HMRC fires staff for reading personal data

An MP has revealed that over 600 staff at HM Revenue and Customs have been disciplined for reading tax payers’ personal histories. Treasury Financial Secretary Jane Kennedy said that 238 people were disciplined in 2005, 180 in 2006 and 192 in 2007.

While some employees received a reprimand, the MP revealed that a large number had been fired.

Kennedy said that HMRC has a “strict policy forbidding staff to access customer records unless they have a legitimate business need.

“Breaches of this policy are taken seriously and will result in the commencement of disciplinary proceedings,” she said. “Each case is treated on its merits but, in many cases, the disciplinary penalty for breach is dismissal.”

The cases highlight continuing concerns about the department’s competence in handling data on UK citizens.

“The data loss that occurred last year at the treasury was the start of a string of stories concerning the mishandling of Government data. What for years was a trusted area is now under the spotlight, where revelations such as this will undoubtedly raise eyebrows,” comments Derrick Cameron, from IT firm Eximium.

“Businesses must deploy an information security solution, which hides sensitive data unless the request is genuine, if they are ever to completely overcome human curiosity and error,” adds Cameron.

No Comments »

Tips on writing effective documents

Add a table of contents at a useful level at the start. It helps people assess and absorb the content of your document, as well as find their way around it. Don’t have too much detail in it though - a maximum of 3 heading levels usually works best. Microsoft Word has powerful tools for helping you create a table of contents easily and effectively, whilst also making keeping it up to date straightforward.

No Comments »

Are you compliant with the PCI standards?

In September 2006, the Payment Card Industry (PCI) Security Standards Council released version 1.1 of a document entitled ‘PCI Data Security Standards’, generally referred to as the ‘PCI DSS’.  The PCI Security Standards Council was formed by the leading payment brands, including Visa and Mastercard, specifically to develop the Data Security Standards. This was in response to rising fraud within the industry, and the standards were designed to ensure organisations adopt consistent security measures to proactively protect customer account data. The standards will be updated in response to new payment security risks, as they are identified.

Adherence to these standards became a mandated requirement in July 2007 for all organisations handling credit and debit card transactions, or providing systems or services that do.  However, many companies are still not compliant and nonconformity could result in hefty fines and possible withdrawal of payment services.  The largest merchants, those handling over 6 million transactions a year, are expected to be compliant first, with the smaller merchants following along later, working towards a deadline of December 2008.  Companies offering systems or services that handle credit and debit card data will also need to comply or face going out of business.

The PCI requirements, like many standards, are just a framework and so by their nature are quite generic. This can make it difficult to pin down exactly how they should apply to your business, your systems and your processes. Anyone who has implemented an ISO standard, such as ISO 9001, will be all too familiar with this problem.

The good news, of course, about a framework such as this is that it’s prescriptive about what needs to be done but not always about how it should be done, so allows you some leeway to implement the approach in a manner that suits your business and the way you like to operate.

So what are these standards really about?

The key information that the standards are interested in is known as ‘cardholder data’.  The PCI define cardholder data as the ‘full magnetic stripe or the PAN (card number) plus any of the following: cardholder name, expiration date and service code (often referred to as the security code on the magnetic strip)’.  In fact, however, many of the requirements deal with general industry best practice in connection with system and data security and have nothing directly to do with card data at all. For example, ensuring that each user of your system has a unique user id and password, and that their password is not one that can be easily guessed.  If your system security policy is already top-notch, then you’ll be a long way there already.  If not, you may have a lot of work to do.

Let’s have a look into the essence of what these standards are really getting at. There are 12 main requirements which are grouped under 6 main headings.  Here are the headings with my simple explanation of the requirements underneath each:

1. “Build and Maintain a Secure Network”
Ensure you have a secure network, including firewall protection and the need for passwords to gain access.

2. “Protect Cardholder Data”
Protect cardholder data wherever it is stored, and even when being transmitted outside your secure network.

3. “Maintain a Vulnerability Management Programme”
Ensure your systems are protected against unauthorised access, including using up-to-date anti-virus software.

4. “Implement Strong Access Control Measures”
Install and maintain strict controls around system access, even access to the physical bits of hardware, ensuring only those people who actually need to see cardholder data have access to it.

5. “Regularly Monitor and Test Networks”
Monitor and track access to systems and, more specifically, cardholder data within systems.  Also, regularly test the security systems that have been put in place.

