John Suffolk

100 questions to ask your tech vendors on their approach to cyber security. Let us all develop an ISO based standards for vendor security

When we look around today it is fair to say that almost everything we see has been shaped by the combination of Governments, regulators, vendors and consumers continuously improving the products and services that we use.

Your trip to the office, or home or school or shop today regardless of by car, bus, cycling, and yes even walking has sustained many years of functional and safety innovations and improvements.

The room you are meeting in has been shaped by health and safety considerations on maximum room size versus the size of the exits to allow a timely escape in the event of an incident. The materials to build and furnish the room are tested for structural, wear, chemical and fire protection and performance.

But what has not gone through the same security improvements is the technology you are using. Your mobile phone, your tablet, your computer - They have gone through enormous technical changes, enormous, functional changes, and enormous cost improvements but sadly security has not followed this same improvement curve.

Consider this when you purchased your phone nowhere did it state any warning about security of your personal details or protection of your identity. Nowhere would you have been able to find a commonly accepted certificate of security conformity or security testing. Electricity – yes, environmental waste disposal probably, security, absolutely not.

So we should stop and ask ourselves why technology security has followed a different improvement trajectory.

• First is the pace of change. It is sometimes hard to comprehend how technology has changed in such a short amount of time. The shelf life of products is short; the affects of Moore's law can be seen everywhere and because of this the cumulative impact of innovation built on innovation is breath-taking
• This cumulative innovation impact makes technology more usable, more comprehensive, more available and at the same time a lot more complicated – simplification for the end-user equals increased complication for the technology vendor – and increased complexity does lead to increased security risk
• Ubiquity has led to complacency. Today we take technology for granted. We do not really consider the power of what we are using, the interconnectedness of the device, the global supply chain that delivered the device and the experience and nor do we consider the amount of hands and prying eyes who have the ability to interact with our personal technology and the data we store

All of this leads to a lack of comprehensive knowledge of the technology by policy makers, regulators, buyers and users of technology. This lack of knowledge on how technology has been built, or should be built and what good security looks like leaves the buyer, whether it is a consumer an enterprise or a government helpless in deciding the good from the bad.

I started off by saying that the interplay between regulators, vendors and consumers have driven quality up, innovation up and price down. What is missing in technology is the knowledge of policy makers, regulators and buyers of technology to make informed decisions about security. This lack of knowledge manifests itself in the reality that few people are able to specify in any level of detail what security capability they want their vendors to have or build-in to the products and services they create. This in turn has not created the pressure on vendors to improve their security capability at a similar pace to that of functional, other quality and cost improvements – hence the divergence that has been created over many years.

Much good work is going on around the world to address cyber security laws but we must be realistic. It can be hard in a single country to introduce new laws. It is even harder in a region such as the EU with 28 member states; it is a lifetime journey to achieve some laws on an international scale. But we do not need laws to make progress. Good progress has been made on improving the standards and knowledge of users of ICT by the new versions of the ISO27000 standard, the work of NIST in the USA, the Open Group and ENISA in Europe. No work, as far as we can see, has been done to start the process of helping the ICT industry improve the inherent security of their products by creating the demand from buyers for better product security. To do this, buyers need to know what questions to ask of their vendors.

Today I have published our latest white paper and you can find it on our website here:

"100 requirements when considering end-to-end cyber security with your technology vendors"

We are blessed as a company of operating in 170 countries and having customers using our technology who support over one third of the planets population. This global insight provides a richness of culture, a wide understanding of requirements and laws and a comprehensive view of the differing approach people take to managing risks. Our campus in Shenzhen, China, is home to over 30,000 employees and is also our headquarters. Here we host guests from around the globe on a continuous basis. Every day large numbers of customers, Politicians, Government officials, experts and the media come and visit. We show them our exhibition centres, our manufacturing, they sit down and talk with us, work with us and importantly eat with us and through this closeness we detail everything we do – not just on security.

From this intimacy and this openness we take our guests through the approach we take to end-to-end cyber security and from this we have captured their questions, their thoughts and their concerns. This knowledge has formed the basis of the Top 100 questions detailed in this white paper.

