Archive for the 'insider attacks' Category


Also see the insider attacks category on the Blindside Wiki

The emerging issues and their impact - a preliminary assessment

Here’s our preliminary assessment of the main categories of emerging technology issues, along with an impact rating. Each is discussed in more preliminary detail on the Blindside Wiki. We will be reporting to the Cabinet Office in mid-July on those that assessed as having an impact level of 3, and need full expert descriptions by that date.

This is your chance to tell us we’re on the wrong track: to add stuff; to argue that somethings missing, over-rated or under-rated. Don’t miss it!

Category Impact (from 3/high to 1/low)
————————
CCTV 3
Convergence 3
Location-based services 3
Mobile and Pervasive Computing 3
Open Standards 3
Anonymity 3
Data breaches 3
E-Voting 3
Human rights (intersection with emerging technology) 3
Identity management 3
NHS IT 3
Non-bank payment service providers 3
People and IT 3
Mission Critical Legacy Systems 3
Rampancy: AI gone wrong 3
Surveillance society effects 3
Semantic Web 3
Self-reproducing technologies: the “GRINs” 3
- *Geno- 3
- *Robo- 3
- *Info- 3
- *Nano- 3
Social media 3
APIs 2
Bandwidth - massive wireless and cable bandwith to the home 2
Shared Service Management 2
Ultraportable devices 2
Automated number-plate recognition (ANPR) 2
Bad sysadmin procedures 2
Bad procedures - other 2
Changes to daylight saving time in the US 2
Public sector databases on children 2
Keyloggers 2
Phishing 2
Phones as bugs 2
Technologies for Non-Repudiation 2
Underground economy servers 2
Unencrypted email 2
Biometrics - unencrypted 2
Windows Vista and other operating systems 2
Government IT projects 2
DNA terrorism 2
On demand computing (ODC) 2
Grid Computing 2
Quantum Computing 2
plus in the lower impact categories (please use the search box if you want to add to these):
Aeronautical cabin services 1
OpenDocument 1
Service-oriented architecture 1
APIs that change without warning 1
Cybercrime 1
Electronic banking 1
Fraud Websites 1
Search Engine Logs 1
Spam 1
Computing Monoculture 1
DRM and its side-effects 1
Environmental side-effects 1
Exploding Batteries 1
Optical Computing 1
User-generated content 1
Virtualisation 1
Generation C - the knowledge nomads 0

Thank you for any help, comments, suggestions.

Cue Bob Hope–Thanks… For The Memory

Posted by Tom Fuller in Blindside project, Data breaches, insider attacks, security services at June 23rd, 2007

I’ve posted before on the implications of computer memory–I think this one surprises even me.

Advances in memory are important and large organisations need them badly. The average Fortune 1000 company’s storage capacity grew from 198 to 680 terabytes between early 2005 and late 2006, according to this article in the Economist.

So, how long will it be before a disc the size of a CD can hold 300 gigabytes of information? And how long before data transfrer methods reach 160 megabites per second?

Oh. They’re already on the market. Welcome to holographic memory, and innovation pushed by commercial demand for better DVDs.

They’re already working on the next generation, which will pack 1.6 terabytes into the same space. At this level, something old becomes something new.

This royal throne of kings, this sceptred isle, this… Heathrow

The chaotic present and hopeful future of information systems exists in a microcosm about 30 minutes by tube from my flat, and I daily watch a stately procession of airliners descending to Heathrow Airport, a beautiful, if not quite silent, parade. It is at Heathrow airport that the current need for better performance on every topic covered in this blog is demonstrated. It is a non-sterile testing environment and the ultimate pilot project to test the ability of information systems and information assurance to integrate modern technology to meet the needs of a mass public. You may have noticed that I ticked every category we use in assigning this blog post its proper place in our own information hierarchy. It’s not a coincidence.