6. “Maintain an Information Security Policy”
Implement and maintain a policy for the security of information in your business

A common misconception about the standards is that they only apply to credit or debit card numbers. In fact, whilst only the card numbers themselves need to be protected using encryption (meaning converted into something incomprehensible using a ‘key’, so that only a holder of the matching key can convert it back to its original form), information such as expiry dates, issue numbers, customer names, addresses, etc., all need to be carefully protected according to these standards.

The 12 requirements under these headings are then further broken down into a total of 64 smaller requirements.  I don’t propose to list them all out here - suffice to say that the PCI council have been very thorough in covering a lot of areas that could result in a security breach, leading to card fraud.  Interestingly, as you can see from these 6 headings, only number 2 is actually concerned directly with what state cardholder information is in inside your business.  The others are all to do with stopping any unauthorised or unscrupulous activity that might compromise that information.

Is everyone affected in the same way?

The PCI have categorised merchants into 4 levels, each with their own set of compliance criteria, based on the annual number of credit/debit card transactions that your business handles, as follows:

Level 1 - over 6m transactions, or anyone whose data has previously been compromised. An annual onsite security audit and a quarterly network security scan are necessary.

Level 2 - between 1m and 6m transactions. An annual self-assessment questionnaire and a quarterly network scan are necessary.

Level 3 - 20k to 1m transactions.  An annual self-assessment questionnaire and a quarterly network scan are necessary.

Level 4 - everyone else.  An annual self-assessment questionnaire and an annual network scan are necessary (although this is under some debate and may be lessened in the future).

What will happen if I don’t comply?

In theory, each payment brand will take the action that it feels is appropriate (and achievable) to enforce these standards.  At the moment, there isn’t a set fine, and the PCI council doesn’t appear to have any plans to create one.  It’s likely that each brand will want different evidence to show you are compliant and they may opt to withdraw your payment services, in extreme cases.

All the original deadlines that were set for compliance have now all passed, so they’ll probably be looking to set a date based on factors such as your level and the importance of your business.  Your acquiring bank should be the best place to start to find out what date you need to work to and what penalties you can expect to pay if you’re not compliant on time.

How do I go about implementing these standards into my business?

So, what do you need to do to implement these standards into your business?  And how can you ensure that you are compliant with a standard, if it’s so generic?

Firstly, it’s important to review each of the standards carefully and assess how it applies to you and to your business.  You may already have some of these things covered, so it’s a good idea to find those straight away and tick them off the to-do list.  This should leave you feeling slightly happier and with a more focussed list of work to be done.

A number of the requirements are things which are going to need a business process change rather than a system change. For example, users of a system being forced to regularly change their passwords.  You’ll be able to confirm whether your systems are capable of this, or change them to make it so, but it’s not quite so simple to establish whether your people are actually using the facility.  So, identify the standards that cover a business process in this way and think about how you’ll implement them, and how you’ll confirm that they are being adhered to.

You’ll also need to think carefully about where your credit and debit card data is being captured, stored and sent. Ideally, it should remain either hidden or encrypted at all times, but of course this just isn’t practical.  In order to actually use the information, it will need to be decrypted and visible.  However, it will need to be re-encrypted again once it’s been used in order for it to remain safe, so you’ll have to find these scenarios as soon as possible and work out what you are going to do.

It’s important to remember that any form of recording or transmission is covered by these standards, so emails, forms, and letters are just as much of a security risk as computer systems.  Make sure you know about the use of these other methods in your business and are doing something to control and audit their use.

The standards call for you to protect cardholder data from prying eyes and not to expose it to the risk of being stolen, even by your support staff. This is harder than it sounds!  Usually, there are backdoors that allow support staff to view and even amend data. This won’t be allowed in the future, in all but the most extreme cases and, even then, use of this facility has to be carefully controlled and audited.

Think carefully about your support processes because these changes could have an impact on your people’s ability to handle certain transactions in your business successfully. For example, are there any regular processes in your business that involve someone either looking at or manipulating card data?  If so, you’ll need to find these and start working out an alternative approach to handling them.

What about processes that rely on the use of people’s card details? For example, do you process credit card chargebacks?  These often start with the need to search a system using the customer’s credit card number. This might not work once card numbers have all been encrypted on your system!  Check these situations out carefully.

OK, I’ve started work on this but what will all this change mean?

Let’s have a look at the type of testing need all this will create.  At the end of last year we completed a testing project for one of our customers to help them ensure that their system met the requirements for the PCI DSS.

We undertook the work in 4 streams:

1. We needed to prove that the changes to their system achieved what they were supposed to have done.  In essence, were they doing what it said on the tin?

