It will probably come as no surprise to anyone in this room to know that Appleby Spurling & Kempe is bombarded with pornographic and other inappropriate images and digital files every day. Similarly, hundreds of jokes and other non-business messages are sent to our system daily, not to mention viruses. Our information systems auditors routinely spend long nights and weekends restoring systems after an attack. I am sure you will empathise. But can you empathise with the lawyers and other internal "customers" of the firm who are frustrated by the successful guardianship of our vital information systems? It sounds ironic doesn’t it, but would you believe there is a degree of frustration and tension between the users of a system and the guardian angels who keep it going?

I mentioned pornography. We all agree that our systems should not be abused to allow outside parties to send such material across our network, whether to our own people or to others. The law tells us so, the E-Commerce Code of Conduct tells us so, and common sense tells us so. But to a computer, what is pornography? It is nothing more than an image file. And that’s where bona fide users get annoyed. Many image files are perfectly innocuous, yet they get caught up in the sweep of auditing done to protect us from "naughty" image files. The good get tarnished with the bad.

Our initial response, which was the source of much of the tension in this area, was to block all image files, and to send a message back to the original sender of the email attaching the image. The sender would receive a notice saying that the file had been blocked because it contained an image. The intended recipient of the message remained in ignorance of the events until he or she more than likely received an irate phone call from a client saying that the message had been blocked.

You can imagine the phone conversation:

Does this story sound familiar? It turned out that the "image" in the blocked file was the logo of the company who was issuing the prospectus. And the problem was that the screening systems set up were designed to block all image files regardless of type. That’s the nature of the digital world, it’s automated, and particular file extensions are the only way of identifying files. A computer can’t tell the difference between a picture of corporate headquarters and a picture of the happy hooker!

Incidents like this precipitated a policy review, and the compromise between an absolute block on image files and a general free-for-all was to create a holding pen where images were reviewed for actual content. Protocols were established for time-frames for quick turnaround. Likewise, no message was sent out to the original sender, but instead a message is sent to the intended recipient advising that a file has been received from Joe Client and that it contains an image and that it is under review. This gives the attorney the opportunity to assure the IT department that the content is genuine and harmless, and to focus IT quickly on its review. But it took a lot of tension all round to get us there. Each person has a conflicting need: IT to protect; the attorney to serve the client.

Now, you may say this all sounds obvious and that your IT departments would have had the matter sorted all on their own, or never even set up a block like that, but I am sure you can find plenty of other examples where there has been a dynamic tension between what you, as systems auditors, need to do to protect your systems from harmful files or from supporting content which breaks the law, as opposed to what your internal colleagues need to do to generate business for your company. Business after all is what brings in the dollars to pay all our salaries.

Tension is always present where you have conflicting goals. Both goals may be entirely legitimate. Of course it is OK to protect the expensive systems that companies have invested in so heavily. It would be negligent not to. Of course it is OK to want to render fast, seamless, and smooth service to the clients who pay our bills. It would be economic suicide not to. So how do we resolve the conflicts between these two goals? What follows in this presentation is to examine what the sources of risk are, and how tension can arise in dealing with them. I may even suggest a few compromises between absolute security and open business efficiency.

I will examine how Information Systems auditors are the gatekeepers or referees who make strategic decisions about protection versus efficiency. They have to referee the business users of the system within the rules of configuration and security. I will assert that such decisions can only be made in consultation with end users, with an eye to how your business’ clients will perceive whatever it is that you do. I will assert that auditors need to take a certain degree of risk, in agreement with senior management, otherwise the chances for business success are not being optimised.

This presentation does not address ordinary systems maintenance to avoid downtime, but rather focuses on the "people risk" element, and that means file content and file usage whether beneficent or malicious, with the systems auditor as referee between the people and the systems.

People make money for businesses, or people cause them loss and liability. It may sound simplistic, but in order to make money, people need to be able to act and re-act quickly to market information and customer demands. In today’s world this means accessing emails, web sites and networked services smoothly and quickly. It means empowering all levels of an organisation to deal with clients and access important company information and data. But, of course, the minute you give a wide body of people wide access to vital systems and data, the opportunity for mischief arises.

