Secure Thinking: New Year's Resolution

It's that time of year again when we all make new year's resolutions.  It's pretty much par for the course.  We will be all enthusiastic for the 1st few days or maybe even weeks (if you're really keen).  Then it will all tail off into nothing.

The same story happens every year - why should this be any different?

Well how about setting a New Year's Resolution you can stick to?  One that will enhance your professional and business reputation?  One that will bring huge benefits to your organisation?

The New Year's Resolution I'm talking about is to call Secure Thinking and let us see if we can help you improve the Information Security within your business.  We can look at your current  information security policies, procedures and controls and investigate whether they are effective and are protecting your business interests.

We can also help you out with ongoing information security management which can plague businesses and is frequently ignored by busy owner managers.

So whatever information and IT security needs you may have, whether you require help with business processes such as security policies, procedures and standards, with employee education  in the form of awareness, guidelines and training, or with technical solutions such as anti-virus, encryption and secure backups, contact Secure Thinking now and make this year's resolution one that truly benefits you and your business!

Eitex: New Year's Resolution

Are you making a New Year's Resolution?

It's that time of year again when we all make new year's resolutions.  It's pretty much par for the course.  We will be all enthusiastic for the 1st few days or maybe even weeks (if you're really keen).  Then it will all tail off into nothing.

The same story happens every year - why should this be any different?

Well how about setting a New Year's Resolution you can stick to?  One that will enhance your professional or business life?  One that will bring huge benefits to your organisation?

The New Year's Resolution I'm talking about is to call Eitex and let us see if we can help you improve your use of IT within your business.  We can look at your current  IT systems and investigate whether they are performing to their maximum or whether there is room for improvement.

We can also help you out with ongoing IT support issues and technical computer problems which often plague businesses and are frequently left unfixed by many IT support providers.

So whatever IT needs you may have, whether you require help with hardware such as printers, laptops, servers or mobile devices, with security in the form of anti-virus, anti-spyware or device encryption, or with software solutions such as CRM, Exchange or Microsoft Office, contact Eitex now.

Make this year's resolution one that truly benefits you and your business!

Merry Christmas

I would like to wish you all a very Merry Christmas.

Let's hope Santa brings you everything you need.

Have a good one!

Lee

Secure Thinking News: Now Extended - 25% Off our InfoSec Policy Pack

Now extended until the end of December 2010 - a huge 25% discount on our Information Security Policy Pack.

In the modern world it is essential that businesses have the correct policies and procedures in-place to protect their data.

Our off-the-shelf information security policy pack defines your organisation's approach and philosophy to protecting your data, shielding your customers and safeguarding your business interests.

With this amazing discount, the pack starts from as little as £71.25 (plus VAT)!

Coping with the "Big Freeze"

Has your business been affected by the “Big Freeze”?  Are your staff unable to get into work once the white stuff starts falling?

If so, have you considered how you can continue running your business even when your staff can’t attend your offices?

Here at Eitex we have had the same problems as everyone else.  Our staff have been stuck at home, unable to get into the office.

However, we have remained in operation, servicing our client’s needs as effectively as if we were all in the office, and only attending client sites and meeting client representatives has been affected.  This means that, in spite of our office being empty we’ve been about 92% as effective as we would normally be.  Quite an achievement I’m sure you’ll agree.

So how have we done this?

As you can imagine, Eitex as a technology company has invested time and resources into our IT infrastructure.  Whilst we provide IT support services to other businesses we also ensure our own business can cope with the demands made of it.

We have implemented technical solutions to provide our workforce with the ability to work from anywhere they have internet access.  This means our staff remain effective whatever the weather or their personal circumstances.  It also means that we have 1^st hand knowledge and experience when it comes to helping our customers.

So if you need to make sure your staff can work effectively, in spite of the weather, then call us now and let us help you keep your business running.

Let’s make snow an excuse to carry on working as normal – and save the sledging for the weekends!

Secure Thinking: 10 Information Security Tips for Businesses

Businesses are recognising the importance of the information they manage, and more companies than ever deal with sensitive information on a regular basis.  So whether you are a one-man-band or a multi-national corporate entity here are Secure Thinking's 10 Information Security Tips for Businesses:

1. Implement policies and guidelines
Implement policies, processes and guidelines - the rules of the game - that are appropriate for your organisation.  This means a top-down approach to information security showing that your organisation is committed and willing to invest in protecting it's data.  Remember that often, the simplest solution is the best so keep your rules simple because doing so makes them easier to follow.

2. Lead by example
Senior level buy-in is vital but business owners and senior management must also follow the same policies and guidelines, otherwise it becomes a pointless exercise as staff will bypass them in the same way.  That means it's vital to lead by example, showing your team that you take information security seriously.

3. Staff education and training
It may seem obvious, but if you don't educate your staff on their information security roles and responsibilities then you can't expect them to provide effective protection for your data.  You should not only teach your staff what they have to do and the rules they must follow but also why it is important to you, how they do it and who they should speak to if they have any questions or issues.  It is important here to make the process as entertaining and fun as possible as it is seen often as a very dry, if not dull topic.

