Alan Calder on IT Governance, information security & ISO 27001

Commonly accepted best practice on password security is that passwords should be complex, changed frequently and never written down. Password complexity (8 alphanumeric characters, case sensitivity plus special characters) increases the level of difficulty associated with cracking it; password change regularity decreases the likelihood of the password, having been inadvertently revealed, being improperly used. The easiest way into a computer or network is, of course, via the password that has been written down and is stored somewhere convenient - on a post-it note under the keyboard, behind the screen or in an unlocked drawer….

And, of course, the more complex the password, the more frequently it has to be changed, the more likely users are to forget it - and to write it down. And we’re not just talking about business users here: our experience is that many seasoned IT and information security professionals resort to writing passwords down - not least because we increasingly combine regularity of change with increasing volume of passwords, each of which have different rules.

And it’s the different rules that make it difficult for one to use one strong password in all the applications and websites to which one has access.

So, there’s the information security manager’s dilemma when dealing with user system access - enforce frequent password changes, enforce complexity, block reversions from new to old passwords, block password sequencing and all those sensible things, and you increase the likelihood of passwords being written down thereby potentially making unauthorised system access even easier.

The solution, for me, is to insist on password complexity - but to enforce change only irregularly - certainly no more than once a quarter - and, perhaps, no more frequently than once per year.

The Data Protection Act (’DPA’) in the UK is a cornerstone of IT and information-related legislation. It applies to all organisations that collect or hold information about living individuals. Most organisations would claim that they comply with the DPA. The reality is that many don’t - over 800 organisations have reported data breaches in just the last two years - and as, reporting data breaches is not a legal requirement, it is likely that there have been many more breaches similar to those described here, but which have been ’swept under the carpet.’

The Information Commissioner (ICO) will, from 6 April 2010, have the power to levy fines of up to £500k for serious breaches of the DPA. Which organisations will suffer the first fines?

For all organisations, the choice is clear and straightforward: continue with shoddy data protection practices and face potentially significant financial penalties, plus the wide spread press coverage that will attend such a fine, or take steps to improve those practices. There is, in fact, a good business case to make for doing exactly that. The ICO has just published The Privacy Dividend, which describes how to make the business case for the necessary investment and even includes - for free - all the documentation that an organisation might use as part of that business case.

Penalty or dividend? 

It shouldn’t be a hard choice, should it?

It is certainly true that most of those involved in the creation of IT standards are from large organisations. It is also true - as Steve Burrows says - that it can be challenging for an SME to implement a standard such as the ISMS standard, ISO/IEC 27001, for information security management.

However, all standards are explicitly designed for organisations of all sizes. ISO/IEC 27001, for instance, is clear that its requirements should be implemented in a way that is appropriate for the organisation; certainly the selection of controls will be driven by a risk assessment and, if the management of an SME has a high appetite for risk, it won’t find itself selecting many controls.

The reality is that all organisations are subject to similar types of risks; an impact (like the loss of a server for a week) that could severely disrupt an SME might not even bother a larger, multinational organisation. Organisations need to select and implement controls that will protect them from impacts they wish to avoid - and the management system they put in place will be very similar to that put in place by a much larger organisation to manage much larger impacts.

The issue isn’t really the IT standards; the real issue is the resources that SMEs have available to tackle them. Few SMEs will have the capability to plan and carry out an appropriate implementation of something like an ISMS - which, of course, is why we developed our FastTrack ISO27001 Implementation Service for organisations that have 19 employees or fewer, and why our classic consultancy service (with its 100% guarantee) is helping more and more SMEs implement appropriately scaled information security management systems that enable them to cost-effectively meet customer compliance requirements and to challenge larger competitors in their space.

I’ve always thought organisations that sell their ’software solutions’ entirely on the basis of Fear, Uncertainty and Doubt should on principle be shunned by all right-thinking CIOs and IT managers. Of course, there is a certain amount of FUD that software solutions have to combat, but sales should primarily be made to deliver quantifiable returns on investment (and I recognise that is not always an easy calculation).

It’s therefore a pleasure to see that Microsoft and Washington State’s Attorney General have filed lawsuits against scam artists who frighten consumers into buying useless software, and I hope these scam organisations are stopped.

The scary message, though, is this: ‘A recent report from North Carolina State University showed that most internet users are unable to tell the difference between genuine and fake pop-up messages. “This study demonstrates how easy it is to fool people on the web,” said co-author Dr Michael S Wogalter, professor of psychology. Despite being told some of the messages were fake, people hit the OK button 63% of the time.’ 

In other words, FUD will sadly be an effective sales tactic for so long as people allow themselves to be duped. Awareness and training become an ever more essential aspect of preparing people - consumers and employees - for what they will find on the Web.

The recently launched ‘Aligning Cobit, ITIL and ISO 17799 for Business Benefit‘ is a welcome step toward making IT governance more usable for most organizations. There has long been confusion over which of these three frameworks is really an IT governance framework; for an equal length of time, the answer has been that each is a component of such a framework, as I proposed in IT Governance Today: a Practitioner’s Handbook earlier this year.

While I’m delighed at this progress, there is (as I’ve already argued) further still to go in integrating and simplifying IT governance frameworks, and I will be taking this further in the 2nd edition of the Practitioner’s Handbook when it is published early next year.

2005 will be the year that more organizations crash and burn through inadequate information security and IT governance practices - more IT projects will go wrong, more malicious incidents, more organised crime frauds and some serious terror attacks, along with even more viruses and increasingly clever spammers - remembering that 80% of organizations never recover from a serious business interruption (fire, fraud, terrorism, etc), the turn of the year is a good time to re-think security postures.

The revised and updated ISO 17799, due out in Spring 2005, will not, on its own, save many organizations - what will save organizations is directors and boards making a conscious effort to put information security on their board agendas and to keep it there throughout the year - and keep it there while they make sure that their organizations are tackling IT projects and information security strategically and systematically.