Beating IT Risks

The police service is now moving ahead with a clear picture of the priorities for investment based on a comprehensive understanding of the business impact of system outage. Systems understood as critical and designated as ‘Premium’ will receive proportionally more attention and effort from IT staff throughout their lifecycle to ensure effective DA–DR capability that meets business needs is built in from day one and maintained in operation.

Printed with permission of PA Consulting Group

6 Information assets

Opening salvo . . .

CD Universe had about 300 000 customer credit-card records stolen by a hacker who then attempted extortion. When the hacker’s demand was not met, the hacker posted about 25 000 of the credit-card details on the Internet (AFR, 2000). Those customers then had to cancel the cards and face significant disruption.

Without examining the details of that particular case, it raises many questions for you and your organization. Just for tasters:

•What is the chance that this could happen to you?

•What sensitive data do you have? Is it attractive to outsiders? What if it is broadcast?

•What percentage of the affected customers would you expect to lose permanently?

•How much security have you got? Is it enough?

•What laws would you potentially break?

•What’s the cost of the fix after the event compared with before, if indeed it can be fixed?

One of the outstanding features of such examples is that the relationship with a key stakeholder – here the customer – can be seriously impacted by a technical inadequacy deep in the techie’s mystery zone. How can management deal with this?

The next example shows that it’s not just the Internet that creates information asset issues, it can be quite mundane.

. . . and while you’re down . . .

A local government organization transferred a database from an old system to a new system, but the data became corrupted. Unfortunately the corruption was not immediately detected, which made restitution very difficult. In this case the customers were asked to send in their copies of records so that the database could be rebuilt.

ownership of both types of assets generates the capacity to deliver value or benefit. But information assets can be duplicated for a negligible cost, which is where the problem starts. Valuable physical assets will typically be located in a few identifiable locations and the potential for physical access security – locking them up – is both technically and financially feasible.

The US General Accounting Office identifies information assets as critical national infrastructure (GAO, 2003). Their report highlights the considerable array of high-risk assets. The issue has become so important that the US Government has enacted specialist legislation to mandate protection of key assets.43

Information assets, on the other hand, will be highly distributed about the organization – every document, file and data storage device is part of the asset. Documents are readily copied – as they need to be so that people can do their work. Information assets are both key inputs and key outputs of many business processes. In many organizations, information assets are not formally recognized, evaluated, stored or managed. We need access to information within the organization to carry out business processes, but it is seldom restricted to those who ‘need to know’.

The ‘availability’ paradox

Information assets must be available to the ‘good guys’ but not available to the ‘bad guys’. Availability is essential but it carries great risks.44

We can, and frequently do, control and restrict access to information assets that are held in computer systems by simple security systems such as passwords but paper documents are seldom controlled with an equivalent rigour. Ask yourself a simple question, ‘Is there a default paper document classification that is broadly known around the organization?’ Do all staff know whether an unmarked (unclassified) document is for internal use only or for public consumption? What does ‘confidential’ mean? How about ‘restricted’? But the absence of defined standards does not mean that everything needs to be made ‘secure’. In the same way, data held in IT systems varies between the mundane and the most valuable. A one-size-fits-all password system is not enough.

The impacts of information asset exploitation

Information assets are developed directly and indirectly in many of the processes of an organization. They are there to be used productively for the organization’s

43The Federal Information Security Management Act of 2002.

44Besnard and Arief (2004) research considers security and legitimate use trade-offs from a cognitive perspective. Legitimate users place a higher priority on usability than security and seek ‘good enough’ solutions.

be corruption, but the impacts on the organization represent the situation that management will have to deal with. This section explores four dimensions of impacts: exclusivity, costs, replacement and confidentiality.

Loss of exclusive use

Exclusivity is an essential dimension in the valuation of an asset. A private beach is quite different from Bondi, Brighton or Santa Monica. If you have exclusive use of information you can license it and generate revenue, or choose not to license it and derive the maximum benefit for your own organization. When another organization has access to your information assets, they are able to gain benefit similarly.

With a physical asset, you should know when someone is using it or has taken it. However, with an information asset, you may not be aware that you are sharing it – in some ways this is worse than knowing.

Direct benefit of the exploitation to the perpetrator

The benefit to the perpetrator is a cost to the victim, whether direct or indirect. Advanced knowledge on company performance, mergers and acquisitions and strategic initiatives allows informed, beneficial actions on stocks and shares, for example. The benefit obtained is at the collective cost of those in the organization and others without the information. The data thief has the opportunity to make greater benefit from it than its guardians, both directly in their own enterprise and indirectly through the damage to the owners.

Time, energy, goodwill

When you realize that you’ve been invaded, that the assets have been accessed, at best there will be a delay while replacement assets are built. The effort that goes into this could have been put to more valuable use elsewhere. Even the decision of whether to replace or not takes some time. When the milk is spilt, a decision has to be made whether you want milk this time around.

Building a replacement information asset can be a significant effort, especially if it needs to be done in a way that cannot be plundered again. The electronics company whose R&D team hijacked an innovative product design for extortion faced the need to develop a new product as the original could now be pirated too easily. This would mean establishing a new R&D team, getting the marketing people to work with them to create a new product concept, and working through the full development cycle.

Loss of confidentiality

If you are the guardian of information that is important to others and you let them down, how can that impact you?

Even unauthorized access to read-only data by police officers destroys the integrity of the data. A valued resource becomes one that is tainted by its misuse. In this case there is no loss of data. The risk concerns the reputation of the organization that has been damaged by the breach of confidentiality.

There are many situations where our private data is given to government in accordance with its authority. The abuse of this, whether by design or malfeasance, damages the organization and persuades the clients that their trust is mislaid. Comprehensive audit trail applications are now used to capture every keystroke and mouse action in such critical applications.