4. Business processes
It is important to implement appropriate business processes in your organisation and to align them with your information security policies as much as possible.  Otherwise it may become easier to bypass the controls you have implemented in order to achieve your business goals.

5. Technical solutions
In the same way as it is important to have appropriate business processes, it is also vital to implement appropriate technical solutions.  Many organisations see IT as the driving force in protecting their data.  However, this is not the case.  IT is simply one of the tools available and you therefore have to ensure your technical solutions and IT systems provide your organisation with the protection it desires in line with your information security policies.

6. Spot checks
A good way to ensure your staff follow your information security rules is to employ a regime of spot-checks.  It is important that this should be done to raise awareness of issues and not as a method of punishing those that fail to follow the rules, after all you need your employees to buy-in to the spirit of the program not merely follow instructions like sheep.  A great way of achieving this is to encourage staff to come up with ideas for improving security and reward the best ideas.

7. Test and measure
In addition to performing your own spot-checks, it's a good idea to employ an external agency or consultancy to test your security controls on a regular basis.  Many corporate bodies have regular penetration tests of IT infrastructure and less frequent tests of physical security.  Smaller businesses might see this as overkill but unless you actually test your controls you have no idea as to their effectiveness!

8. Check your suppliers
Most companies make use of 3rd party service providers.  Whether it's for your IT, web hosting, accountancy or legal operations it's important to ensure your suppliers take the same care and consideration over their information security (and yours) as you do.  It's no use having fantastic information security controls only for every Tom, Dick and Harriet at XYZ IT Support Company to have access to your sensitive data because they provide your IT support services.  Take the time and ask questions - ask to see their policies, how they vet their staff, and what controls they employ to protect your data.  At the end of the day, protecting your data is your responsibility.

9. Plan for the worst, hope for the best
In the same way that it's a good idea to have business insurance, all companies should invest in a Business Continuity Plan.  This means looking at the threats to your business, the risks posed by them and how you respond in order to continue operating should the worst happen.  Your Business Continuity Plan needs to cover all the high risks to your business and should be tested and reviewed on a regular basis to ensure it meets your changing operational requirements.  Obviously, testing a Business Continuity or Disaster Recovery Plan completely may be prohibitively expensive but there are ways of assessing the plan without necessarily having to buy hardware or pay for office space.

10. Incident response
Although having all the policies, processes and guidelines, the correct technical solutions, and excellent staff awareness will give you the best chance of not having an information security breach, it doesn't guarantee it.  Therefore, it is essential that you have a clearly defined process for responding to an incident.  This should include reporting points, escalation, evidence gathering and media management.  It should also clearly define the roles and responsibilities for relevant personnel and how your organisation reports the breach to the relevant authorities - be they law enforcement, the Information Commissioner or regulatory bodies - and of course how you inform the individuals or companies concerned.

Secure Thinking Announce New Online Backup Service

Secure Thinking are please to announce the launch of our new online data backup service for small and medium businesses.

The service makes use of a secure data backup solution provided by our partners - Risc IT Solutions and offers a range of benefits including:

• Security - fully encrypted backups mean your data is secure from the moment it leaves your system
  
• Resilience - dual site UK based data centre storage for enhanced peace of mind
• Compatibility - including Windows (Desktop, Laptop & Server), Mac OSX, Linux, MySQL and Oracle among others
  
• Flexibility - backup a single file or all of your data including active databases
  
• Scheduling - backup your data when it's convenient to you
• Recovery - latest copy of a single file or full point-in-time recovery
• Safety - with Business Continuity and Disaster Recovery options
  

For more information or to sign-up for a FREE trial call us on 01282 877333 or email nicky.webb@securethinking.co.uk

Secure Thinking Exhibiting at Burnley SME Event

Secure Thinking are now one of 12 exhibitors at the Burnley SME owner’s event on 19th January 2011. With 22 SME owners already confirmed and over 500 invites going out this week. Do you want to be part of the SME owner’s event in Burnley in January? Email mark to get your place now. Markj@afsl.info

Secure Thinking: 10 Social Networking Security Tips

Social Networking is the biggest thing to hit the internet since it began.  The sheer numbers involved are staggering.  If Facebook was a country it would be the 3rd largest in the world behind India.  It can be a massive force for good, yet it comes with inherent dangers, not least of which is to your security.

As such Secure Thinking have produced our 10 Social Networking Security Tips, to keep you safe and secure whilst chatting with your mates!

1. Don't publish too much
Don't publish too much information about yourself, your personal life, and your family online.  Things to avoid if possible are full dates of birth, mother's maiden name, 1st pet's name, 1st school, or make sure you lie to these types of things.  After all, they are all used by major institutions as "security" questions, so don't make it easy for someone to target you.

2. Assume everything is public
Always assume that everything that you post on the internet will at some point become public domain.  The rules and settings employed by the service provider now might change in the future.  Never post or say anything online that you wouldn't want your mum, your boss, future employers or future partners to find out about!  This includes "chats" with other people and "status updates", all of which have the potential to be public or become visible to others.

