Tag Archives: information systems

How to ‘Detangle’ Your IT Issues

If you have ever experienced detangling a four-year-old’s hair, you know it is a mess! The amount of fighting and screaming along with negotiations (I will give you ice cream), sometimes threats (no iPad for you) that go into that process can be unbelievable. The situation is not so different a scenario when we try to detangle the spider-web systems that exist in organizations today. Business folks fight with IT, have back-door negotiations with leadership about priorities and engage in countless back-and-forth exchanges of business requirements. Sound familiar?

How can organizations cope in a “detangle” situation? Here are three recommendations:

1. Comb through your systems one small section at a time.

If you have tried to comb through a large section of tangled hair, what happens? You get stuck, or your comb breaks. If you comb a small section at a time, you could effectively detangle. Take one part of your process, application, module, etc. and determine ways to streamline the operation. “Eat the elephant one bite at a time” to ensure you won’t get stuck in your innovation and transformation efforts or end up in a mental asylum.

See also: Creating Win-Win-Win Scenarios  

2. Use a detangle spray.

I love detangle spray! Taking a small section of the hair and applying the detangle spray makes the combing faster. Here is where I would recommend organizations look at outside help. Is there a service like virtual transformation office that can expedite your transformation or innovation efforts? Transformational consultants are of a different breed. They cut through the BS; if they don’t, you don’t have the right one working for your organization. These folks bring outside technology, industry-level perspectives and agile processes to act as a “detangler” in your initiatives. For most organizations, operational needs tend to outweigh innovation efforts. An external perspective can ensure organizations are looking beyond the operations and focusing on innovation.

3. Chop it off.

Chopping off the hair was my final resort with my toddler’s hair. I went to the barber and had her hair cut. Why? It was just too painful to continue to maintain. With your spider-web systems, you will come at a point where you have to say good-bye–good-bye to your green screen friends, VB screens from the early 2000s and old funky .asp apps. Are there startups that you can bring to your organization to provide new tech that can eliminate multiple legacy applications? At Benekiva, we pride ourselves on eliminating four to nine systems leveraged by claims staff to process one claim. How many systems are your teams using to complete a task or work unit?

You may not be ready to chop everything off, but you can do it gradually. Change takes time.

See also: Culture Side of Digital Transformation  

Disrupting is the name of the game for all organizations. Even if you are a giant company, you have to keep up or you risk going bald, at which point no amount of combing, spraying or chopping will help.

New Way to Audit Digital Assets

In the real world, it would be considered reasonable and appropriate to require an independent audit of digital assets to be insured. In cyberspace, this is more challenging. Insurers have to rely on the insured to tell the truth about what assets have been affected by a breach.

Integrity standards for data enable insurance companies to conduct an independent audit of what digital assets exist (e.g., client data, intellectual property) prior to a breach, thus preventing fraudulent claims.

One aspect of a data integrity standard is keyless signature infrastructure, known as KSI. KSI is a disruptive new technology standard that can effectively address some of the issues insurers face in the rapidly emerging cyber liability domain. It can enable mutual auditability of information systems to allow stakeholders to know the cause of a breach, mitigate the risk of breach escalation in real time and provide indemnification against subrogation and other legal claims.

The concept of a digital signature for electronic data is very straightforward: a cryptographic algorithm is run on the data, generating a “fingerprint of the data”; a tag or keyless signature for the data that can then be used at a later date to make certain assertions, such as signing time, signing entity (identity) and data integrity. KSI offers the first Internet-scale digital signature system for electronic data using only hash-function-based cryptography. The main innovations are:

  1. Adding the distributed delivery infrastructure designed for scale
  2. No longer requiring cryptographic keys for signature verification
  3. Being able to independently verify the properties of any data signed by the technology without trusting the service provider or enterprise that implements the technology

Other features include:

  • Unlike digital certificates, keyless signatures never expire; the historical provenance of the signed data is preserved for the lifetime of the data, and people are not required in the signing process.
  • Use of keyless signatures strengthens legal non-repudiation for data at rest.
  • There are no keys to be compromised or to revoke. This fundamentally changes the security paradigm. It is important to understand that if data integrity relies on secrets like keys or trusted personnel, when these trust anchors are exploited there becomes an unlimited liability for the data protected by those trust anchors. This occurs because there is no way to determine what has happened to the data signed by those private keys or maintained by those trusted personnel. Evidence can be eliminated; data changes can occur without oversight; and log/event files can be altered. The exploiters can provide the picture they want you to see. Keyless signatures remedy this problem.
  •  During a breach, active integrity can be provided with cyber alarms and correlated to other network events by auditors, network operations center and security operations center(s). Active Integrity means real-time, continuous monitoring and verification of data signed with keyless signatures. With active integrity, real-time understanding is achieved as to the coherence and reliability of technical security controls and whether the digital asset has integrity.
  • Underwriting cyber policies becomes much simpler and more efficient because there is transparent evidence certifying the integrity of the data, the technical security controls protecting the information and rules governing the transmission, modification, or state of the insured asset(s).

A “managed security service” resulting from the implementation of KSI marks a new era for insurers. As they seek organizational intelligence of digital assets to make real-time policy adjustments, they are also making concrete conclusions about the insured asset risks, threat, exposure and cyber landscapes affecting clients. Claims processing and disputes become simpler as the technology preserves the forensic traceability and historical provenance of the digital asset, enabling rapid determination of when and how a breach or manipulation occurred and who or what was involved. Hackers and malicious insiders cannot cover their tracks. Moreover, proving negligence is now possible. Negligent acts may be quickly detected and proven in the event the service provider does not comply with the contracts maintained in force with the enterprise.  

Most breaches today go unnoticed until long after they occur and the damage has been done. Active integrity involves continuous verification of the integrity of data in storage using keyless signatures. It is equivalent to having an alarm on your physical property and a motion detector on every asset that cannot be disabled by insiders.

Because of the volatile nature of electronic data, any hacker knows how to delete or manipulate logs to cover his tracks and attribute his activity to an innocent party, which is why attribution of crimes on the internet is so difficult. Integrity is the gaping security hole. A loss of integrity is what leads to data breaches, introduced by malware, viruses or malicious insiders.

Public key infrastructure (PKI) will never be the solution to integrity or usable for large-scale authentication of data at rest. The forensic evidence of keyless signatures makes legal indemnification issues easy to resolve, highlighting who, what, where and when a digital asset was touched, modified, created or transmitted. This places the onus on the “use” of data and not collection, providing auditability across service providers and the internet. Privacy is maintained, but there is also transparency and accountability for how data is used. Every action can be traced back to the original source that is legally responsible. This simplifies service-level agreements, pinpoints liability in the event of accidental or malicious compromise, and indemnifies independent data providers from legal claims.

This article is an excerpt from an EY report titled “Cyber Insurance, Security and Data Integrity; Part 1: Insights into cyber security and risk — 2014.” For the full report, click here