We set out to detail the most frequent non-technical questions we are asked by our customers and other stakeholders when it comes to cyber security. In this context, "most frequent" also means the ones that generate the most conversation or review or follow-up questions.

We have taken "poetic licence" to tweak the questions posed to us to make them generic. We have also added questions to reflect the latest issues, such as the Snowden revelations, and filled in any gaps in the questions to make each section cohesive. We fervently believe that the more demanding the buyer and the more consistent the buyers in asking for high quality security assurance the more likely the ICT vendors are to invest and raise their security standards.

Whilst this white paper is a start we are delighted to be working with the EastWest Institute (EWI) on cyber security. We are delighted to announce that the EastWest Institute has agreed to take this initial Top 100 and, using its extensive knowledge and networks, shepherd the evolution of updated and more tailored versions. We look forward to the Top 100 concept becoming an integral part of a buyer's approach and helping the ICT industry drive to greater improvements in product and service security design, development and deployment.

Together we can augment the quality of security considerations in technology products and services, and from this we can collectively do more to enrich people's lives through the use of ICT

Should we teach politicians the basics of business analysis and problem solving? As we enter an election period lots of “ideas” and “policies” being mooted… oh dear

In the UK we are fast approaching an election period and political parties are coming up with lofty ideas and policies to tempt the electorate to vote for them. It doesn’t seem that long since the last election, and from what I can see, policy thinking does not appear to have moved forward. Same old same old… But what is missing, again, is any sense of what problem the political party is trying to solve and what value the policy will create for the country and its citizens.

Let’s be clear policy pontificating has little to do with reality, it’s merely there to say “look at me I am a complete [please enter your own description]”.

I sense no vision being developed or articulated for the UK. What will, or should, the UK look like, feel like, behave like, perform like in ten and twenty years time? And then from this how will we get there – the strategy. What policies, what laws, what incentives/disincentives and of course what problems need to be solved.

Turning to problem analysis, those of you with a classical training in business will understand my point. Every political party has had its, how can I say, “challenged policies” where for the greatest brains on the planet no one had certainty what problem they were trying to solve and the value it would create. The previous administration had the ID cards: it’s for security, no it is for access to public services; no it is not, it is for students, no it is not, it is for actually all of the above. The current administration had the changes to the NHS, moving a large wad of cash to the frontline and removing all political involvement in the governance  of the UK’s biggest public sector beast, and the value created to the tax-payer for this monumental shift, err dunno. What I do know is that I still cannot get an appointment with my GP, but I could probably go and get fertility treatment.

Parliament is no better. When do you actually hear a Minister or an opposition member asking the questions “what problem(s) are we trying to solve”, “what constraints are we having to work to”, “what are the best options to solve the problem(s) in the shortest timeframe for lowest cost and lowest risk”. Without this basic business analysis approach no wonder we spin our wheels addressing things that add no value, and at worse, spend money on doomed initiatives.

As for Parliamentary oversight committees they are fabulous for grandstanding but not much else. Civil servants are trained to give away as little as possible, not to engage in a conversation, claim things have moved on since the audit report, and if you ever get into difficult, just say you will write to the committee chair person – a maximum of 2 hours of pain, job done, career intact.

So in essence we end up with a situation where incoming Governments have a raft of policies that do not seem to solve a problem that anyone is interested in, a Parliament that doesn’t have the skill to effectively challenge the Government and an oversight regime that is ineffective. We should not be surprised that single issue politics engage the electorate (think UKIP) and the mainstream parties continue to scrabble around for sound bites to differentiate their position from the other main parties.

So what should we do? I will give it some thought and come up with some lofty ideas…

Seoul cyber security conference, more countries, more talking, not much progress. Huawei launch new white paper on end-to-end security

I have just finished speaking at the Seoul cyber security
conference, perfectly and warmly hosted by the Republic of Korea Government.
About 100 countries, plenty of Ministerial support as usual. Sadly the
conversation does not appear to have moved on in many ways relating to “international
laws, standards, behaviours”. In fact it is what most Ministers asked for, yet
I assume it is their job... Correct me if I am wrong but I have not seen since
the first conference in London some three years ago any G8, G20, UN or other
Government put this to the top of the list and say we are going to make this
happen. Perhaps with all of the Snowden revelations and the fact that some
enterprises and some Governments no longer trust American Tech titans we might
see more progress on this.