Let’s walk through the daily issues faced at Heathrow from an information standpoint:

1. About half of all tickets to fly are booked via the Internet, and that information must be completely available to several very different systems immediately and be perfectly accurate.
2. Parking systems must provide availability, administrative and financial information.
3. Public transportation systems must send and receive useful information about current operations and schedule changes, and receive and use similar information from several different airport systems.
4. The logistics of welcoming, feeding, watering and moving 67.7 million people per year (and taking care of 70,000 employees) are an interesting challenge, as is maintaining 48,000 square metres of retail space. Private security, first aid, tourist information, all of these have information issues attached.
5. Oh yes–core business–mustn’t forget–90 airlines, 186 destinations, 469,000 ‘air transport movements’ (er, would that translate to flights in English?) annually. Information requirements include weather at each destination, status of all airports and traffic, passenger information (but more on that below…)
6. On-time status of flights relating to connecting flights.
7. Correlating information from HMRC (well, more the C part than the R) with the Home Office (now with both parts of the newly divorced members of what was once one) and probably discreet communications with agencies using numbers as well as initials.
8. Communicating with the Civil Aviation Authority, National Air Transport System, HM Immigration–of course I’m sure they all use the same electronic forms that grab data smoothly from Heathrow systems… right?
9. Communicating with the media–and having the capability of communicating with international media
10. Having co-ordinated disaster preparedness programmes that are up to date as well as up to snuff.

Probably missed half a dozen supremely vital information systems there… but it’s Sunday morning, so it’s okay. (Did somebody say baggage?)

Lots of things to go wrong there. Amazingly, not much does. (Did somebody say baggage–again?) That’s why when things do go wrong it’s news.

Notice they don’t have an uber-contractor trying to integrate all systems and dictate technology standards and usage. Strange, that. And I’ll bet they often use trainer-net(where some employee puts on trainers and walks information to diverse destinations). But that’s how functional communities develop–and despite grumbling and glitches, Heathrow functions as an information community: People get to destinations, planes don’t fall out of the sky. Successful information communities do seem to develop from the ground up, not the top down.

I guess the point I’m trying to make is that information systems and information assurance issues develop in an ecosystem not a vacuum. Complexity in information management is probably a geometric rather than arithmetic function relating to the number of actors involved. And yet don’t we often see government requirements for information systems that are internally oriented and indeed self-referential? The box must be this big with holes here and here, and those holes must be guarded in this way. I think more than anything else, government’s inability to get value for money from IT investment is based on this issue.

Please feel free to contribute complaints about Heathrow in the comments–I’ve suffered there myself. My praise is directed at a higher level, at finding a community that functions. Your nominations?

The Upcoming DTI Event

As this event is getting closer to hand, I am reposting William’s discussion of it from last month.

Update: You can now register online by clicking here, or here or by emailing the rather miraculous Susan Pickrell at susan.pickrell@kable.co.uk.

What are the essential unanswered questions for the UK about ID infrastructure, government’s role and its effect on business and consumers? What are the opportunities for unlocking value, wealth creation, efficiency and what are the threats to privacy and public trust?

The DTI is planning a get-together to start the process of looking at this on 9 July. There are important questions still out there, and DTI has allocated £10m for research projects to look into them to get answers starting from the autumn.

This isn’t a re-run of the ID card policy debate. We live in a democracy, Parliament has spoken, and those who want Parliament to speak again and say something different next time have to go through those channels. That’s Home Office/IPS’s patch anyway, and they are co-sponsors of the get-together. So the approach is, taking the work of IPS as a given in this landscape, what are the great known unknowns, including areas like privacy and consent.

Let’s go into the ID-enabled future with our eyes open. DTI will particularly welcome attendance at this event from people interested in undertaking the research work.

If you’re interested in coming email your details to editor [at] blindside .org.uk for now; online registration will be available soon.

KPMG’s profile of a frausdster

Posted by William Heath in Humanity nature and activity, insider attacks at May 12th, 2007

KPMG offers us the Profile of a fraudster based on 360 cases of financial fraud in companies.

  • 70% of fraudsters were 36-55 years old.
  • 85% were male.
  • 68% acted independently.
  • 89% were employees ie insiders
  • I guess we can assume the people likeliest to leak our personal details from the IPS’s Identity register would fit a similar profile. KPMG’s research suggests we need to protect our whistleblowers, as they’re the most successful route for revealing fraudsters. So more strength to the arm of that little-known NGO Public Concern at Work.