3. The internet never forgets
Unlike you an I, who have a habit of forgetting things on a regular basis, the internet won't forget.  That means the embarrassing photo's from your stag/hen party will still be hanging around the next time you get married!  And even if you delete images or remove content, there's a good chance it's been copied, backed-up or cached by another internet service.  This is an important fact that people tend to forget.

4. Don't "connect" with people you don't know
Don't accept "friend" or "connection" requests from just anybody unless you're aware of the risks.  Accounts of users are regularly monitored and targeted for malicious purposes with the intention of gaining something - either identity information or more often money in some way.

5. Don't trust even your "friends"
Remember, unless you can verify the identity of a user account without simply trusting they are who they claim to be don't trust them!  A genuine friend could have had their account compromised or someone may have set-up an account in their name with the intention of gathering information on you and others you know.

6. Don't announce your plans to the world
If you're going on holiday to Thailand for a fortnight, that's great, but don't tell the world and his wife when you're going, when you're returning, which hotel you're staying in and who's traveling with you!  This information is brilliant for burglars, muggers, identity thieves and anyone else who fancies free board and lodgings in you home while you're away.  Remember points 4 and 5!

7. Be wary of "apps"
"Apps" are great fun, what harm could they do, they're all provided by the site?  This isn't true.  Many "apps" are developed by individuals and companies external to the social network you're using and they often re-use code segments from other apps.  As such there's no guarantee the apps you're using are simply there for your enjoyment and aren't harvesting your data.  Now some harvesting is done for legitimate marketing and research purposes, but some of it is also done with not so innocent intentions.  As such be wary and don't download/install/add the "app" unless you really need to.

8. Avoid location based services
I know they're the new up and coming "thing", but I personally don't like the idea of having my movements tracked, even if it means I save a few quid at Starbucks.  Again, like point 6, you don't know who else has access to the information and who knows if the terms of service might change at some point in the future?

9.  Check your settings
All of the current social networking sites come with some form of privacy or security settings.  Now these might seem confusing and a bit pointless, but it's worth taking some time to go through and understand them to ensure you're protecting yourself to the best of your abilities.  If you need help then see if there's an FAQ, speak to someone who understands how they work or simply stay off the site.  Either way, make sure you have the settings at the level you feel comfortable with and that protects your data.

10.  Never post anything sensitive
The last point is almost the same as point 2, but here we're emphasising the need to avoid posting potentially sensitive personal or business information which could cause you or your company/employer harm.  This could be something as innocuous as a tweet saying "Off to meet XYZ corp now, back in an hour".  There is the potential that this could be privileged information and might allow your competitors to see who you're dealing with or who your clients are.  It could provide them with a competitive advantage or it could land you in trouble with your bosses, regulators or courts, depending on the issue at hand.


Now all of this might seem a little to paranoid for some of you, but as "they" are out to "get you" surely it's not paranoia!?

Secure Thinking November Offer: 25% Off our InfoSec Policy Pack

Until the end of November you can receive a huge 25% discount on our Information Security Policy Pack.

In the modern world it is essential that businesses have the correct policies and procedures in-place to protect their data.

Our off-the-shelf information security policy pack defines your organisation's approach and philosophy to protecting your data, shielding your customers and safeguarding your business interests.

With this amazing discount, the pack starts from as little as £71.25 (plus VAT)!

10 Client Site InfoSec Rules

If you're working on a client site, in addition to obeying their rules and policies on information security here are Secure Thinking's 10 Client Site InfoSec rules you should employ  to keep yourself and your information safe and protect the client.

1. Never leave equipment unattended
Laptops, phones, disks, memory sticks etc., should be taken with you, locked away securely or, in the case of laptops, locked to something solid with a Kensington style lock if they have to be left unattended.

2. Use encryption
Encrypt laptops, external disk drives, USB sticks to protect the data on them whilst on the move.  This will help to protect your data should you lose an item of equipment or it is deliberately targeted.

3. Operate a clear desk policy
Even if the client doesn't operate a clear desk policy, you should.  Never leave papers or other media on unattended desks.  Lock it away or carry it with you.

4. Leave sensitive information where it belongs
Don't carry sensitive information in bags, briefcases or laptop cases unless it's directly relevant to the work you're engaged in. If you do carry sensitive information, keep it in a secure bag and don't leave the bag unattended.

5. Never send unencrypted data or emails over public or client wi-fi networks
Just because your client trusts their wi-fi network doesn't mean you should.  Only send non-sensitive information over non-secure networks.

6. Never directly connect to client networks
Unless it is essential for your role never directly connect your systems to their network.  This is to protect them and you!  You don't know their network is secure and virus free and they don't know your system is.

7. Always lock your screen
When not working on your computer or laptop make sure it is locked and set a low timeout value for the automated screen lock.  This helps to prevent your system being accessed should you become distracted.

8.  Only work on that client's data
Never work on another client's data while on-site at a different client.  There are a whole host of potential legal and regulatory issues you could be opening yourself up to and you've no idea who might be interested in snooping over your shoulder.

9. Keep your equipment up-to-date and secure
I know it's a common one but you should ensure your Anti-Virus, Anti-Spyware, Operating System and other software packages that you use are patched up-to-date, you should also disable all unnecessary applications and services, and have your firewall enabled.

