It’s so easy to get caught up in the protection of data (or lack thereof) that it is easy to forget about the other primary goal of information assurance–getting correct information to the right place in good shape, accurately and on time, to preserve the confidence of the public in government’s ability to manage its own affairs.

“THOUSANDS of servicemen and women, including many fighting on the front line, are being underpaid because of failures in a new computerised pay system.”

…”The computer system, known as Joint Personnel Administration (JPA), was introduced in March last year in the Royal Navy and saw a flood of complaints from sailors not being paid their full pay. The RAF was taken on to the system in October last year, followed by the Army in April this year. The £250m system was implemented by EDS, which was widely criticised for its computerisation of the Child Support Agency.

One of the key problems with the system is that it requires senior officers to log in to authorise payments, which means that if they are away on operations, the whole procedure grinds to a halt. “The system is based on the design for a civilian pay system and takes no account of the complexities of the armed forces pay system,” one officer said.”

It’s a good thing that the British are so patient–these people are armed. It’s a very bad thing that we can’t get JPA right–ADP would have taken this on as an outsourcing project for a lot less than £250 million.

Last week I attended a discussion on “Galileo – is it worth it”, hosted by OpenEurope at the House of Lords committee rooms.

Lined up was:

Richard Peckham, Business Development Director (UK), EADS Astrium
Peter Brookes, Senior Fellow, National Security Affairs, The Heritage Foundation (former Deputy Assistant Defence Secretary in the George W. Bush Administration)
Dr. Stephen Ladyman MP, former Minister of State for Transport
Bernard Jenkin MP, member of the House of Commons Defence Select Committee, former Shadow Secretary of State for Defence

Not sure that I learnt much as all played to form. The industrialist took the industry line (EU should invest €2.1 billion), Tory politician (EU waste of money), Labour Politian (wanted it stopped but couldn’t quite say so), Ex US Politian (don’t undermine NATO and don’t trust the Chinese - see here)

It seems that unless there is a political carve up it’s “doomed”. The most interesting part of the discussion was on the impact of loss of GPS (failure or executive switch-off). There is general agreement that loss of GPS would be disastrous for the EU and US economies (and others presumably) and therefore the US Administration would never switch it (the open access bit) off. OK then, if it’s that important then why don’t we need a back up! I think a trick was missed here and should have been explored further.

It’s well documented that GPS is easy to jam and goes wrong and as I said in a recent post the continuity of service is possibly the only remaining defensible argument for continuing with Galileo.

Hi all, sorry I haven’t been here to bother you for the past two days.

I’m giving a 20-minute talk at an event tomorrow on IT Security Implications for Network Convergence. Here are my notes–what did I miss?

Implications of Network Convergence

Have we had the right conversations about the right issues?

 Convergence is enabled by technological change, but is not driven by it. The drivers of convergence are mainly commercial.
 Convergence affects not just telecommunications and broadcasting. The scope of convergence is the entire knowledge and transaction-intensive services sector;
 Convergence is structural in nature, but changes to industry structure are the most profound changes associated with it
 Would anybody here wager that all of the commercial sponsors of this event will all have the same corporate governance in 2 years’ time?

Real World Effects of Network Convergence

Lesser Effects
• Fewer network owners (oligopoly), less responsive?
• May require more regulation as a result
• May decrease options for network users
I call these lesser effects because in many countries the regulatory framework exists to effectively deal with these issues—we don’t have to invent ways of treating oligopolies or organisations to protect consumers.
Greater Effects
• Currently, the Internet treats all traffic equally. In future, converged networks will be able to pick and choose messages and send them to recipients more quickly and efficiently based on their value to network owners. It is possible that network owners will make perfect decisions regarding priorities, and that those decisions will align with their commercial needs. Possible, but not too likely
• Convergence on IP networks may render other networks redundant. Sky may not need as many billion pound satellites, choosing to use IPTV to distribute content. BT may finally be able to offload their very expensive business of maintaining copper connections to home and business, and just provide wireless connections to all. Bear in mind that BT would love this, in terms of reducing costs. Television and radio broadcasters may choose to cease terrestrial broadcasting in favour of using the Internet.
o The Internet was invented to be a back-up system to radio and telephone communications in case of a disaster. If the back-up system becomes the only system, what do we do if the network goes down?

