INFORMATION SECURITY THE NEXT GENERATION 13 th World Electronics Forum Israel Christopher Joscelyne Board Member & Membership Chairman AEEMA November 2007

Boundaries between personal and business computing have become difficult to define because everyone and everything is becoming linked. In order to survive, enterprises must manage the new risks this environment creates.

SIGNIFICANT CHALLENGES SIGNIFICANT CHALLENGES The enormous quantity of information assets in most organisations. The enormous quantity of information assets in most organisations. Assets' inherent vulnerabilities and the potential threats to their confidentiality, integrity, and availability. Assets' inherent vulnerabilities and the potential threats to their confidentiality, integrity, and availability. Rapid adoption of new devices and methods of use inside and outside the enterprise Rapid adoption of new devices and methods of use inside and outside the enterprise

SIGNIFICANT CHALLENGES SIGNIFICANT CHALLENGES A variety of co-workers, with inconsistent attitudes to information security, working together and sharing information A variety of co-workers, with inconsistent attitudes to information security, working together and sharing information The many requirements for information security, including legal and regulatory, marketplace requirements from customers and partners, and corporate governance. The many requirements for information security, including legal and regulatory, marketplace requirements from customers and partners, and corporate governance.

COMMON THREATS COMMON THREATS Lost or stolen laptop computers (over 600,000 per year in the US, of which 97% are not recovered) Lost or stolen laptop computers (over 600,000 per year in the US, of which 97% are not recovered) Lost or stolen PDAs (current estimate is double the number of lost or stolen laptop computers) Lost or stolen PDAs (current estimate is double the number of lost or stolen laptop computers) Lost or stolen USB flash memory devices (millions lost with no protection of the stored data) Lost or stolen USB flash memory devices (millions lost with no protection of the stored data)

LACK OF SKILLS IS A SIGNIFICANT PROBLEM LACK OF SKILLS IS A SIGNIFICANT PROBLEM According to recent research, while 87 percent of organizations are confident that they can deal with viruses, spam and malware, only 35 percent feel they are able to deal with the prospect of lost data. Kace Research Study – May 2007

INFORMATION SECURITY – KEY MOTIVATORS Realization that corporate knowledge is a high value information asset that is worth protecting Realization that corporate knowledge is a high value information asset that is worth protecting Acceptance at boardroom level that protection of information assets is a corporate responsibility Acceptance at boardroom level that protection of information assets is a corporate responsibility Action at boardroom level to implement information security initiatives Action at boardroom level to implement information security initiatives

NON-TECHNICAL TREND IN 2007 Induction process for new employees that communicates policy in clear non-technical language that is understood Induction process for new employees that communicates policy in clear non-technical language that is understood Ongoing education programs to create and maintain a culture of respect for information and the need to protect it Ongoing education programs to create and maintain a culture of respect for information and the need to protect it

TECHNICAL TREND IN 2007 New and emerging technologies that protect data without choking productivity, inside and outside the enterprise New and emerging technologies that protect data without choking productivity, inside and outside the enterprise Security is becoming embedded in the infrastructure Security is becoming embedded in the infrastructure Convergence of disk encryption, removable media encryption, end point security, data loss protection, document content security and digital rights management into a suite of compatible modules Convergence of disk encryption, removable media encryption, end point security, data loss protection, document content security and digital rights management into a suite of compatible modules

SOME PRACTICAL CONSIDERATIONS “One size fits all” usually fails to meet the varying needs of enterprise employees “One size fits all” usually fails to meet the varying needs of enterprise employees Granular approach to policy enforcement allows flexibility Granular approach to policy enforcement allows flexibility Implementation must reflect levels of trust and encourage staff productivity Implementation must reflect levels of trust and encourage staff productivity Greater tracking and auditing of incoming data and outgoing data creates reports that are meaningful for fine tuning of security policies Greater tracking and auditing of incoming data and outgoing data creates reports that are meaningful for fine tuning of security policies

ENGAGING WITH VENDORS Select “mix and match” modules from one or more vendors, based on your priorities, to ensure you get what you want, when you want it, using your available technical resources

THE TASKS FOR ASSOCIATIONS THE TASKS FOR ASSOCIATIONS Establish security policies that can be enforced Establish security policies that can be enforced Guard information assets and protect data integrity Guard information assets and protect data integrity Audit and review all processes and procedures Audit and review all processes and procedures Educate staff with an ongoing program that reinforces the value of information security Educate staff with an ongoing program that reinforces the value of information security Maintain and develop a culture of security as a practical example to members and others who engage with or interact with the association Maintain and develop a culture of security as a practical example to members and others who engage with or interact with the association

FURTHER INFORMATION CHRISTOPHER JOSCELYNE SafeKnowledge ® AUSTRALIAN PROJECTS