10. Don't use removable media
Unless it's essential to your work, don't use removable media to transfer data between your system and client systems.  If you do have to use a USB stick or other device, ensure you have auto-run functionality disabled (preferably on both systems) and ensure the device is virus scanned at both ends.  Use a brand-new device where possible and encrypt it if it's practical.

Eitex Blackburn - IT made easy

Lancashire businessman Lee Hezzlewood today announced the launch of Eitex Blackburn (IT Support Lancashire), a new arm of the Eitex franchise providing IT support to businesses in Blackburn, Burnley, Accrington, Clitheroe and across Lancashire.

Initially based in Nelson, Eitex Blackburn will provide ad-hoc and pro-active IT support to businesses ensuring their day-to-day operations are not affected by common IT problems.

"Eitex Blackburn brings professional IT support to businesses in Lancashire like they have never experienced before.  We aim to provide quality service at a price that's right for local businesses," said the local entrepreneur.

"IT support in Lancashire will now receive the benefit from the combined experience of the Eitex Team, meaning we can deliver truly corporate levels of service and reliability to the regions' small and medium sized businesses."

Mobile & Social Networking Apps

The subject of 3rd party "Apps" has raised its head again - this time on Google Android smart phones.

Apps on smart phones and on social networking sites are becoming ever more popular, but are the intentions of the App developers always in the best interests of the users?

A recent study of the apps on Android mobile phones has shown that the data they access and how they use it does not always tally with what the user authorises when they install the app.

This becomes even more of an issue where apps are downloaded or installed from other, shall we say less reputable sources.

There has also been occurrences of apps being developed reusing code segments created by other developers. This could lead to all kinds of unauthorised or malicious use of personal data which even the app creator doesn't know about.

So here are some simple rules to follow to enhance your security and protect your data:

• Don't use apps unless you really need to
• Only install apps from reputable sources
• Only install apps that are essential for you
• Remove apps you no-longer use
• Always read what data will be collected by an app
• If in doubt don't install it
• Don't provide an app with access to sensitive information or don't place sensitive information in a location an app has access to

Importance of Information Security Awareness Programmes

Most businesses are starting to recognise the importance of information security, both from the perspective of regulatory or legal responsibilities, and from a viewpoint of good business practice and brand protection.

But information security policies, procedures and practices are only as good as the people and systems that operate them. If the people who work in the system don't understand their role, their responsibilities and why the controls are in place, then the results can be as bad for your organisation as not having them there in the first place.

Over the last few years there have been many stories in the press about information security failures within major organisations and government bodies. These organisations almost certainly had information security policies in place at the time of the failure. So why did it still occur and what can we learn from the mistakes of others?

As already stated, information security policies are only any use if they are understood, are adhered to and ultimately enforced as part of the culture within an organisation. Many of the well publicised information security failures have occurred because either the staff involved didn't know their responsibilities, weren't aware they were breaching the policies, or were operating without adequate supervision.

Another common failing is that information security policies do exist but are complex documents, unlikely to be thoroughly digested and understood by staff, even where they have apparently 'signed them off'.  This often means that staff ignore, or at best pay lip-service to the policies and the only time they are truly understood is following a security failure.

In most cases, a programme implemented to raise awareness of information security may well have prevented the failure, either partially - reducing the impact of the failure; or completely, by preventing the breach from occurring in the first place.

A carefully implemented information security awareness programme, encompassing properly documented, easy to understand security policies, standards, procedures and staff guidelines, along with ongoing training and evaluation, is a proven method for reducing information security failures.

It ensures your staff are aware, not only that the policies exist and that they are expected to adhere to them, but also why they exist, what their responsibilities are and how to operate on a day-to-day basis to maintain the required level of security. It also allows management to understand the levels of awareness within the organisation and provides them with the ability to target any specific issues which may arise.

Finally, even a good information security awareness programme needs to be backed up with a policy of open reporting. Having a 'blame culture' is not a good environment in which to raise information security issues.  Staff need to feel they can report actual or potential problems without the threat of some kind of retaliation or witch hunt!

Location Based Services & Security

It seems that more and more location based services are surfacing, jumping on the Social Media bandwagon.

Now, I'm not an old fuddy-duddy, and I can see how some of these services might be of use to businesses and potentially to individuals. I do however, have massive concerns over the privacy and security of these services.

Firstly, there is the physical security aspects. The information about where you are could be used to target you personally for malicious intent. This could range from mugging you as you leave a venue to burgling your home while you're out.

Then there are the issues of who has access to this information. There are various rules and laws which apply to data protection but under what jurisdiction are you accounts being managed? Who both from a staffing point of view and a company point of view has access to the information? Are your locations, movements and habits being observed, monitored and assessed for other reasons - some of these may be purely for targeted marketing but others could be for more insidious purposes?

I have been critical in the past of individuals who post on Twitter, Facebook and other social networking sites with too much detail about where they are and what they are doing. Now we have services specifically designed to post and collect this information.

