Developing greener data centres

By Phil Andrews, operations director, Data Centre, Cisco for European Markets

The ever-increasing power consumption of data centres is rapidly putting energy efficiency at the top of the data centre manager's agenda. Even if energy costs and the threat of a shortage of power to support data centres weren't driving this efficiency agenda, the threat of carbon capping and legislation soon will. Reducing the demands being made on the data centre by businesses is not an option so what are the alternatives?

This article looks at a combination of subtle trends driving the impending power crisis in the data centre, strategies and technologies to reduce power consumption whilst meeting the evolving needs of the business, and approaches for the short-term and long-term future.

From barely being an issue a few years ago, the environmental impact of data centres has risen to the top of many IT managers’ agendas. The very real concerns over power consumption need a convergence of technological and non-technological solutions to mitigate/address the issue, says [name to come] from Cisco Systems.

How green is your data centre? Until recently, such a question would have raised eyebrows among IT managers. But with rising storage requirements and the levels of data centre infrastructure, the increase in power consumption of such facilities has been getting harder to ignore in recent years, despite the fact that accurate measures of data centre power use are difficult to come by.

Historically, power consumption has not been an issue for data centre managers for a number of reasons. First and foremost, data centres have often sat at the heart of strategic moves to expand or improve the business, and as such have not usually had to contend with cost-containment measures.

A second reason is that IT divisions have not traditionally had responsibility for the environmental impact of their data centres. Facilities departments usually foot the power bill and are often in charge of implementing environmentally-friendly practices.

Thirdly, there has never been much of a green alternative to data centres. Unlike, say, corporate air travel, you cannot just stop using IT storage systems and expect the enterprise to carry on as before.

As a consequence, some data centres have been allowed to turn into the gas guzzlers of the IT world. It takes about 830 pounds of coal to run a computer for a year. And in the case of servers, research by Intel shows less than 20 percent of power actually goes to the CPU.

This carefree attitude to power use is changing now, though, as companies face spiralling bills to maintain their sprawling data centre operations.

Data storage requirements are currently expanding at a compound annual growth rate of between 40 percent and 70 percent. Server use grew by 12 percent in 2005 and is expected to increase.

As a result, energy costs are expected to mushroom from 10 percent up to 30 percent of average IT budgets, overtaking all other forms of data centre expenditure and meaning IT managers will effectively loose a fifth of their budget to power consumption.

Exacerbating the problem is the fact that cooling tends to become less efficient as power consumption rises. The simplest way to increase cooling to a given rack of equipment is to simply open up more floor tiles.

While this is simple fix in the short run, it does not work much above two or three because cooling air being provided to one rack will be ‘stolen’ from adjacent racks, reducing the amount of cooling provided to neighbouring racks.

Another reason is that as more floor tiles are opened up for a particular rack, the distance from the tile to the rack increases. The cooling system ends up being less efficient because it ends up cooling the atmosphere in the data centre in addition to the equipment.

Both of these effects result in higher cooling bills, a reduced ability to cool equipment in the data centre on a per-rack basis and a less efficient cooling system.

Since cooling and heat removal are typically growth constraints in the data centre, this wasted cooling capability will act as a drag or a cap on growth.

Over the next three years, says Gartner, 50 percent of large organisations will face an annual energy bill that is higher than their yearly server budget. Google has already notoriously reached this point. And it gets worse.

In 2005, the University of Buffalo paid US$2.3 million for a new supercomputer, only to find there was not enough power to switch it all on.

An increasing number of data centre managers are similarly finding that there simply is not enough power available to expand their operations any further.

Gartner says most data centres are now operating at 100 percent capacity in terms of power and cooling, versus 70 percent capacity for data storage, meaning that energy, not memory, is now the main limiting factor on growth. (Availability of suitable space is also an issue.)

This puts data centre managers in a difficult position, since demand for IT storage is not going to go away.

If anything, compliance requirements such as the banking sector’s Basel II or Sarbanes-Oxley regulations, combined with the need to roll out ever faster and more complex IT applications, are increasing the demand for data centre services.

