Governance and Government

We weren’t sure whose chin hit the floor first.

“He did say 25 million, didn’t he?” asked The Pebble.

“Yip”, I replied.

We had just begun watching a news broadcast about the latest data security breach by a British government department, Her Majesty’s Revenue and Customs (HMRC).

25 million personal records, including the banking information for every family in the UK with a child under the age of 16, had been written with only password protection onto two CDs which were subsequently “lost in transit”.

The UK Prime Minister, Gordon Brown, said that the security breach was down to “Failure in implementing the proper procedures.”

He went on to explain that:

1. “Only authorised staff should have access to protectively marked information”
2. “Information must not be removed without appropriate authorisation”
3. “Encryption should be used whenever information is being sent”

The government has launched an investigation to discover why these procedures were not followed in the HMRC, especially after previous problems in the organisation.

What is known, is that another government department, The National Audit Office (NAO), had asked the HMRC to send it records from the UK’s Child Benefit system.  However the NAO did not want all of the data kept in each record, only some of the data.

Part of the explanation for the procedural failure is that HMRC was trying to save money.  Rather than HMRC spending time and money querying the databases for the exact data required by NAO, HMCR decided to send the full set of tables so that the NAO would have to meet the cost of extracting the data.

Regardless of the data being re-discovered or used for criminal gain, it would certainly appear that the lapse in security was because well-founded procedures and processes were disregarded at some level within HMRC.

Those of us who have worked within a highly procedure-driven environment can understand the frustrations which are commonly felt, where what appears on face value to be the simplest of tasks seems to take forever to gain sign off through many layers of bureaucracy. 

Similarly, those who have tried to implement processes and procedures to cover IT management and governance, such as those in ITIL, equally understand the frustration of trying to get staff to adhere to new ways of working.

Sometimes we, as individuals, may think we know why a process works in a certain way and, based on our limited knowledge, take shortcuts just to shorten the time taken to achieve the same results.  But all too often, because we don’t have the experience of the whole community of practice which has developed the process, we unwittingly introduce risk.

Taking shortcuts can be a common occurrence, and trying to control this temptation has lead to a rise in the automation of workflow through software such as Microsoft Sharepoint and, specifically for service desks, Remedy.

Going back many years, we saw a similar trend within manufacturing industries, such as Oil and Gas.  It used to be the case that valves and machinery were operated manually and, if the process was not adhered to, technicians could perform the wrong sequence of operations, leading to, at best, contaminated product or, at worst, a loss of life.

Process automation was used to prevent this from happening, and had the additional benefit of increasing efficiency. 

Controls were enforced through software to ensure the correct sequence of events occurred at the right time.  P&IDs (Piping and Instrument Diagrams) were adopted so each engineering and operational discipline could understand how every part of the plant interacted with the process – enabling weak points in the process to be identified.

A few days ago I had a meeting in Europe's oil capital, Aberdeen, Scotland, with a Sharepoint integration company, Sunnyside Consulting, who showed me how they analyse their clients existing business processes and then design a workflow system within Sharepoint to automate the process. 

Checks, sign-offs, and form routing are controlled and managed by the software to make sure that the procedures required by the business are followed to the letter.

Documenting how the IT assets are used to support this workflow, however, has always been somewhat tricky.  Trying to portray this to third parties, such as infrastructure designers, proves even more complicated, as this is usually out-with the domain expertise of the software integrators.

What is needed is a P&ID for IT which would allow each discipline to understand how every part of the IT portfolio interacts with the process. 

Please excuse the naked self-promotion, but this is one of the reasons why my company invented Business and IT (B&IT) diagrams.

In the same way that the Health & Safety Executive (HSE) use P&IDs to apply auditing and governance to industry, B&ITs can facilitate both Internal and External Audits to take place quickly and easily.

P&IDs enable weaknesses within industrial processes to be identified and remediated, and B&ITs do the same for IT.  B&ITs utilise the OBASHI methodology and enable a common language between IT specialists, business workers and management so all parties can understand why processes exists and explain the implications of non-adoption.

In reply to Prime Minister Brown’s opening statements in parliament, the Leader of the Opposition highlighted that: in the last year there were more than 2,000 breaches of security in HMRC; 8000 people receiving tax credits had their bank details revealed; that the details of 15,000 taxpayers, including private pension information, were lost in the post; and that HMRC lost an unencrypted CD-ROM containing data about UBS savings accounts – UBS being the market leader in retail and commercial banking In Switzerland.

People will always try to shortcut procedure and it is that human nature which we’ve seen tackled in other industries through communication, automation and implementing new approaches to cross functional governance.

With IT, unless we can clearly identify weaknesses in dataflow, easily explain process and make sure the true costs of taking shortcuts are clearly understood, it is only a matter of time before there are further catastrophic data breaches.

© Paul Wallis 2007.  All rights reserved.

Comments

[Mike]

Paul,

Great post. What you describe is the classic struggle between security and easy to use systems. You can't have both (at least at a reasonable cost). The best you can hope for is a good balance.

As you point out "People will always try to shortcut procedure" and the procedure isn't always applicable.

What I believe is missing is judgement and responsibility. People (and the trick is define who are the right people) need to use judgement on how to properly handle data in different situations. To make proper judgement I believe people have to feel responsible for the data in their care. They have to own, they need to understand it and know what it represents. It is easy to be cavalier when all your moving around is 1s and 0s but when it is someone "life" it takes on a whole other perspective. To me that is one aspect we in IT have never stressed enough.

Mike