Sometimes, the "bad guys" are outside the organisation. We all know what hackers can do, and likewise what the pranksters who create and transmit "viruses" can do. However, auditors probably more than anybody will be familiar with what the "good guys" can do. And that means a company’s own employees. Carelessness, failing to log-off, mis-using systems in an "honest mistake" all occur daily. Perhaps employees simply wish to copy data for home use, or to "lend" it to a friend. And it gets worse if employees are disgruntled for whatever reason, when they may even actually try to sabotage the systems. There is also a very real threat that a business rival will either infiltrate one of their own employees into your organisation, or simply subvert one of your existing employees.

So a conflict arises. How can auditors track what is going on within an organisation, ensure that access to vital data is open, but not insecure, and yet not impede the freedom of action required in today’s work environment? So the conflict is between security and access versus speed and efficiency. How many people should access what systems and when and how? Should there be a limit on the authorised users of particular systems? Should their systems be accessible offline only or online? Should particularly sensitive systems be accessed via one terminal only? All of these choices have implications for user-friendliness. Without ease of use, however, the organisation cannot function as effectively in today’s competitive market.

Ease of use in this context must mean that an authorised user can effect a communication or obtain data without error or no-access notifications, without time delay and with data integrity on forward transmission. That’s a tall order. And it conflicts with the systems auditors’ primary duty to keep track of file access (a monumental task) to verify authorised usage and to maintain gateways for security purposes.

So how can a resolution of the inherent conflict be reached. First let us look at what some of the risks are, and then see how they can be dealt with; ideally in a way that meets the need for security and the need for freedom.

Again, it’s all about people. The more people who can access your system, the greater the risk.

We mentioned hacking earlier. Essentially, if you have a link to the outside world, you are at risk. The risk is of damage or loss to vital data. Equally, it is the reputational risk to your organisation: who would trust their money or credit card details to an organisation that gets hacked? As you all undoubtedly know, any 17-year-old can come in over the web and attack your system. That’s why you all no doubt have firewalls, which you assume are effective. But people are the problem, and people wander in the front door in a variety of guises. Once inside, there’s no saying how they may acquire passwords, dial-up numbers and find other ways in to your "fortress" system. But do you want a fortress, even to prevent hacking, if to do so means your co-workers can only get on the Net with special permissions and assistance. Surely, the better approach is to institute protocols for screening visitors and rotate passwords? There are plenty of low-tech, user-friendly solutions to hacking risk: people preparedness.

You will have heard many times that the true value of a company these days lies in its Intellectual Capital. What that is, of course, is its people, know-how and databases. Unfortunately, Intellectual Property is the most vulnerable to theft and misuse. Whether innocently or maliciously co-workers can gain access to confidential information or general databases. The information can then be copied, deleted, altered or broadcast. Proprietary business systems or business methods can be leaked to competitors. Sensitive, perhaps embarrassing information could suddenly appear on an Internet bulletin board. The only way, it might appear, to protect against this risk is to keep all these intellectual assets under lock and key. But as I say above, if you do that, how can productive workers use them to make profits for the company? Information systems auditors play a key role, therefore, in working with management in establishing appropriate flexible security and staff vetting systems. Auditors must be able to monitor data tampering, but simultaneously allow data flow, for the reasons discussed above. Protocols need to be developed for risk tolerance. And the bottom line is, you need to take some risks if you want to succeed in business. Fortunately, risk management boils down to hiring and retaining the right people. Good hiring practices are the best mitigator of risk. Motivate staff by giving them a stake in the intellectual property they help to create and your systems will be that much more secure and effective.