As a result, the only way to go is to cut power consumption and thereby reduce the environmental impact of data centre operations. Doing this is not easy. The actual amount of power required by data centre devices is only part of the equation.

Each watt consumed by IT infrastructure carries an additional ‘burden factor’ of between 1.8 and 2.5 for power consumption associated with cooling, lighting, conversion and distribution, all essential energy-consuming services that have to be taken into account in efficiency plans.

In addition, simply checking the power rating on the back of a device will not necessarily give you an accurate picture of how wasteful it is; its processing power and utilisation are also critical factors in determining its overall efficiency.

Because of all this, it is not easy to accurately measure and track data centre power consumption and even now few IT managers are building operating efficiency considerations into their purchasing criteria, although it is likely many will need to soon.

The good news is that recent developments by equipment vendors have led to a number of innovations that can help data centres run more efficiently. Server manufacturers, for example, are looking at introducing variable power consumption based on CPU activity.

The beneficial effects of this will be tempered, however, by the fact that server virtualisation strives to increase CPU utilisation to upwards of 80 percent.

Another option is the creation of blade centres and multi-core CPUs. This will raise the percentage of power going to the CPUs on a per-server basis, improving the overall power efficiency.

It will not necessarily reduce the power per rack, though, without other measures such as IO consolidation.

Where there is perhaps more scope for improvement is in the data centre’s network components, which can be used to create efficiencies in three ways:

  • By switching to devices that offer more processing power per watt.
  • By incorporating more services into each device, so that redundant devices can be removed from the infrastructure.
  • By using virtualisation to ensure that the remaining devices are used as efficiently as possible.
Looking at perhaps the most obvious measure for reducing power consumption, which is the efficiency of the devices themselves, it is fair to say that virtually all equipment manufacturers are working hard to bring leaner machines to market.

As an example, the efficiency of power supplies for the Cisco Catalyst 6500, the most widely used switch on the market, has improved from 70 percent to 80 percent since it was introduced in 1999.

Forthcoming Cisco power supplies are expected to be 90 percent efficient. At the same time, Cisco is continuing to reduce the power per port required by its data centre platforms, with a 30 percent to 50 percent reduction goal.

What is also significant about many of these new, more efficient platforms is that they can support a greater range of services. This can have a major impact on power consumption.

A typical application server may have multiple appliances associated with it, such as firewalls, secure sockets layer termination devices and load balancers, each with its own power and cooling requirements.

A rough and ready calculation shows these could represent up to an additional 2700W of power and cooling load per server, representing a considerable drain across the entire data centre.

Nowadays, however, functions such as security and load balancing can be incorporated into the network fabric, making it possible to eliminate the appliances and their associated power loads.

Doing this has several added bonuses. It lowers the complexity of the overall infrastructure, making it more manageable, reducing latency and eliminating single points of failure.

Finally, virtualisation can further increase disk utilisation by around 70 percent simply by incorporating all a data centre’s disparate storage devices into a single fabric that is then compartmentalised logically rather than physically.

In a virtual storage area network, each device can be ‘filled up’ to full capacity with data from various sources and applications, so fewer devices need to be used at any point in time.

In addition, the network can give priority to more efficient devices, so that those that represent the greatest drain on resources are only used when absolutely necessary.

The benefits of virtualisation can be significant. Taking a tape subsystem offline can save nearly EURO€3000 in power and cooling per year.

Taken together, these measures could reduce data centre power requirements by up to 85 percent, certainly enough to allow significant further expansion in storage area network use at current energy levels.

Storage area networking technologies can also help reduce server power requirements in a number of other ways.

Aside from power conversion losses, peripheral component interconnect cards and hard drives are the two biggest non-CPU power loads on a typical dual-core server, so moving to diskless servers will potentially remove a 72W load.

This translates into approximately 1.2kW per rack, in addition to reducing costs and improving the availability of servers. Another big area of opportunity is multifabric input/output and server I/O consolidation.

Consolidating storage and Ethernet connections on a single link reduces the number of network interface card ports required on the server (as well as switch ports), reducing the amount of cabling needed and thus improving airflow around the rack.

Furthermore, there are other areas of technical innovation that could help create further savings.

