Gallery

The Government's laughable security strategy

Posted on 29 Mar 2010 at 16:49

Davey Winder despairs of the Government's repeated security blunders - and offers a few obvious tips

Those of us who spend a lot of time in the world of IT security know that there’s no such thing as 100% security.

Sure, it’s a worthy state to aim for, but the reality is that there are no guarantees in this game – and too many possible variants to make any such claim. You can only do your very best to close all doors and lock them behind you, figuratively speaking, to keep your data as secure as possible.

This being so, it should come as no surprise to hear about things going wrong from time to time. What’s surprising (and also totally unacceptable) is the frequency with which stories hit the newswires about things going wrong in the world of public-sector security.

It seems as though lessons are never learned, as though the last security slip-up never happened or didn’t matter, and nowhere is this strategic blindness more apparent than in the Government’s IT security.

It seems as though lessons are never learned, as though the last security slip-up never happened or didn’t matter

It was recently revealed that a USB memory stick found in a Belfast car park close to the docks contained a whole load of confidential data relating to Royal Navy personnel.

How much is a whole load? Well, in this case it would appear to be 40 pages, plus lots more “restricted” data about naval manoeuvres. Have you spotted how security has been totally ignored here? The fact that such restricted data wasn’t encrypted – and it can’t have been, because whoever found it was able to see what the information actually was – is the least of the problems here.

I realise that a fair few of you will have already fallen out of your chairs and be rolling around the floor laughing; after all, how could a “security expert” such as myself not realise that if the data had been encrypted there would have been no story?

What’s more, aren’t you that same Davey Winder who’s been banging on about the importance of mobile data encryption for years and years? Well yes, I am, but I’m sorry to report that there would indeed still be a story – namely, that the data should never have been “lost” in the first place.

The fact that it was lost reveals a monumental misunderstanding about data security among government employees, as well as a seriously flawed data-protection strategy. I’m not just talking about how such an obviously confidential data device came to be misplaced at all, but rather about what procedures must have been breached for it to happen.

Download a year of Davey Winder's Online Security columns by heading to our Free Downloads site