IT Security Issues

Network Failure and Degradation
One problem with converged networks and the service-oriented architecture that tends to support them is that the majority of large networks are poorly understood. Traffic has typically been added piecemeal over a long period and much data communication does not require particularly high standards of service.

This is especially true of service-oriented architectures (SOA). Ambitious developments in this area have led to a situation where the precise communications flows are not well known. As this kind of architecture is often built to be tolerant of high latency and lost packets, nobody is aware of issues until the network is subjected to new stresses. Services such as VoIP, Citrix-style thin clients or video are not at all tolerant of low quality networks.

Question 1: Have we designed a ‘Fail and Fix’ into our approach to network problems?

When it comes to security, there are three main areas of focus: Unauthorized access to data and resources (which is where access control and encryption come in); Malware (such as viruses, spam.); Compliance with government and industry regulations.

Question 2: Are these the right areas of focus in 2007, and will they be the right areas to focus on in 2009?

Typically, security is controlled by PINs and access numbers, which, depending on the vendor, can often be customized to a wide degree, and SSL 128‐bit encryption. Organisations can add more layers, depending on their needs and the ability of the applications to accept it. Convergence applications require security in three key areas: user access, data protection, and delivery security.

Those components have been turned into a new discipline, or field of endeavour, called Identity Management. It is new. Standards and agreements on interoperability are still under discussion.

Question 3: Is Identity Management as a concept and practice robust enough to be the linchpin for converged networks?

Those are my 3 questions. What are yours?

Here’s our preliminary assessment of the main categories of emerging technology issues, along with an impact rating. Each is discussed in more preliminary detail on the Blindside Wiki. We will be reporting to the Cabinet Office in mid-July on those that assessed as having an impact level of 3, and need full expert descriptions by that date.

This is your chance to tell us we’re on the wrong track: to add stuff; to argue that somethings missing, over-rated or under-rated. Don’t miss it!

Category Impact (from 3/high to 1/low)
————————
CCTV 3
Convergence 3
Location-based services 3
Mobile and Pervasive Computing 3
Open Standards 3
Anonymity 3
Data breaches 3
E-Voting 3
Human rights (intersection with emerging technology) 3
Identity management 3
NHS IT 3
Non-bank payment service providers 3
People and IT 3
Mission Critical Legacy Systems 3
Rampancy: AI gone wrong 3
Surveillance society effects 3
Semantic Web 3
Self-reproducing technologies: the “GRINs” 3
- *Geno- 3
- *Robo- 3
- *Info- 3
- *Nano- 3
Social media 3
APIs 2
Bandwidth - massive wireless and cable bandwith to the home 2
Shared Service Management 2
Ultraportable devices 2
Automated number-plate recognition (ANPR) 2
Bad sysadmin procedures 2
Bad procedures - other 2
Changes to daylight saving time in the US 2
Public sector databases on children 2
Keyloggers 2
Phishing 2
Phones as bugs 2
Technologies for Non-Repudiation 2
Underground economy servers 2
Unencrypted email 2
Biometrics - unencrypted 2
Windows Vista and other operating systems 2
Government IT projects 2
DNA terrorism 2
On demand computing (ODC) 2
Grid Computing 2
Quantum Computing 2
plus in the lower impact categories (please use the search box if you want to add to these):
Aeronautical cabin services 1
OpenDocument 1
Service-oriented architecture 1
APIs that change without warning 1
Cybercrime 1
Electronic banking 1
Fraud Websites 1
Search Engine Logs 1
Spam 1
Computing Monoculture 1
DRM and its side-effects 1
Environmental side-effects 1
Exploding Batteries 1
Optical Computing 1
User-generated content 1
Virtualisation 1
Generation C - the knowledge nomads 0

Thank you for any help, comments, suggestions.