As an example, Cisco has an Automated Power Management System (AMPS) to control energy consumption in laboratories where it develops and tests new equipment.

These labs represent approximately 20 percent of Cisco's real estate, although the testing equipment is rarely used continuously. The system identifies equipment not in use and automatically switches it off.

Separately, Cisco is also partnering with the U.S. Department of Energy's Lawrence Berkeley National Laboratory to research technologies that could significantly reduce energy demands, as well as improve reliability and lengthen equipment life in data centres.

The technology eliminates power conversion losses by using DC (direct current) rather than AC (alternating current) power to provide electricity throughout the data centre.

According to Intel, AC to DC power conversion losses account for around 36 percent of the total server power budget in a typical data centre.

On a more general level, using IP networks to monitor and control energy use can help reduce power consumption across the business as a whole, a concept which Cisco has dubbed ‘Connected Real Estate’.

With all this, technology clearly remains only part of the answer to the issue of data centre power consumption. As indicated above, there can be challenges in identifying whose responsibility it is to deal with energy supply in the first place.

Organisations need to take a holistic view of the problem. However, it is a fact that technology can now have a significant impact on power consumption and it makes sense to start assessing developments in this field now.

Currently the power consumption of data centres is not regulated, but with climate change moving inexorably up the political agenda worldwide this is unlikely to remain the case for long.

And there are other pressing reasons to evolve to more environmentally-friendly operations as soon as possible, including the growing likelihood of outages as power and cooling systems come under increased stress.

Specifically regarding the network components of the data centre, there are a number of steps you can take now to reduce power consumption. They are:
  • Consolidate networks – fewer networks equals less cost and a reduced storage power draw.
  • Avoid gateways and consolidate functions – specialized appliances are not power efficient due to redundant internal cooling, switching and power conversion elements.
  • Bring in virtualisation – one network or network element per customer is inefficient in terms of power and space, so consider technologies such as Multiprotocol Label Switching to enable future virtualisation.
  • View power requirements holistically and prioritise efforts based upon reducing overall power consumption.
The need to save energy for the sake of the planet is now well established. Within data centres, the need to save energy is no less critical, not just for the sake of the environment but in order to ensure the enterprise’s viability, too. Now is the time to go green.

Cisco is exhibiting at Storage Expo 2008 the UK’s definitive event for data storage, information and content management. Now in its 8th year, the show features a comprehensive FREE education programme and over 100 exhibitors at the National Hall, Olympia, London from 15 - 16 October 2008 www.storage-expo.com

Source: StoragePR

How to multiply the uses of your Business Continuity Infrastructure

Ian Master, sales and marketing director UK, Double-Take Software

Introduction
Business continuity (BC) infrastructure is typically thought of as a means to get data offsite. IT managers don’t necessarily realise that the BC infrastructure they are building can provide much more. A well thought through deployment can provide the ability to move information technology systems anytime, anywhere, for whatever purpose, without interfering with ongoing operations. Whether recovering from a disaster, simplifying routine server maintenance or even migrating whole data centres, a good deployment can provide a dynamic infrastructure that ensures effective business continuity planning as well as making the data centre manager’s life a whole lot easier.

A day in the life of a data centre manager
To state the obvious, data centre managers don’t spend their working lives exclusively worrying about large-scale disasters. Their day-to-day experience is more likely to include managing smaller business continuity and infrastructure issues. How can they maintain full service when they know a shared disk is starting to malfunction and needs to be swapped out? How can they replace a physical server because it is no longer performing optimally? What happens when entire clusters of servers need to be moved because the nodes lack disk or processing ability? What happens if the entire data centre needs to be moved to a different location?

Building a dynamic infrastructure
Data replication solutions, which copy data in real time from one server to another to create a complete duplicate on a live backup system, provide very high levels of data protection and availability. However, data replication is just that; it only protects an application’s data, not the application itself. In the event of a disaster, system administrators will have to hope that all of the application backups are valid and can be restored, because if not, they’ll have no choice but to find the installation disks and sometimes even that isn’t an option. To overcome this, the more sophisticated data replication solutions provide byte-level replication for application system states so that administrators have the ability to provision an entire server at the touch of a button and keep business critical applications up and running.