The simple fact of the matter is that people will leave themselves open because there are multiple, complicated options on the security settings page - will every user truly understand them all? And how do you know all of your "friends" are the only ones viewing your information? It could be that their accounts have been compromised or that you have mistakenly added a "friend" who isn't who you think it is.

My philosophy is this - whatever you share on the internet, even just to "friends" you should consider it public domain. Don't tell anyone anything, say you are or have been anywhere, or opine about something you wouldn't want your mother, your boss or the rest of the world to know! That way, you can protect yourself, your identity and your information.

Why Website Security is Important for Everyone

Most websites, whether owned by an individual, an organisation or a business, are never security tested. Many see it as an irrelevant or unjustified expense, citing the fact that it's mainly static content, there's no sensitive information held on the site, it doesn't accept financial transactions, etc., so there's no point in potentially expensive web security testing, as the business or organisation can't be affected by insecurities.

Well, to put it simply, this is not true!

Whilst your website might not contain sensitive information, might not  accept any financial or personal transactions, and may be purely static content, you are still putting your clients and website visitors at risk.

Cyber criminals, of which there are many, are not necessarily interested in gaining access to your business and its information – although you are always a likely target – but they ARE after your customers. They want access to their computers and their details and they can use the vulnerabilities in your website to get that access.

More and more often, we are seeing ordinary websites used to load malicious software onto the computers of unsuspecting victims. Cyber criminals are scanning the internet, looking for any websites which are insecure and are loading them with malicious software (called 'malware'). This in turn is then passed on to the computers of every visitor to your site in what is known as a "drive by attack", exposing them to all kinds of issues such as identity theft, bank account skimming and credit card fraud.

So whilst your organisation may not be affected directly by your website security problems, there is a huge amount of damage that can be inflicted on your customers and passing visitors, for which you are at least partly to blame.

This has now reached a point in the US where victims of such incidents are taking the website owners to court for compensation. And whilst this may not be likely to happen in the UK or elsewhere, there is certainly the potential for it, particularly where an incident can be traced back to a specific website.

If every person who merely looked at your premises was in danger of some injury, you would rightly take steps to prevent it. So why wouldn't you take such a course of action in the virtual world of the internet, where such damage can be just as serious?

Information Security for SMEs

If you run a small or medium sized enterprise, then you’re probably up to your eyes in government red-tape, and legal and regulatory obligations, and that’s before you start to actually run and operate your business in order to make a living.

A key component in the smooth running of your business is information. That information may take on many forms – customer or supplier details, financial data or secret recipes for the perfect carrot cake – whatever it is, it is vital to your organisation. As such you need to make sure it is protected, kept from your competitors, guarded against public disclosure and available as and when you need it.

This is why good information security management and practices are as important to you as they are to the ‘big boys’. The major banks and corporations employ dedicated staff to manage their information security risks. You probably don’t have that luxury, but you still need someone to take responsibility for information security.

At this point, many SME managers and business owners claim they don’t have the time for information security, they don’t have the resources, it isn’t important to them, or they can’t afford it. After all, you’re only a small business, your IT people take care of that side of things, and you’re not at risk.

The information and data you use on a daily basis is the lifeblood of your business. Can you imagine if you had none of it? If one day you turned up at the office and all of your paperwork was blank? All of your computers had been wiped? Where would that leave you?

But it isn’t just the total loss of information that is of concern in the modern world. Criminals, including the so-caller ‘cyber’ criminals, want your information and my information. They want personal and financial details from as many people as they can for a variety of reasons, including identity theft. Even corporate data is now a target for the unscrupulous members of society.

So how would your company survive, particularly in the current economic climate, if it was discovered that your customers’ bank accounts were being drained, that identity thieves had access to personal data that could only have come from your business?

Apart from the obvious, potentially fatal, legal and regulatory fines, a well publicised incident of this nature would have a disastrous effect on your brand and business reputation. Even accidental disclosure of sensitive personal information is jumped on by the press, and that is without any direct criminal involvement.

If you hold personal information relating to living individuals, you fall under the jurisdiction of the Data Protection Act (DPA), if you handle financial information for individuals or other businesses you are very likely regulated by the Financial Services Authority (FSA), and if you handle credit and debit card payments you will almost certainly have to comply with the Payment Card Industry Data Security Standards (PCI-DSS). All of these mean you must adhere to minimum standards for information security for regulatory and/or legal reasons.

At the end of the day, information security is as important to SMEs as it is to anyone, so the question isn’t really “why do you need to worry about information security?” but “can you afford NOT to worry about information security?”

Poll: Protecting sensitive information.....

Please help with our latest poll for SME Business Owners - Protecting sensitive business or customer information is vital to my business......Complete Poll

Why information security is NOT just an IT issue

Time and again, when I talk to business owners and managers about information security, I get the line "that's an IT issue" or "our IT guys look after that".

Whilst I'm well aware that IT and IT security plays a significant role in information security, it is not the Holy Grail many people seem to think it is.

IT is not some kind of magic wand you wave over your information assets to suddenly make them secure. The careful and appropriate use of IT solutions aids information security, but it is not a way of enforcing information security in its own right. Think of IT as a method of securing your information and data whilst it's being used or accessed electronically. That's all IT can ever hope to do.