2. Then we had to confirm that the changes had led to the requirements under the PCI DSS being either met or exceeded.

3. Also, it was important for us to confirm that everything else still worked correctly on their system, i.e. that the changes hadn’t broken any of the important processes they already used.

4. Lastly, we had to check that other changes they had had to accept as part of the upgrade were also working correctly.  Their system is essentially a package, so some dependant updates were also provided by the software provider to make the PCI changes work.  This issue may or may not affect you.

After we had completed our testing successfully, we handed everything back to our customer so they could start their own testing, to make sure everything was fit for purpose for their business and their business processes.

I can’t stress strongly enough that all the changes you are going to need to make, whether they are to your business processes or your systems, are going to need to be tested thoroughly.  Don’t just implement them and expect them to work.

Hopefully, that gives you something of a flavour as to how complex testing something like this can be, and what all this change is going to mean to you.  The bigger companies are spending millions of pounds getting this right.

So what do I do next?

The best place to start is to download the standards themselves and the Self-Assessment Questionnaire from the PCI website at www.pcisecuritystandards.org.  You also might also want to contact a PCI Approved Scanning Vendor (ASV) and get them to come in and assess how much work you’ve got to do.
Also, if you haven’t already done so, I’d talk to your acquiring bank as soon as possible and confirm with them what level merchant you are.  Oh, and don’t forget to ask them that all important question about when you need to be compliant by, and how much it will cost you if you’re not ready by then!

Ultimately, this could be a complicated and costly process.  But, it’s worth remembering that it’s an important investment in risk reduction.  And, according to statistics from Visa Europe released in January this year, 84% of customers want to shop with merchants who are security market leaders and 75% say they would not shop at a store that had suffered a security breach.

Derrick Cameron is Managing Director of Eximium Ltd, who specialise in helping businesses use their IT to solve their business headaches.  For further information or advice on the use of IT in your business, please see www.eximium.net or call 01582 635 078.

2 Comments »

Tips on writing effective documents 

Try to think about who your primary target audience is and focus the document on what they would want to know, the level of knowledge they have, and the kind of language they would use.

No Comments »

Business owners increasingly clinching deals on the move

Nearly half of UK SME bosses have won business by being able to respond to prospects while on the move, according to a survey by Research In Motion.  The research also suggests that the majority of SME decision makers are out of the office for significant periods at least twice a week.

The need to juggle business requirements and communications on the move is therefore of vital importance. Two thirds of respondents said that ‘regular communication’ and ‘reacting quickly to queries’ are the two most critical aspects in successful relationships with customers.

However, despite 65 per cent of SMEs stating that keeping in touch with business stakeholders is ‘very important’ or ‘important’, nearly a third still use letters as the preferred method of communication.

“It is commonplace for SME owners to spend large amounts of time out of the office, and multitasking is often essential to keep their business moving,” said Derrick Cameron, MD of Eximium.

“However, customers and prospects expect a certain level of service and speed of contact regardless of whether they are in the office or not. It is becoming ever more important to use reliable mobile solutions.  They are essential to the success of SMEs in the UK and across Europe, so adopting the right tools and procedures from the beginning is key to long term success.”

The proportion of SME bosses who have clinched a deal while out and about is around 62 per cent across Europe, rising to 86 per cent in Spain.

No Comments »

System integration is the key to managing your e-commerce business and not just your website

Websales are key to any retail business, but e-commerce is not just about the shopping basket and the parts of the website that the customer sees. In a recent article, President and CEO of NetSuite, Zach Nelson, raises many valid points.  He says you must ensure that your whole business can support the sales process through the efficient integration of your website, front-office and back-office systems. 

Zach’s article advises 2 main things to think about:
1. What information is available at various stages of the process
2. The speed at which information is available

There will always be questions that cannot be answered by your website. You need to ensure that when a customer calls, customer support and administration staff have enough information to be able to respond to the enquiry effectively. Central customer information, such as a customer account, can also show what sort of experience each customer is having, whether good or bad. It can identify your good customers that you want to retain, and warn you about your bad ones!

Your Marketing department also needs enough information about your customers and how they are using your website to be able to understand what your customers want and need, so they can direct your business where it will be most effective.

If you have this sort of information available, how quickly is it being transmitted between systems? Customers expect instant results and are disillusioned when information such as stock levels are incorrect. This can also incur un-necessary costs for your business when you cannot fulfil customer orders. Real-time data can make the difference between an average business and an efficient, streamlined business that customers want to come back to, and effective integration between your systems can help you achieve this.