Another tool used to reduce hardware costs and manage infrastructure more flexibly is virtualisation. Virtualisation provides data centre managers with the ability to move servers “dynamically” to a different virtual machine where more processing power or disk space may be available. However, the process of moving virtual machines is limited to the virtual infrastructure and sometimes only the same physical server where the technology is hosted. By combining data replication that moves data and the application system state, virtualisation, WAN accelerators, operational monitoring and security tools, you now have the ability protect and dynamically manage your entire data centre, regardless of the situation.

Dynamic infrastructure in operation
Using host-based replication allows you to replicate data and operating systems, independent of hardware and in real time, while systems are still in production. Administrators are able to replicate from physical to a virtual environment or vice versa, physical-to-physical or virtual-to-virtual, all while the end users are accessing the data.
Data centre managers are using dynamic infrastructures to move entire data centres without end users even being aware, easing operational management as well as meeting the most stringent business continuity requirements. If a server is in need of maintenance, the data centre manager isn’t committed to a 2.00 am Sunday morning change control window just to tweak a configuration setting or perform a reboot. The operation of that server is dynamically moved to another without interruption, allowing the technician to take as long as needed to perform maintenance or repair that server. Maybe the part from the vendor won’t be available for 10 days? Operations continue uninterrupted and the maintenance window is open to whenever it is convenient.

Conclusion
If you have the ability to move systems anywhere, anytime, for whatever reason, without interruption to users, you have just exceeded a rather large piece of your company’s business continuity requirements and, more importantly, maximised data centre uptime. Dynamic infrastructures are providing the ability to restore business operations after a disaster not only to a functional level but also to the level of service that your end users expect, as well as providing the ability to seamlessly manage data centre operations.

Source: StoragePR
<>

Angelina Jolie Guest Stars in Malware Scheme

Spammers use sensationalized headlines to lure unsuspecting computer users

BitDefender researchers have identified a new wave of spam messages that use fake events related to actor Angelina Jolie in order to trick users into downloading and installing Trojan malware onto their computers.

This new campaign of spreading malware is mostly carried via spam messages based around an alleged adult video footage with the movie star. In order to watch the movie, users have to download binary file, video-nude-anjelina.avi.exe, which is infected with Trojan.Agent.AGGZ.

The spam message is comprised of an explicit image of Angelina Jolie, along with some text claiming that the mail has been sent as part of the MSN Featured Offers program. The text message plays a double role by it trying to trick the user into thinking that this is a legitimate news message and by preventing spam filters from labelling the entire mail as spam message.

“The spam wave is part of a larger category of unsolicited mail messages that rely on social engineering techniques in order to lure unwary users into installing Trojans,” said Vlad Valceanu, Head Of Antispam Research. “This type of attack seems to be extremely successful, as the number of messages has quickly escalated over the last couple months. In order to achieve their goals, spammers usually rely on international celebrities and their pictures, along with catchy, yet fake news leads.”

This is not the only incident involving Angelina Jolie. Recently, the actor has given birth to two children, and spammers took advantage of the event in order to infect more computers. The spam campaign following the event wrongfully announced the fact that Jolie gave birth to no less than five children, and even offered users a link to a website allegedly hosting a small video with the event. The announcement, combined with Angelina Jolie’s fame was meant to take advantage of users’ hunger for sensational events.

Once on the respective page, users were shown an image impersonating a flash video player. When the user landed on the compromised webpage, the download started immediately, without any user intervention (a procedure also refered to as drive-by download). The binary file was infected with Trojan.Downloader.Exchanger.Gen.1, a piece of malware that has been widely used in another spam campaign promoting an alleged antivirus utility, called Antivirus XP 2008.

Although the approach is relatively new, the underlying technique has been widely used in the past. This campaign mostly targets computer users who are not educated in computer security - as they are not aware about free online scanners offered by major security providers.


The spam message directs the user to a legitimate webpage who’s index page has been doubled to facilitate the attack. For instance, while the normal home page is index.php, the compromised URL would always end in index1.php. This secondary index page is neatly crafted using the Windows Vista look-and-feel (the Aero wallpaper and icon buttons). The professional look dramatically contributes to gaining users’ confidence, but there are a few details that should tip off the visitor about the scam.