But, by making information security an IT issue, many senior managers feel they have done their duty, and allocated it to someone who can deal with it. The problem here is that without senior management buy-in, and a top-down culture of security and security awareness among non-IT staff, the 'IT Crowd' can only achieve so much.

Often, IT security controls and processes, implemented without the understanding and support of non-IT staff, will be circumvented. If staff feel that IT is getting in their way, they will do everything they can to work around it or subvert the  controls. This is how we end up with users sharing logins and passwords, or documents being emailed to large groups of people because "So-and-so can't access them".

It is also worth remembering that not all information within a business falls under the control of electronic or IT systems. Almost every business in every industry will have printouts or hard-copies of documents, files and folders, and hand written notes, much of which contains business critical or at least business  important information – otherwise, why would it be there?

To successfully implement an information security programme, managers and business owners need to take ownership themselves. They need to be involved in defining the policies and procedures. Then they need to involve their staff in the process and educate them as to WHY they need to adhere to the policies, HOW to do it and WHAT the consequences will be if the processes and controls are not followed. They can then use the available IT solutions to assist with implementing the controls defined by the policies, whilst also ensuring that all staff are informed and educated as to why they are needed.

Information security is NOT an IT issue, but done properly IT can help you achieve your information security aims. You just need to make sure you've defined your business objectives beforehand, and educated your staff along the way.

Testing Data

Does your organisation develop software in house? Are you responsible for testing applications? Are you a tester of applications? If so, where do you get your test data? You know, the data you put in the databases that allow you to test the applications, where does it come from?

If the answer is from the live databases then you could be in trouble. Yes, you personally.

Many organisations, both large and small, take cuts of live data to use for testing purposes. Indeed, this is often seen as a good way of generating the test data required to fully exercise the application code. But is it?

There’s no argument that it’s as close to ‘live’ as possible because it is live, but do you do anything with the data before you place it in your development and test databases? Do you sanitise or obfuscate personal or sensitive fields? Do you restrict access to properly vetted and checked staff? If not you could be in breach of the law or regulatory conventions governing your organisation.

In the UK, personal information stored electronically comes under the Data Protection Act. Any such data collected can only be used for the purposes it was collected for. If ‘testing our application’ is not included in the official purposes, then raw personal data taken from the live databases and used for testing is almost certainly done so in breach of the DPA.

In addition to the DPA, which covers personal data held on individuals, there are other good reasons for not taking live data, unaltered. These could be regulatory or compliance related, including FSA, PCI, or any other governing regulations.

But it’s not just about the rules and regulations. It’s just really bad practice. If all you’re doing is testing your application against known, good data, then you’re not properly exercising your code. You’re not performing thorough data and error handling tests. Part of application testing is ensuring the code handles the unexpected in a predictable and safe manner. If you don’t test with data that stretches your code, how do you know what your application will do should it come across such data? 

So what should you do? How should you populate your test data?

This is where it gets interesting. These are good and valid questions, and there is no easy answer. The simple fact is that you are going to have to spend some time and effort on this problem. Test data needs to be created or generated and it needs to be good for testing. Taking a cut of live data and performing careful and thorough obfuscation is obviously one way of doing things. It needs to be done carefully though, as sensitive data may not be immediately apparent, for example, some free-form fields may contain sensitive data even after obfuscation. It’s also no good just populating the database with meaningless random data, as the testers may not be able to tell if they have the right results.

So it’s likely that the only way to achieve meaningless but realistic test data is to take the time (and money) to generate it, utilising relevant resources (DBAs, testers, developers, data owners) to ensure it covers the testing requirements. This test data could then be stored, added to, modified and reused throughout the lifecycle and lifetime of the application. You could even set up a function to centrally manage and distribute test data for all your applications and data users, ensuring high quality, useful and valid test data is available when needed.

There are a number of tools on the market which can aid with this process. A simple Google search for “database test data generator” pulls up dozens of suitable products out of about 1.7m hits, so there are resources available.

At the end of the day it comes down to a conscious decision by your organisation. You can either continue using live data for testing purposes in the hope that no security breach will occur, and that your breaking of the law or regulatory policies won’t be discovered, or you can stop cutting corners and take the time and effort to correct the situation.

Remember, ignorance of the law is not a defence under the law.

Article reproduced with kind permission of Pentest Limited - www.pentest.co.uk

--

New Online Store

I've now added an online store for books, music, computer equipment and
electronics to my website. Check out Lee's Store for some
great bargains!

Drive Like An Idiot Day & Wasting Taxpayers Money

Well, it's been a busy old week so-far (considering it's still only Monday) but I have the distinct impression it was drive like an idiot day for the first few hours of this morning.

I usually try to be nice when I'm in the car but for some reason all the people I tried to be nice to just ignored me.  I slowed down or stopped to let out about 6 or 7 others this morning but most of them seemed to be completely asleep, to the point where I even shouted at the last one and drove on!

Now maybe I was a bit crotchety as I didn't get a particularly good night's sleep, and maybe I was therefore a little impatient, but I can't think why, when you decide to let someone out or across in front of you they just continue to sit there mindlessly staring into nowhere!

