Once More Unto the Breach, Second Edition by Andrea C Simmons

Author:Andrea C Simmons
Language: eng
Format: epub
Publisher: IT Governance Publishing
Published: 2015-01-22T00:00:00+00:00

Data-sharing protocols

The industry on whose periphery we operate loves its acronyms and its reused phraseology. So, when a colleague comes and asks you what it means to be a ‘trusted source’, you need to be able to construct an answer! Context is, of course, very important. But how is this identified and what makes someone ‘trusted’?

The difficulty is that the context is related to trying to deliver on the promise of information sharing. It seems that each agency within the public sector is making up its own language, just as each industry in the private sector does, too. You need to watch out for this, as your role as ISM is often one of translator. Wherever possible, you need to develop relationships across the various agencies that your organisation has connections with, in order to learn their language twists so that you can translate for your own colleagues. You cannot operate in isolation and, somehow, you need to try to be one step ahead. Then there are all the conflicting initiatives that are the harbingers of change attempts. Again, you need to keep abreast of these as every politically related change has an impact on an information system that will be used to produce statistics or manage a requirement; your organisation will need to secure the data on such systems and the people managing it. There are usually far wider implications from small changes than were originally considered.

But back to the ‘trusted source’. It was a crossed-wires scenario where one agency was claiming that it wouldn’t trust our connectivity unless we proved certain things. Yet both agencies were in the same sector and should have been adhering to the same policies, procedures, guidance, network connectivity, connection protocols, legislation, regulations and standards. It was a clear example of the need for data-sharing protocols to be in place – and for them to be meaningful, in terms of having the right breadth of security controls to support the clauses contained therein. As an ISM, you end up needing to know about contracts and agreements. This involves having to understand legalese. It hurts, but it’s worth it! Data protection clauses – think of these as information asset protection clauses – need to be better referenced in contracts from the outset – either directly or as an annex in the form of a security schedule.

You need to be able to provide a sensible response to providers when their sales teams are determined to sell you the world, but the reality may fall short. In particular, with the Cloud and virtualisation intentions moving forward apace, it really is important to know where (in the world) your information is, who is going to look after it, for how long, how you will be able to get it back and how long that would take. You can’t be afraid to challenge the legal jargon and ask for what the actual facts might turn out to be, because, in breach mode, it might just be too late to find things out.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.