For instance, the virus top on the upper right side of the screen displays the most aggressive viruses that were active during May - meaning the page has not been updated. Secondly, the other text elements are written in plain English, with ambiguous explanations (such as ”Trojan attacks damage more than $3 million/hour.”) The spam message itself is written using poor grammar, with multiple obfuscations to trick spam filters.

”This spam wave built on an older recipe, making heavy use of text obfuscation in order to prevent spam filters from identifying and marking the message as junk,” said Vlad Valceanu. “The message itself should be enough of a warning for the user that the advertised piece of software is not legitimate and might come from ’unorthodox’ sources. More than that, users should pay extra attention to webpages that automatically try to download a file on the computer.”

Once installed on the computer, the rogue antivirus utility would stealthily start installing other high security risks such as adware, spyware or other malware from multiple servers or sources on the internet. Also, when run, the antivirus would display that it found multiple fake or false security threats on the host computer. This is a common tactic for rogue security applications, as they try to mislead unaware computer users and make them pay for the “full” version of a bogus utility.

Source: BitDefender News Center
<>

P.S. Such headlines are not limited to dealing with Angelina Jolie or other such celebrities and such malware also comes by means of emails with other titles, such as claiming to be news and weather information, news of military operations by US and allied forces in Iraq, Afghanistan, or claims that attack on Iran has started, and many other such headlines.

The advice can only be as always... DO NOT OPEN such emails.

BitDefender Protects Against Zero-Day Microsoft Word Bug

The BitDefender Labs released a signature update to protect clients against the latest unpatched Word exploit.

The vulnerability affects Word 2002 SP3 , could be exploited by an attacker to "gain the same user rights as the local user", according to Microsoft. The exploit is already being used in the wild.

"The samples we retrieved were already being detected as malicious by BitDefender software, as the exploit was being used to drop a malicious executable file that we had already signed. As of this morning, we've also added detection for the exploit itself, blocking this avenue of attack against our clients once and for all" explained Senior BitDefender AV Researcher Attila Balazs.

The dropped component is a backdoor detected by BitDefender as Backdoor.PoisonIvy.CV. Once installed, PoisonIvy grants complete control over the affected computer to an attacker.

Malicious files containing the exploit are detected by BitDefender as Exploit.Word.MS-953635.A. The vulnerability itself is detailed in Microsoft Security Advisory 953635. An analysis of the PoisonIvy backdoor variant used in the attacks is ongoing and will be published on the BitDefender website as soon as possible.

Source: BitDefender News Releases
<>

Comment: Now, that's why I am glad to have BitDefender as my protection software. And while it takes a little longer - a lot, in fact - to do a full system scan compared to AVG which previously was run here, the thoroughness of the scan seems to be superior and now we can see that the 2-hourly or so update frequency (automatic, even in the FREE version) has a good reason.

GROUP Technologies: How to implement legally compliant e-mail management

15 and 16 October will see the eagerly awaited Storage Expo 2008 – the UK’s leading storage and information management event – held at London’s Olympia Exhibition Centre. For the first time, GROUP Technologies UK will be represented with a booth of its own. All aspects of legally secure e-mail management will once again be under the spotlight.

“We are delighted to have the opportunity of presenting our entire legally secure e-mail management portfolio to a wide audience,” says Andreas Richter, International Product Marketing Manager at GROUP Technologies. “Our expert visitors are set to gain a comprehensive insight into the world of efficient e-mail management via the leading mail platforms.”

Visitors to the fair will have the chance to profit from the expertise of GROUP Technologies’ e-mail specialists at GROUP booth 515, where they can find out about current requirements and opportunities in the field of corporate e-mail systems. The focus of attention will be on the central control of e-mail messaging as well as the intelligent linking of e-mail security and e-mail archiving.

Other topics of interest will include server offloading and the tamper-proof storage of business-critical e-mails. This is an area in which GROUP’s iQ.Suite provides the perfect solution to increasingly stringent corporate confidentiality and storage record requirements.