For our part at Huawei we are passionate about bringing the
world together to make progress on determining what does good end-to-end cyber
security look like and implementing globally accepted standards to help buyers
have more trust in what technology they are buying. To this end at the Seoul
conference I launched a new white paper that documents how Huawei builds-in
cyber security requirements into its end-to-end processes - we would love your
views on how we can improve on what we do.

http://pr.huawei.com/en/news/hw-310599-cyber.htm

Project reviews completed, moratorium holding firm, renegotiations well advanced, strategy imbedded - so time for me to leave

Sir Gus O'Donnell, the Cabinet Secretary, has announced my decision to leave the Civil Service after 7 years with almost 5 years being the Government Chief Information Officer and Senior Information Risk Owner.

the full statement is

"John Suffolk, Government Chief Information Officer at the Cabinet Office, has announced today that he will be leaving the Civil Service at the end of the year. John joined the Home Office in 2004 as the Director General leading the technology transformation of the Criminal Justice System and was appointed to the role of Government Chief Information Officer in 2006.

John made his intentions clear in March that he wished to consider his position once he had fully supported the new Coalition Government in their first 6 months of office.

John said:

'It has been a great honour to have been a civil servant and a huge privilege to have led the IT profession over the last 5 years. Without doubt we have transformed the UK into a leading user of technology benefiting Citizens and the UK economy.
 
'I am immensely proud of the way we have supported the new Coalition Government in its first 6 months and have greatly enjoyed working with Francis Maude and his team. I know that with his drive and passion for delivery the very good work we have started will continue and be a great success."

Cabinet Secretary Sir Gus O'Donnell said:

'John deserves the thanks and best wishes of everyone in the Civil Service for driving the transformation of technology in Government. His work with the CIO Council and technology professionals across Government has ensured that we are well placed to cope with the challenges that we will face. We wish him all the best for the future.'

Francis Maude, who co-chairs the board which oversees the Efficiency and Reform Group, said:

"'I'd like to thank John for his enormous contribution to the technology transformation agenda, and the civil service as a whole over many years. 'His experience in both the public and private sector has helped to make the transition to the coalition government a smooth one. The Cabinet Office will certainly not be the same without him and I wish him well for the future.""

The Government has announced the most demanding public sector spending review in a generation. In that review the ICT Strategy that we have been working towards and delivering over the last 7 years is baked in, in some shape or other: the rationalisation of infrastructures to create a "cloud" model; the continued sharing of assets and systems; the continued drive to benchmark and drive operational excellence; putting more systems online - but based around horizontal citizen and business needs; focussing more on SMEs; reducing the scale of projects; fixing our procurement processes and finally putting technology at the heart of the next transformation.

I am a great believer in renewal and as new teams enter a business, or as in our case, Government, it is important that they themselves can bring in new ideas, new policies and processes, and crucially new people. Having achieved what I set out to achieve it is time for me to get out of the way and allow fresh thinking and impetus to drive forward the strategy. I know I leave our work in strong capable hands supported by a strong capable ICT supplier community.

The PM talks semantic web, Martha Lane-Fox, and tweaking the Tigers tail

I woke up at 03.18 with my head buzzing with so much exciting stuff. I had just spent 2 hours at the Computer Weekly 500 club talking to an excellent, vibrant group about our G-Cloud strategy. We probably could have gone on for days...thanks Bryan. This event was clearly built on the publication of our Government ICT Strategy and enabled us to talk about the opportunities and threats. My summary of the event would be that the strategy is good, we recognise the criticality of the culture change that will be required, getting SME's into the app store will be vital and that the EU procurement process, for SME's, has unintended consequences of being anti innovative and anti competitive because of the cost and time of bidding. We also discussed that the cloud provides the fundamental underpinning of other strategies such as Martha's work as without it, we will just not have the money to do everything.

The second thing buzzing around my head was how the hell did we manage to get the PM to talk about the semantic web? The hero who will have managed this (not me I might add) will have had to work across many departments and stakeholders to develop the evidence and buy-in to the suggested policy to ensure what we suggest we should do, can actually be done.