This article found on Yahoo mentions Hewlett-Packard’s purchase of SPI Dynamics, but there’s been a lot more.

The article states, “Last year IBM spent $1.3 billion to pick up Internet Security Systems Inc., while data-storage giant EMC Corp. shelled out $2.1 billion for RSA Security Inc. Not just computing companies are interested: last year telecommunications carrier BT Group PLC bought network monitor Counterpane Internet Security Inc.”

What are the public policy implications of this? BT has many UK government clients, as does IBM. Are there conflicts of interest in this? Will certain security systems work better with their parent companies’ technical solutions than with their competitors? Has the public sector had a chance to secure covenants regarding this? Do existing contracts with UK government have the appropriate clauses to protect them (and us) from normal commercial competitive practices?

The chaotic present and hopeful future of information systems exists in a microcosm about 30 minutes by tube from my flat, and I daily watch a stately procession of airliners descending to Heathrow Airport, a beautiful, if not quite silent, parade. It is at Heathrow airport that the current need for better performance on every topic covered in this blog is demonstrated. It is a non-sterile testing environment and the ultimate pilot project to test the ability of information systems and information assurance to integrate modern technology to meet the needs of a mass public. You may have noticed that I ticked every category we use in assigning this blog post its proper place in our own information hierarchy. It’s not a coincidence.

Let’s walk through the daily issues faced at Heathrow from an information standpoint:

1. About half of all tickets to fly are booked via the Internet, and that information must be completely available to several very different systems immediately and be perfectly accurate.
2. Parking systems must provide availability, administrative and financial information.
3. Public transportation systems must send and receive useful information about current operations and schedule changes, and receive and use similar information from several different airport systems.
4. The logistics of welcoming, feeding, watering and moving 67.7 million people per year (and taking care of 70,000 employees) are an interesting challenge, as is maintaining 48,000 square metres of retail space. Private security, first aid, tourist information, all of these have information issues attached.
5. Oh yes–core business–mustn’t forget–90 airlines, 186 destinations, 469,000 ‘air transport movements’ (er, would that translate to flights in English?) annually. Information requirements include weather at each destination, status of all airports and traffic, passenger information (but more on that below…)
6. On-time status of flights relating to connecting flights.
7. Correlating information from HMRC (well, more the C part than the R) with the Home Office (now with both parts of the newly divorced members of what was once one) and probably discreet communications with agencies using numbers as well as initials.
8. Communicating with the Civil Aviation Authority, National Air Transport System, HM Immigration–of course I’m sure they all use the same electronic forms that grab data smoothly from Heathrow systems… right?
9. Communicating with the media–and having the capability of communicating with international media
10. Having co-ordinated disaster preparedness programmes that are up to date as well as up to snuff.

Probably missed half a dozen supremely vital information systems there… but it’s Sunday morning, so it’s okay. (Did somebody say baggage?)

Lots of things to go wrong there. Amazingly, not much does. (Did somebody say baggage–again?) That’s why when things do go wrong it’s news.

Notice they don’t have an uber-contractor trying to integrate all systems and dictate technology standards and usage. Strange, that. And I’ll bet they often use trainer-net(where some employee puts on trainers and walks information to diverse destinations). But that’s how functional communities develop–and despite grumbling and glitches, Heathrow functions as an information community: People get to destinations, planes don’t fall out of the sky. Successful information communities do seem to develop from the ground up, not the top down.