Source: Storage Expo Press Center
<>

Know Your Cybercrime Enemy – Finjan Unveils the Latest Cybercrime Organizational Structures and Modus Operandi

In its Q2 2008 Web Security Trends Report, Finjan outlines the latest developments in the cybercrime commercialization economy

Farnborough, United Kingdom, July 2008 - Finjan Inc., a leader in secure web gateway products, on July 15, 2008 announced the latest findings by its Malicious Code Research Center (MCRC). In its latest trends report for Q2 2008, the MCRC identifies and analyzes the latest Crimeware business operations, and provides a first-of-its-kind insider’s look at the organizational structure of Cybercrime organizations. It all makes the cybercrime more successful and profitable than ever.

The report includes real documented discussions conducted by Finjan’s researchers with resellers of stolen data and their “bosses”, confirming Finjan’s analysis of the current state of the cybercrime economy.

“Over the course of the last 18 months we have been watching the profit-driven Cybercrime market maturing rapidly. It has evolved into a booming business, operating in a major shadow economy with an organizational structure that closely mimics the real business world. This makes businesses today even more vulnerable for cybercrime attacks, especially considering the maturity of the cybercrime market and its well-structured cybercrime organizations,” said Yuval Ben-Itzhak, Finjan’s CTO. “Recent industry reports containing record numbers of malware infections during the first half of 2008 alone underline again the huge impact of cybercrime on today’s businesses.”

The report explores the trend of loosely organized clusters of hackers trading stolen data online being replaced by hierarchical cybercrime organizations. These organizations deploy sophisticated pricing models, Crimeware business models refined for optimal operation, Crimeware drop zones, and campaigns for optimal distribution of the Crimeware.

These cybercrime organizations consist of strict hierarchies, in which each cybercriminal is rewarded according to his position and task.
The “boss” in the cybercrime organization operates as a business entrepreneur and does not commit the cybercrimes himself. Directly under him is the “underboss”, acting as the second in command and managing the operation. This individual provides the Trojans for attacks and manages the Command and Control (C&C) of those Trojans. “Campaign managers” reporting to the underboss lead their own attack campaigns. They use their own “affiliation networks” as distribution channels to perform the attacks and steal the data. The stolen data is sold by “resellers”, who are not involved in the Crimeware attacks themselves.

“In our report we provide a closer look at today’s cybercrime enemy, indicating how it organizes, operates and benefits from stolen data. We unveil the business cycle of data collecting and trading by today’s cybercriminals, said Yuval Ben-Itzhak, CTO of Finjan. “We also show examples of the highly effective tools and methods that are being used to steal data from enterprises around the world.”

As a preventative measure, businesses should look closely at their security practices to make sure they are protected. A layered security approach is a highly effective way of handling these latest threats, and applying innovative security solutions, such as real-time content inspection, designed to detect and handle them is a key factor is being adequately protected.

Malicious Code Research Center (MCRC) is the leading research department at Finjan, dedicated to the research and detection of security vulnerabilities in Internet applications, as well as other popular programs. MCRC’s goal is to stay steps ahead of hackers attempting to exploit open platforms and technologies to develop malicious code such as Spyware, Trojans, Phishing attacks, worms and viruses. MCRC shares its research efforts with many of the world’s leading software vendors to help patch their security holes. MCRC is a driving force behind the development of next generation security technologies used in Finjan’s proactive web security solutions. For more information, visit our MCRC subsite.

Finjan is a global provider of web security solutions for the enterprise market. Our real-time, appliance-based web security solutions deliver the most effective shield against web-borne threats, freeing enterprises to harness the web for maximum commercial results. Finjan’s real-time web security solutions utilize patented behavior-based technology to repel all types of threats arriving via the web, such as spyware, phishing, Trojans and obfuscated malicious code, securing businesses against unknown and emerging threats, as well as known malware. Finjan's security solutions have received industry awards and recognition from leading analyst houses and publications, including Gartner, IDC, Butler Group, SC Magazine, CRN, ITPro, PCPro, ITWeek, Network Computing, and Information Security. With Finjan’s award-winning and widely used solutions, businesses can focus on implementing web strategies to realize their full organizational and commercial potential. For more information about Finjan, please visit: www.finjan.com.