System Integration is one of the areas we specialise in, as it helps business owners get the most out of their existing IT – and it doesn’t have to cost the earth. We see a lot of cases where 2 or 3 good systems are doing a decent job individually, but where greater benefits could be realised if they simply shared information efficiently between them. If you would like any advice on how to get your systems talking to each other, or would like to arrange a free visit from one of our consultants, please go to www.eximium.net/contactus.asp

To read Zach’s full article see www.inc.com/resources/technology/articles/20070501/nelson.html

No Comments »

Need a useful FTP (File Transfer Protocol) tool?

I get asked quite often by people what I’d recommend as a useful FTP (File Transfer Protocol) tool.  Here is my answer!

There’s a lot of software out there that does this job, and everyone has their favourites, but I must admit that I’m a big fan of SmartFTP (http://www.smartftp.com/).

This type of tool is really useful for manually moving data files around systems in your organisation, and between your organisation and third parties.  Sometimes email just isn’t practical, especially if the files are large.  Also, a good FTP tool is essential if you ever need to upload to, or download from, your website anything that isn’t dealt with via some sort of content control process on your site itself.  For example, it’s how we update the database that contains our tips and case studies on our site.

I’ve been using SmartFTP for 8 years now.  It’s user friendly, it gets the job done well and I find it very intuitive to use.  Also, it doesn’t cost the earth - the standard version costs under £20.  They’ve recently released version 3.0 and it’s even better than ever.

So, if you’re looking for a powerful but useable FTP tool, I’d recommend you try SmartFTP on a 30 day free trial and see what you think. Like me, you might never look back!

No Comments »

Tips on Writing Effective Documents

Try to keep them short. People are put off reading long documents. If you have a lot to say, it’s better to have another document that provides more detail than create a huge document that no-one will read.

No Comments »

Eximium joins Luton Business For Breakfast® group

Business IT specialists Eximium Ltd announced today that they have joined the Luton Business For Breakfast® group. The club meets at the Menzies Strathmore Hotel in the Arndale centre between 6:45am and 8:30am every other Tuesday, to share best business practise and exchange quality business referrals.

Derrick Cameron, MD of Eximium said “We are delighted to be working with Ryan and the other members of this group to grow our business, and to help them grow theirs. We’ve already had a number of valuable opportunities come from the group and it’s great to be part of a club with such friendly and like-minded business people.

“This group fits well with our marketing strategy. We don’t employ salespeople, as they can turn people off. Our services and our approach sell themselves, and recommendations and referrals are the most powerful way for us to spread the word about what we do. I can recommend this group to anyone looking to do business in the area, who wants to have an opportunity to meet and nurture new contacts and benefit from a fun, friendly and professional approach to business breakfast networking.”

The group is run by Ryan Tobias. Ryan said “I’m delighted to have Eximium on board. They are exactly the type of forward-thinking, growing company that we’re looking to have as members. Derrick has a great approach to the meetings and is always keen to help other members to grow their business, which is to everyone’s benefit.”

Ryan can be contacted at ryan@bforb.co.uk.

2 Comments »

Happy birthday to an unwelcome guest - 30 years since the first junk e-mail was sent

Security researchers from across the UK are giving a tongue-in-cheek salute to the 30th anniversary of the first spam message. Gary Theurk is apparently the person who gave birth to the first junk e-mail.  At the time, he was an employee at the Digital Equipment Company and sent a message on Arpanet to hundreds of fellow users on 1 May 1978.

The message advertised the latest DEC computer systems, and received a less than enthusiastic reaction from fellow users. Arpanet has since evolved into the modern day internet, and DEC was purchased by Compaq and later HP.

 So, 30 years on, why does spam still exist?  Security firm Sophos noted recently that some 10 per cent of respondents to a recent survey admitted to purchasing spammed products.

“The truth is that, much as we all say we hate spam, if an e-mail for a product or service arrives that we are interested in, we buy it.  If users didn’t buy the goods, spam would soon dry up.  The spammers wouldn’t make any money and their activities would stop,” said Derrick Cameron, MD of Eximium.

“What amuses me about most of the spam I receive,” adds Derrick, “is that I have no idea what it is meant to be selling me!  I’ve always been at a loss to understand how or why this type of spam seems to be growing.

“What started out as a single message 30 years ago has grown into a global problem that clogs inboxes the world over and makes returning from holiday that little bit more bothersome,” adds Derrick.

No Comments »