I guess the point I’m trying to make is that information systems and information assurance issues develop in an ecosystem not a vacuum. Complexity in information management is probably a geometric rather than arithmetic function relating to the number of actors involved. And yet don’t we often see government requirements for information systems that are internally oriented and indeed self-referential? The box must be this big with holes here and here, and those holes must be guarded in this way. I think more than anything else, government’s inability to get value for money from IT investment is based on this issue.

Please feel free to contribute complaints about Heathrow in the comments–I’ve suffered there myself. My praise is directed at a higher level, at finding a community that functions. Your nominations?

As this event is getting closer to hand, I am reposting William’s discussion of it from last month.

Update: You can now register online by clicking here, or here or by emailing the rather miraculous Susan Pickrell at susan.pickrell@kable.co.uk.

What are the essential unanswered questions for the UK about ID infrastructure, government’s role and its effect on business and consumers? What are the opportunities for unlocking value, wealth creation, efficiency and what are the threats to privacy and public trust?

The DTI is planning a get-together to start the process of looking at this on 9 July. There are important questions still out there, and DTI has allocated £10m for research projects to look into them to get answers starting from the autumn.

This isn’t a re-run of the ID card policy debate. We live in a democracy, Parliament has spoken, and those who want Parliament to speak again and say something different next time have to go through those channels. That’s Home Office/IPS’s patch anyway, and they are co-sponsors of the get-together. So the approach is, taking the work of IPS as a given in this landscape, what are the great known unknowns, including areas like privacy and consent.

Let’s go into the ID-enabled future with our eyes open. DTI will particularly welcome attendance at this event from people interested in undertaking the research work.

If you’re interested in coming email your details to editor [at] blindside .org.uk for now; online registration will be available soon.

We have a new Security and Resilience Industry Suppliers Council (RISC - see Intellect press release or SBAC press release). Says chair Stephen Phipson:

“Through the formation of RISC the UK security and resilience sector will act as one, in concert with government, to deliver a significantly fortified frontline of security and resilience.”RISC is an alliance of suppliers, trade associations and academics. It provides a single industry voice and channel of communication for government on strategic issues affecting national security and resilience. This will foster unprecedented industry-government partnership and dialogue to counter international and domestic terrorism.

The Spy Blog takes a characteristically dim view of this.

If we could say our IT trade association had a tragic flaw, it would be its inability to ensure that what its members deliver actually meet customers’ or end-users’ needs. It doesnt even seem to show any interest in the idea, and the consequences in public-sector IT continue to be problematic.

The RISC might well fall into the same pattern.

It can’t make the world a safer place by creating a spirit of military-industrial cosiness and selling taxpayers more technology. It’s the human dimension of security that matters most. It’s not clear from what we see so far which RISC member would speak up to that effect.

This could be a case of government procurement muscle used to effect changes in the supply side. From Techworld

The US federal government has launched a programme that will require federal agencies to insist on security standards from suppliers, a move that some argue will have a far-reaching impact on most large and medium-sized organisations buying PCs.The government confirmed the move in a memo late last month and will roll the programme out in several stages during the course of this year. By 1 February of next year, all federal agencies will be required to use secure software configurations when they deploy Windows XP or Vista.

The scheme matters to the outside world because software suppliers who want to sell to the US government will have to certify that their equipment works on operating systems set up to work securely, said Alan Paller, director of research at the Sans Institute security research centre, in a recent memo.

Currently organisations never know if securely configuring Windows will break their applications. The new US government programme could make things simpler for IT managers by providing clearly understood standard security configurations that are backed up by the federal government’s purchasing power, Paller said.

“It provides the incentive ($65bn/£33bn) in US government IT purchasing each year, and confidence (agreed upon configurations), to allow every software vendor to ensure and affirm the software they sell works on the secure configurations,” he wrote. “That takes the pain out of secure configuration and rapid patching.”

Paller said secure configurations could slow the spread of botnets, reduce patching delays and stop many attacks directly.

“This initiative will affect every medium and large buyer of computers running Windows software,” Paller wrote.

The White House memo is here