedures leveraging the features of the tool. Below is a Freemind map of the overall process:

Language Coverage

We have a diverse workforce who speak many languages including: Hindi, Finnish, Russian, Bulgarian etc. Deciding which languages should cover was a simple conundrum to the in-house legal expert - we only need to cover the languages in which we conduct our business, (in the clients case) namely English, French, German and Japanese.

The stock English dictionary supplied with MIMESweeper contained mainly anatomical parts and the usual canonical profanity. The strategy of this particular stop list seemed to be male, heterosexual, white, American and lower class. I believe this is where the fecund British mind can add value: there are several online dictionaries are sources of expletives and profanity (e.g. The Alternative Dictionaries, Roger's Profanisaurus etc.) Other interesting sources are SMS acryonyms which are increasingly being used by the younger generation. There are even translation sites which can change English into "text speak". and several words used by the slightly more educated such as onanist. In the latter case, it would be hard to argue that any of these words, phrases and acronyms have any place in business communications.

UK Legislative Changes

The legislative environment in the area or employment law, company regulation, data protection and human rights has changed so radically of late that there is a significant gap between practitioner perception and legal reality. Therefore, it may be wise to address address this chasm in order to "provide a safe working environment" for staff. To that end, I've tried to cover all bases here in a succinct yet comprehensive statement in the Email and Instant messaging policy to reflect this intent:

• the creation or distribution of any disruptive or offensive messages, including offensive comments about race, statements about gender, hair colour, disabilities, age, religious beliefs and practise, political beliefs, national origin, sexual orientation, sexist remarks, sexual candour or voyeurism

Email Governance - Data Protection, Human Rights and RIPA

Contrary to the widely held belief, employees do have rights under the Data Protection and Human Rights Acts in the UK. Therefore, an explicit governance framework must be in place to control access to email, user data and calendar information:



Email Analysis Using MIMESweeper

And lastly, once we have our email, we need to be able to analyse it in a way which does not necessarily mean we need to read the contents.


To be continued

Security Incident Management - Event Notification

Deep in policy land of late, finishing off a BITS compliant set of Infosec polices, I noticed a service which may prove useful in Information Security Incident management (or any other incident management scenario for that matter) from Grasswhispers (http://grasswhispers.co.uk.)

The user controlled web portal allows you to upload your staff mobile phone database then categorise them accordingly. When an incident occurs they will receive a pre-recorded message. Of considerable further use is the ability to record update messages on the move from a mobile phone. It's a slightly better alternative that SMS (see below.)

In times of crisis

Only fly in the ointment is what happens if they switch the mobile phone networks off? This happened during 7/7 for whatever reason - presumably in an attempt to block a control route to a yet unexploded devices. Perhaps this is something that needs to be taken into consideration in any emergency scenario? However, I'm surprised that so many organisations seem to devolve the responsibility for DR/BCP to the least able of the IT groups and usually to their least able members i.e. Infrastructure.



SMS comes with no quality of service guarantees - in fact it's store and forward at its worst. As an example, people frequently encounter difficulties with SMS traffic each New Year or in crowded venues. Occasionally, you'll get an SMS message that has been significantly delayed too.

Policy.HR.Ethics

Index

Overview
Purpose
Scope
Policy
Conflicts of interest
Honest and ethical conduct
Corporate opportunities
Confidentiality
Treating stakeholders fairly
Employees
Protection and proper use of assets
Compliance with laws, rules and regulations
Compliance with this code
Interpretation of this code
Policy class hierarchy
Enforcement
Ownership and maintenance
Copyright

Document Status and Revision History

New policy - written 2008

Overview

"Your Company Name" is committed to conducting its business in accordance with the applicable laws, rules and regulations and with the highest standards of business ethics.

All employed in the company must not only comply with the applicable laws, rules and regulations but should also promote honest and ethical conduct of the business. They must abide by the polices and procedures that govern the conduct of the company's business. Their responsibilities include helping to create and maintain a culture of high ethical standards and commitment to compliance, and to maintain a work environment that encourages stakeholders to raise concerns for the attention of management.

Purpose

This code is indented to provide guidance and help in recognising and dealing with ethical issues, provide a mechanism to report unethical conduct and help foster a culture of honesty and accountability.

Policy

Conflicts of Interest

These can arise from:

• the receipt of improper personal benefits as a result of one's position in the company (including benefits for family members)
• an outside business activity that detracts from an individuals ability to devote appropriate time and attention to their responsibilities in the company.
• The receipt of non-nominal gifts or excessive entertainment from any person or company with which has current or prospective business
• any significant ownership interest in in a supplier, customer, development partner or competitor of the company.
• any consulting or employment relationship with any suppler, customers, development partner or competitor.

All employed by the company should be scrupulous in avoiding conflicts of interest. Where there is likely to be a conflict of interest, the person concerned should make full disclosure of all the facts and circumstances to the board of directors or the the committee or officer nominated for this purpose and prior written approval be obtained.

Honest and Ethical Conduct

The directors, officers and employees shall act in accordance with the highest standards of personal and professional integrity not only on the company's premises but also at company-sponsored business, social events and in their personal lives.

They shall be free from fraud and deception.

They shall always conform to the best standards of ethical conduct.

Corporate Opportunities

All have a duty to the company to advance its legitimate interests when the opportunity arises.

Directors, officers and employees are expressly prohibited from

• taking for themselves personally, opportunities that are discovered through the use of the company's property, information or position.
• competing directly with the current business of the company or its likely future business.
• using company property, information or position for personal gain.

If the company has made a final decision not to pursue an opportunity, an individual may follow it up only after disclosing the same to the board of directors or to the nominated committee or individual.

Confidentiality

All shall respect confidential information on the company, any of its customers, suppliers or business associates. Disclosure of such information should only be made where authorised or required by law.

The use of confidential information for personal gain is strictly forbidden.

Treating stakeholders fairly

All employees at all levels should deal fairly with those we do business with. No-one should take unfair advantage of anyone through manipulation, concealment, abuse of confidential information, misrepresentation of facts or any other unfair dealing practices.

Employees

The company will not tolerate discrimination on any grounds whatsoever. All employees will be treated fairly and given the opportunity to grow and develop within the company. Promotion will be on merit. Bullying or harassment is regarded as a serious offence and will not be tolerated.

Protection and proper use of company assets

Everyone has a duty to protect the company's assets and ensure their proper use. Theft, carelessness and waste of the company assets damage profitability. These assets should only be used for legitimate business purposes.

Compliance with laws, rules and regulations

All employed by the company shall comply with all relevant laws, rules and regulations. All employees at all levels are expected to know how these laws and rules apply to their area of decision-making. In the event of any uncertainty, the employee concerned should consult the company legal department before taking action.

Compliance with the code

If any person suspects or knows of a violation of this code, they must immediately report the same to the board of directors or the designated committee or person. The company has a "whistle blowing policy" or to give its formal title, Public Interest Disclosure Policy that will protect their anonymity. Details of the policy are available on the intranet via the preceding link.

Violations of this code will result in disciplinary action and, in some cases, dismissal. Full details of the disciplinary procedures and the appeal processes are included on the intranet.

Interpretation of this code

Interpretation of this code is reserved for the board. The board may appoint a designated committee or designated person to act on its behalf in interpreting and clarifying this code.

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Policy Class Hierarchy

Class

Policy.HR.Ethics

Procedures

None

Standards

None

See Also

None

Ownership and Maintenance

This policy is owned by the Head of Information Security at and is revised on an annual basis.