A major feature of doing business today, given the need for global scale and the concentration of companies on their "core competencies" rather than trying to be all things to all people, is the building of alliances. In the bricks and mortar world, we see the One World Alliance of the various airlines so that they can share codes. But equally, in the age of the Internet, and perhaps less visibly, there are essential alliances necessary in order to deliver even the most basic products: take books. Amazon.com has to work in electronic tandem with its own book indexing system, non-proprietary warehouses, payment systems and banks, courier companies, shippers, and rare books acquisitions teams among others. Each one of these is plugged in electronically into Amazon.com headquarters and systems. Just like the internal staff of any company, each one of these "partners’ represents a security risk once they are hooked to a company’s system. Certainly access can be restricted to non-related parts of the alliance service, but once there is a route in a "partner" could have access to do wrong if the partnership ever falls apart. Indeed, there need be no difficulties between the partners, just simply a disgruntled employee of any one of the partners who can then infect the whole chain of relationships. What can Auditors do about it? They must be involved with management from the very early days of discussing trading partnerships which involve a mutual electronic hook-up. There must be early planning of security structures which firewall each separate partner from the other except in relation to the mutual project. Each partner must have similar staff screening systems to the other.

Virtual Private Networks, dial-up access, wide-area networks. They sound great for enabling travelling members of staff or distance-commuters to log-into their company’s systems. Certainly, I myself was a distance commuter for several months a few years ago, though I used principally email. But the same principles discussed above apply. The minute there is an external line into your network, there is risk exposure. Auditors need to be particularly vigilant with distance workers, who themselves may not be technologically savvy and that adds an extra dimension of risk in that travelling workers may leave passwords on laptops which are then stolen or accessed by unauthorised persons. Distance workers present a very real risk, in that they may easily be subverted, and operate their computers without any risk of physical oversight.The dynamic tension between business need and security in this instance tilts heavily in favour of the auditors, who should be setting strict guidelines for distance workers on systems security.

My firm, for example, has an interactive web site called www.justaskinc.bm. The servers are separate from our main system, and thus there is no direct connection with our main network. So where is the risk? Well, it’s not direct to our network, but there are substantial risks to our reputation if it all goes wrong in some way. If people who use the service lose their data, or we fail to deliver a company due to systems error, or, worse, if the data we have collected is stolen or abused we are exposed. We are fortunate first in having web support engineers who act as auditors and monitor all traffic. But this all serves to illustrate what you as systems auditors need to ensure in relation to online, particularly interactive sites operated by your companies. Just to be clear, by interactive I mean that there is real time querying of a company’s data by its clients on payment of a fee, and whereby services are initiated by dynamic questionnaires that inform the resulting service. What can go wrong is many and various, but it is particularly on the payment side that there needs to be very careful interaction between the systems auditors, the company’s finance department and the online payment gateway company. Otherwise there is exposure to credit card fraud, or client denial of a previously authorised credit card use. Getting your systems wrong can result in clients "charging back" the debit to their credit card. This imposes costs and penalties on your company. And yet, the controls you institute cannot be so rigorous as to slow down the interactivity. What degree of risk can you afford to take?

There is a huge degree of tension between the business people who have conceived the web service. The marketing people who promote it and the engineers who run it. Only by arbitrating risk can this tension be resolved. Everyone wants the systems to be fast and easy to use. Yet everyone wants it to be 100% reliable and secure. These aims are not necessarily mutually compatible. Trade-offs will be necessary to get to launch and to react competitively afterwards. Systems auditors will be the key arbiters of these risks, and should be suggesting solutions which do in fact carry some risk.

Systems auditors sometime need to be moral policemen as well as technical officers. It may well be that there is a duty on auditors to be the "web master" of corporate bulletin boards or of employee access to chat rooms. At any rate, auditors will need to ensure that somebody from management is reviewing bulletin board usage by staff. The risk is that either confidential information will be posted, causing liability to clients and loss of business to the company itself. Or that something damaging will be said about a competitor which will amount to defamation, thus opening the way to lawsuits and huge damages. Auditors are on the front line to defend their companies against such risks. Here again the dynamic tension tilts in favour of the auditor. There is only perhaps marginal economic value in chat rooms, though internal bulletin boards may have more value. Appropriate screening needs to be instituted so that doubtful material can be removed. Certainly, the law courts have found liability where a company knowingly allows defamatory or confidential material to remain on bulletin boards. And, further, companies have what is known as "vicarious" liability for messages posted by the employees on outside chatrooms.