Anyway, this isn't the real topic of today's update.  The real topic is the completely pointless addition of traffic lights to a local roundabout!

Now I'm not an expert on traffic flow, but our genius local council have decided that a local roundabout at the site of the former North Valley Pub in Colne was in need of traffic lights.

I'd love to meet the moron who decided this was necessary, as all it seems to do is block the flow of traffic, cause even longer queues and tailbacks, and make vehicles have to stop when there's no other traffic on the road - like any time outside of the morning and evening rush-hours!

Oh, and then there's the added benefit of wasting £10k's of taxpayers money just when we need it the most!

Ok, rant over - I'm off to make dinner now!

List Your Business on FreeIndex

FreeIndex is a free business directory.  If you're in business get your company listed - visit FreeIndex


-

UWDC News: Another Distributor Joins the Team

Another Independent Distributor has joined my team - welcome Ian!

If you'd like to become a distributor and earn extra money in your spare time contact me on 01282 500 511, drop me an email here or go to the website and watch the video.

-

Victim vs Winner

Types of People

There are two types of people in the world - Victims and Winners. Most of us have attributes from both types but generally we fall more into one category than the other.

Victim

There are two kinds of Victim - real victims of crime, tragedy, or disaster who are genuinely unfortunate. Then there are those who have normal lives but perceive everything that happens to them as being out of their control.

These people blame everything in their lives on external events and influences. Nothing is their responsibility, it is the government, their parents, the area they live in, their lack of money, the lack of opportunity, their school, their boss, and everyone hates them, etc.

We all know victims, they are people who achieve very little in life but sullenly moan and complain loudly that it isn’t their fault!

Winner

Winners are those people who take control of their lives. They understand that they control almost all of what happens to them and what they achieve, and that to blame everything outside of their control is a pointless waste of energy.

Winners learn from their mistakes, accept failure as a step on the path to success and are willing to take responsibility for their actions.

We all know winners, they don't have to be high achievers or earners but they are generally confident and successful in whatever field or walk of life they chose. They accept life as a challenge, but are often put-down and knocked by those who are more 'Victim' than 'Winner'.

Attributes of a Victim:

• See nothing as their fault
• Think that everything is out of their control
• Blame everything/everyone else
• Gossip about everyone else
• Poor losers
• Obnoxious winners
• Believe that material things will make them happy
• Rude and disrespectful

Attributes of a Winner:

• Learn from failure
• Know that everything is under their control
• Take responsibility for themselves and others
• Confident
• Good losers - accept defeat and learn from it
• Gracious winners
• Understand that material things will NOT make them happy
• Polite and respectful

Lifetime Career Opportunities of a Victim:

• 'Doley'
• 'Wino'
• Drug Addict
• Checkout Clerk (if they're lucky!)

Lifetime Career Opportunities of a Winner:

• Business Person
• Manager
• Sports Person
• Whatever THEY want to be!

Pseudonyms of a Victim:

• Loser
• Dosser
• Whiner

Pseudonyms of a Winner:

• Leader
• Successful
• Achiever

Typical Quotes of a Victim:

• "It's not my fault, its....."
• "I can't do that because....."
• "Nobody helps me....."
• "Everything would be great if I had...."
• "Can you do ..... for me?"

Typical Quotes of a Winner:

• "I can ...."
• "I will learn how to ...."
• "I will help myself and/or others"
• "Being successful will enable me to have ...."
• "Can you show me how to ....?"

Which category do you come under now and where would you rather be?
Start planning now how to get there!


-

Household Contract

If you have teenage or grown-up children (or even supposedly grown-up!), or live in a shared house as students, then you probably have some idea of the difficulties in getting everyone to contribute financially or help out with jobs around the house. Our solution to this was to introduce our "Household Contract", ensuring everyone pays their way and assists with day-to-day chores and housework.

Feel free to take this contract and amend it for your own use.

Basic Principles

Everything costs money – first there's the obvious things such as food to eat, electricity for TVs, washing, drying and charging phones, gas for hot water and heating, telephone, Sky TV, washing powder, soap, shampoo and toiletries. Then there's the things you can't see – council tax, mortgage, broadband, insurance, TV license, and general maintenance and upkeep.
The bills alone (utilities, phone, council tax, etc.) currently come to over £450 per month. That doesn't include mortgage, food, or cars!
In addition to the costs, running and maintaining a home involves constant work, time and effort, to keep it clean and tidy, healthy for residents and guests, and in a fit state to live in.
As such we are introducing some rules for the household to ensure everyone contributes.
As of 1^st June 2010, everyone who lives* in the house will contribute in the following ways:

1. Anyone not in full-time education will pay board at the rate of £20 per week – no exceptions!
   
2. Those in full-time education will still be expected to do their fair share of the chores.
   
3. Everyone will contribute time to household chores.
   
4. Anyone who cannot afford to pay board will be expected to contribute additional time to household chores.
   
5. Everyone will have an area they are responsible for maintaining.
   
6. Everyone will be responsible for keeping their own room clean and tidy.
   
7. Everyone is responsible for ensuring shared areas of the house are free from personal clutter, mail, clothing and other junk – PUT IT AWAY!
   