‘Confidentiality’ is used as the generic term to describe any example where information assets are exploited by anyone other than the intended users. While in many cases the power of the law is on the side of the owners, this is of little comfort when there is little likelihood of extracting suitable compensation from the offenders.

The impacts of degraded information assets

The most obvious degradation of information assets occurs when they are totally, irrecoverably lost. It’s conceivable that hundreds of laptops are stolen each week in most of the major cities of the world and quite likely that some of them have useful, valuable or even critical information on them. The value of that information to others was dealt with in the section above, but even if it is completely password-protected and encrypted, we still face a loss if there is inadequate back-up.

Back-ups have been used since the earliest days of IT, when the inherent unreliability of the hardware necessitated rigorous copying of data, and the frequent use of the back-up store in a recovery process. Now that reliability is dramatically improved, we are less likely to use the data restoration facility

– which explains the common reality that restore or recovery doesn’t work satisfactorily.

But degradation is not simply about loss of data; it includes the accidental and deliberate corruption of records that can take place in many ways. Degraded assets can destroy an organization. If your organization’s financial records have been systematically distorted, as with Barings Bank, there may be nothing left.

Loss of integrity can occur at any stage of the lifecycle. In the State of Victoria in Australia the speed cameras have been proven unreliable in capturing and recording data. In May 2004 the government announced that almost 165 000 motorists caught by fixed speed cameras will have their fines waived or be paid compensation, costing the state government A$26 million (Age, 2004).

Somewhere in AT&T’s systems, errors have crept in, manifesting themselves in erroneous customer bills. Typically, individual retail telephone customers are unable to threaten giants such as AT&T and rely on a ‘goodwill’ response, or quietly fuming take their business elsewhere. The state of Florida, with Attorney General Crist leading the charge, is a more effective consumer advocate. In a May 2004 media release Crist is quoted as saying, ‘We will be relentless and unyielding in our fight against AT&T on behalf of consumers until all appropriate damages are recovered.’ With up to one million customers impacted and up to US$10 000 restitution being sought for each allegation of wrong billing, this is a serious information integrity issue.

Repair cost

The cost of rebuild or repair to a database can be significant. A local government authority faced the cost of buying a replacement ancient mainframe computer – one of only two still in operating condition in the world – as a necessity in order to convert a back-up tape to a common format. It was not in the best negotiating position. The old non-IBM mainframe had a proprietary data format that could not be read by other machines. In order to rebuild its database of ratepayers, it needed the collection of data that was now held only on the back-up tapes. The entire computer centre – with mainframe – had perished in a major fire. If the back-up tapes had been written in another format, that dimension of the expense would have been spared (Fitzgibbon, 1998).

But, even if the rebuild is easier, a comprehensive audit is needed to establish the integrity of the data. This involves both cost and time.

Opportunity cost

All the time and expense that is involved in fixing the impacts created by the use of invalid data, finding and identifying errors, rebuilding and then validating the data, could all have been used profitably. Using up staff and customer goodwill on something as unproductive as rebuilding a database is not anyone’s first choice. Even time and effort taken in filling out an insurance claim is not the best use of the organization’s resources.

‘Loss of integrity’ is the generic term used to describe any example where information assets have been degraded, whether intentionally or unintentionally. The value of an information asset depends to a great extent on its integrity,

•The criminal mind46 – a comfortable livelihood can be made if delivery schedules can be intercepted, or data can be sold to competitors.47 If you were a criminal, how many opportunities for gain could you identify in your organization? The 2004 surge in ‘phishing’48 shows that there are other objectives for spam.

•The competitor mind – imagine a competitor is walking around your organization and finds a logged-on, ready-to-go computer system, what could they do? What would be the most valuable data to them?

•The customer – privacy legislation in many jurisdictions now permits the individual customer (or client) to gain access to their own data, but sets severe penalties if others’ information is retrieved. Yet information about others is potentially valuable (credit-card details, for example) or simply of enormous curiosity value. A business customer may be extremely interested to know its supplier’s cost prices and discount policies.

•The employee – devil or angel, in-between, or variable? Even the most rule-abiding employee can imagine data that they would ‘love to know’ – their manager’s salary or performance appraisal, or a flame’s age, status and home address. In the normal course of events, employees seek employment elsewhere and will need to ‘feather their nest’ in the new job, perhaps with a customer list, price list or even new product release schedule. But aggrieved employees have many opportunities (see www.internalmemo.com, or other rumour mills for example).

•Anyone can be a ‘hacktivist’ – a hacker with a mission. An organization’s manufacturing locations, hiring policies, perceived social or environmental impact, or pricing practices can inspire some individuals or groups to distribute the ‘truth’. Moral outrage is not confined to anarchists and libertarians – passing on real data is much more satisfying than unconfirmed rumours.

This crowd of attackers will have various means and divergent motivations: some willing to die for the cause, others simply spending a quiet evening at home on a ‘hobby’.

Typical approaches to confidentiality are access control methods based on need-to-know user profiles and hard-to-crack passwords, restricting data to particular computers or networks, physical access restrictions and dongles (security

46The CSI/FBI survey (2003) provides statistics on the frequency, distribution and impact of computer crime. In total, the 251 organizations surveyed reported annual losses of US$200 million. The theft of proprietary information caused the greatest financial loss with the average reported loss of approximately US$2.7 million. Virus incidents (impacting 82%) and insider abuse of network access (80%) were the most cited forms of attack or abuse.

47The definition of what exactly cybercrime is and how multiple jurisdictions must work together to combat it are current topics of great interest to legislators (Pounder, 2001).

48Seeking log-in data by creating websites that mimic others’, and gaining access to their accounts.