Source: Eskenzi PR

ISAF welcomes strengthened UK government IT security awareness

London 17th July 2008 - - Dr David King, ISSA-UK and Chair of the Information Security Awareness Forum (ISAF), said he is delighted that the requirement to provide information security awareness has been raised to the top of the agenda amongst UK government departments and agencies.

"The move is welcomed by the ISAF and will, I have no doubt, also be greeted in a positive manner by other IT security bodies across the UK," said Dr King, who added that the sea change in the government's approach to information security is the result of conclusions of a number of relevant reports in recent weeks.

"The new security ethos permeating through the various strata of the UK's government and its agencies will, we hope, encourage all managers in the public sector to take a responsible attitude towards looking after their computer data," he said.

According to Dr King, there is now a greater need for education and guidance on information security matters for existing and new employees of the government and its agencies.

"This need is about to become pressing as the government and its agencies gear up to take on the several tens of thousands of newly-qualified graduates that have decided to enter the public sector this coming September," he said.

Most of these new employees, he added, will have grown up with computers, both at home and at school, but many will lack a basic understanding of data security issues.

"It's down to their new public sector employers to educate them on this front and they can only do this if the relevant managers get behind the security policies that already exist in many government departments and agencies, and pro-actively apply them," he said.

"Here at the ISAF, we believe that government departments and their agencies should develop positive strategies to raise awareness and understanding of information security principles, taking into account the DPA, HRA, RIPA, Computer Misuse Act, Police & Criminal Justice Act, Defamation Act, Fraud Act, Obscene Publications Act. They should also prepare for the governance provisions of the Companies Act 2006, which is due to become law later this year," he added.

Dr King went on to say that, as individuals as well as employees, ISAF
members and associates, as well as anyone involved in business management, need to be more aware of the issues that affect us all in our day-to-day handling of personal data.

"This is especially true when it comes to developing the resources required to provide information security guidance to all members of staff, covering issues such as incident reporting, data handling and taking a holistic approach to the topic," he said.

The ISAF had already seen the need to do this at a Director level with the production of its Directors’ Guides on Information Assurance launched in April 2008, sponsored jointly by IAAC, ISAF and BT. The ICO has warmly received and reviewed these and believes that they should be on the desk of every single director of every single company / organisation in the land. When asked by the ISAF as we seek to use the Directors’ Guide to spread the message that information risks must be understood and effectively managed, Richard Thomas the Information Commissioner replied, “Every Director should have one!” and continued, “We will be saying more about board-level accountability in the Thomas/Walport Report on Data Sharing due out shortly.”

Founding members of the forum included the ISSA, (ISC)2, BCS, Infosecurity Europe, IISP, ISACA, EURIM, Get Safe Online, NeCPC and Security Awareness SIG.

“The Security Awareness SIG is looking forward to assisting the public sector by sharing the knowledge and skills learned by corporations in the private sector. Our members have been tackling the challenging issues surrounding data protection for many years, and there is a wealth of good practice and experience that will save the painful reinvention of many wheels.” Said Martin Smith MBE BSc FSyI, Chairman and Founder of the Security Awareness SIG

“The CMA is proud to be a founding ISAF member and though our organisation is not an obvious one for Information Security, we have long recognised that security issues arise from our increasingly interconnected and converging world and that top down business involvement is key element in improving the security posture of any organisation (or country)” said Peter Wenham CISSP MICAF CLAS, Director, CMA

Nigel Jones, Director of the Cyber Security Knowledge Transfer Network, commented: “It is essential that the education and awareness of information security becomes a top priority for UK government IT users. Meeting today’s information security challenges relies on addressing three key issues – how to make our technology more secure; how to help business understand the positive economic impact of reducing e-crime; and how to change the way society thinks about the value and vulnerability of its sensitive information. This announcement offers a positive outlook on all three. Information security may be a global issue but it must be tackled locally first. The decision to increase government focus on Information security awareness demonstrates that the UK will lead from the centre on cyber crime and security.”

For more on the UK government's enhanced security ethos click here:

For more on the ISAF see website:

Source: Eskenzi PR
<>