8. If you entertain guests, YOU are responsible for tidying up after them – this includes washing up, putting away and cleaning.
   
9. If you did not cook, YOU are responsible for clearing away, emptying/filling the dishwasher (correctly!) and putting away.
   

Failure to contribute will result in penalties being imposed on the individual.

Areas of Responsibility

Area	Name	Tasks	Estimated Duration	Frequency
1	Bathrooms	Keep clean & tidy including – anti-mold, cleaning toilets, mopping floors.	1 hour	Twice weekly
2	Landing, Stairs & Hallway	Keep clean & Tidy, including – hoovering carpets, dusting furniture & bannister, mopping floor.	1 hour	Twice weekly
3	Lounge & Dining Room	Keep clean & Tidy, including – hoovering carpets, dusting furniture, plumping cushions.	1 hour	Twice weekly
4	Kitchen	Keep clean & tidy including – anti-mold, cleaning sink, mopping floor, watering house plants.	1 hour	Twice Weekly
5	Lawns	Keeping tidy and healthy – mowing, strimming, edging & feeding	1 hour	Weekly
6	Garden Plants	Keeping tidy and healthy – weeding, trimming, watering & feeding pots & borders	1 hour	Weekly
7	Cooking	Making evening meals	0.5-1 hour	Daily
8	Washing	Washing & drying clothes	0.5 hours	Daily

Penalties

The following penalties apply for non-compliance with household rules:

Crime	Description	Penalty
Not keeping room tidy	Failure to keep your bedroom clean and tidy to an acceptable level	£10 or 2 hours of extra chores £5 per person or 1 hour of extra chores if shared room
Failure to perform allocated duties	Failure to maintain the areas allocated to you in an acceptable state or perform the tasks allocated to you	£5 or 1 hour of extra chores per session
Non-payment of board	Failure to pay board on-time (weekly)	£5 per week not paid or 4 hours of extra chores
Leaving dirty crockery in room	Leaving dirty cups, glasses, plates or cutlery in your room	£1 per item per day + cost of replacement if unusable
Leaving Clutter	Leaving personal items of clothing, jewellery, mail or gadgetry in a shared area of the house where they don't belong	£1 per item per day
Not clearing up after guests	Failure to clear away, clean tidy and perform any washing after entertaining guests	£10 or 2 hours of extra chores per incident
Not clearing up after eating	Failure to clear away, sort the dishwasher and put away after having had a meal made for you	£5 or 1 hour of extra chores per incident

Other penalties may be added where deemed necessary by parents.
Basically, if you don't wish to contribute financially then you can do more chores, if you don't wish to contribute time then you can buy back your time by paying additional board. Either way the rate is the same - £5 per hour.

Agreement

I hereby agree to abide by the household rules and submit to the penalties imposed for non-compliance. I also agree to accept responsibility for the area(s) listed below and promise to take my work and responsibilities seriously.

Date	Name	Signature	Areas
	Mother
	Father
	Child #1
	Child #2

* For the sake of argument 'living' in the house is defined as residing in the property (full- or part-time), having a bed allocated or reserved, keeping clothes or a significant amount of personal items on the property, using the residence for washing, drying or entertaining, or possessing a key.


-

Secure Thinking in Local News

My company Secure Thinking makes the local news:
Lancashire Telegraph


-

Household Values

General Values
I will help with chores whenever and wherever I am needed without complaint.
I will always do my chores to the best of my ability.
I will clean up after myself when I, or my friends/visitors make a mess.
I will keep my room tidy and clean at all times.
I will “do my bit” around the house because I do not expect others to look after me.
I will not moan, grumble or attempt to avoid doing tasks I have been allocated.
I understand that everyone in the house has to help and I do not expect others to carry me.

Standards of Behaviour
I will not use foul or abusive language at other household members or guests.
I will not use threatening or aggressive behaviour to other household members or guests.
I will not pester others to provide me with things, instead I will rely on myself and explore other legal avenues.

Cooking
I can cook for myself and/or my guests at any time as long as I clean up afterwards.
If I cook for the household, then other household members will be responsible for clearing away, washing up and tidying.
I will NOT overfill the dishwasher – I will ensure there are gaps between all items (especially crockery) to ensure everything cleans correctly.
Before consuming any foods I will check that they have not been put aside for a specific purpose – such as a planned meal.

Washing
I will NOT wait until the last minute and expect that my washing has been done, will be done or that others will run around an do it for me.
I am responsible for my washing and drying unless I:
Put things in the correct washing basket/pile;
Am in no hurry or urgent need for anything in particular;
Am not washing things which are delicate/valuable.
At all other times I am totally responsible for my washing.
I am always responsible for my ironing unless someone offers to help.

Money
I realise that money does not grow on trees and is not in endless supply.
I will always attempt to save money by ensuring all electrical devices are properly powered off and by not wasting things like fuel, gas, electricity, water, food, clothes, furniture, etc.
I will not to borrow money unless I have explored ALL other legal ways of earning.
I am responsible for earning my own money and paying my own debts.
I will pay my board/rent/mortgage on time when it is due.


-