There is an increasing practice for companies to create extranets with their clients whereby key business partners can view their files held by the other and generally share information in relation to their mutual dealings. All of the same concerns apply as expressed under Alliances above. There is also of course the added concern of violation of confidentiality, where one client accidentally or maliciously is able to view the client data of another client. Here there is a dynamic tension between the ease of use by the client and the absolute necessity to preserve confidentiality. The security systems for firewalling data belonging to different clients must receive particular focus, and there must be staff training to ensure that access to non-authorised data is not inadvertently given out.

I have tried to explain above the vital role that systems auditors play in the modern economy. Certainly in your own jobs you will be aware of the sensitivity of the material you encounter. One can learn a surprising amount about the operation of the business by watching what runs through the pipes. So there is a heavy responsibility on the auditor. This responsibility starts well before anyone switches on their computer in the morning. Auditors in my view must be involved from the initial stages of a businesses investment in systems in planning security and monitoring systems, and into the mix of their considerations they must bear in mind the dynamic tension with the business needs of the organisation. Auditors are gatekeepers. Since you have your finger literally on the switches which control the flow of data, since you have the capacity to view people’s sessions as they happen live, there is a tremendous responsibility to ensure that the systems are being used properly. Yet you cannot abuse that power, because to do so is to reduce the economic opportunities of the organisation. So what then should auditors do to get the balance right, to keep the door open wide enough to enable effective commerce but closed enough to keep out the bad guys. How do they referee the conflicting needs of business and systems?

I am a great believer in the "keep it simple" philosophy. I also believe, and I can’t emphasise this enough, in getting in the right people from the outset. This is in fact the single most important thing to prevent internal fraud and subversion. If your staff are competent and committed to your business, not themselves or someone else, you will be fairly safe. Thus, I would advise against creating systemic risk before you even get started. What that means is the more independent systems which try to link together the worse it is. Wherever possible try to build unitary systems, and then control access by a combination of well-trained and well-screened people using clever password security systems. If you have numerous separate databases being run with numerous different front ends from different locations, it is inevitable that you will be exposed to risk. You can respond harshly, and then slow down the business or you can respond pro-actively by working towards simpler more inherently secure systems. Where there is "inherent" security, you are then able to be more flexible with the users. The dynamic tension eases.

So, where you have one door, it is easier to keep it open to the right degree. But the more doors you have the more difficult it is to monitor them and the more tightly jammed an auditor might feel each one needs to be to be, simply because of the difficulty of keeping track of so many at the same time. Again, unify systems, limit the routes in, work with the users and you will be able to find that delicate balance between protection and profit.

Specific Questions relating to this article should be addressed directly to the author.

Do you have a question for the author?

Interested in attending the next free seminar/webinar on this topic?
Click here to register your interest.

Other Information about Appleby

View summary of all information contributed by Appleby

View Firm's Website

View Popular Related Articles on Media, Telecoms, IT, Entertainment from Offshore

Remote Gaming In Malta - Our Service Offering

In the last few years, a large number of remote gaming operators have established themselves in Malta.

CISO – The Voice For Information Security

Business leaders have come to realise that their organisations’ dependency on information technology is now more prevalent than ever.

How Firms Can Implement A Social Media Strategy

Facebook, Twitter, e-mails, blogs, YouTube, Linked-In and Skype - words that we are all familiar with as they permeate our day-to-day lives.

Opportunity Calls - An Update On The Evolution Of Mobile Payments

At the latest iPad launch event, Apple CEO Tim Cook announced that we have now entered the post-PC era.

The Future Of Gambling: A Multi-Faceted Quandary

By creating a highly regulated environment and enticing fiscal incentives, Malta has been on the winning side of the sphere and many operators have set up or relocated to the island.

Averting A Digital Pearl Harbour?

This year could well be remembered in technology law circles as the Year of the Acronym. From SOPA to PIPA to ACTA and we are still in the second quarter of the year.

E-Commerce - Thinking Tax