Three years ago my objective was to deliver the Transformational Government Strategy, Develop the ICT Community as Head of Profession and extend our strategies into Green ICT Strategy, Open Source Open Standards reuse, Power of Information etc etc. etc. We have strategies in the pipeline on offshoring and our standards catalogue and we will publish those as soon as they have been completed, reviewed and signed off.

Many of you might recall that the first strand of Transformational Government was "Citizen Centred Services" and this was all about putting the Citizen at the heart of what we do and deliver services on their terms, not ours.

So to see that Martha lane-Fox will become the UK's Digital Champion is a culmination of years of hard work by many people. At last the use of ICT is becoming centre stage of Government strategy with its rightful place to serve citizens (or people who serve citizens) on their terms at a price we can afford.

But tweaking the tail of the Tiger, and one of the Tiger's chums can be a dangerous thing to do. As the saying goes, "beware of what you ask for". The note from Gus to Martha makes clear the first activity is to focus on developing a digital public services strategy. In the PM's speech on Monday, the PM details what he expects to see: the creation of Mygov, which will "integrate" many backend systems such as pensions, tax credits or child benefits, and a simple approach to citizens identifying themselves to Government. This is no small feat. Neither the PM, nor Martha will take too kindly to people dragging their feet and spending their time in endless meetings talking about theory and governance, who does what, building big teams, lots of reporting, posturing and and and. We have raised the expectation and now we need to deliver, and deliver in an environment where as the Chancellor said yesterday "it will be very very tough on spending settlements" for the public sector. This almost certainly will entail diverting money from existing projects, websites, and indeed scrapping activity that does not conform to whatever strategy Martha agrees with the PM and Ministers. Many people talk about cross cutting delivery but few have done it –it's really tough - I carry 6 years worth of scars from doing this in Government.

This is a culmination of three years activity for me, and it is interesting to note that all the things we created over the last three years and spun off are now all being grouped back together again! What goes around comes around. So I look forward to continuing to work with Martha developing the strategy, and critically implementing it... I'll send one of my Tigers to all of the meetings...

Innovation - what prat thought this up? would you take a bullet for your innovation?

In times of financial strife, the word innovation, gets talked about more and more as if people think it is something that can be turned on and off at whim. We all know in reality to create an innovative environment takes time, patience, leadership and a recognition that for each successful innovation many fail.

So in late 2006, early 2007 I got to learn how innovators really work. First of all they give you snippets of what they are up to. "oh we are just thinking of putting No 10 Petitions online, all right boss?". "that thing I mentioned to you a little while ago it's going live, nothing to worry about...". "oh you know that little innovation we talked about, it seems to be causing a bit of a stir". "I need to go and see Ministers". "you need to go and see ministers".

and then over your port and lemon or snowball one night you read the national news headline "which prat thought this up". Should you get angry or pat them on the back and say right now dream up something else. The reality is if you are going to create an environment that gives people the time to think, to dream up ideas, to push the boundaries and then do something with the idea, you can't worry about the odd bullet heading your way when things don't go as people thought. This reminds me of the three legged chicken joke.

"A man was driving along a road when he noticed a chicken running alongside his car. He was amazed to see the chicken keeping up with him because he was doing 50 MPH. He accelerated to 60 and the chicken stayed right next to him. He speeded up to 75 MPH (u oh...) and the chicken passed him up. The man noticed the chicken had three legs. So, he followed the chicken down a road and ended up at a farm. He got out of his car and saw that all the chickens had three legs.

He asked the farmer "What's up with these chickens?"

The farmer said "Well, everybody likes chicken legs. I bred a three legged bird. I'm going to be a millionaire." The man asked him how they tasted.

The farmer said "Don't know, haven't caught one yet."

Rolling the clock forward three years from the launch of the e-petition site, who would have thought that the e-petition website would have spawned the power of information task force, the releasing of 3,000 data sets to the public under http://www.data.gov.uk/and applications such as the asborometer achieving over 80,000 downloads in two days, and becoming the number 1 free app in the UK iTunes App Store and also an Android Market top 25 free application.

But for people to innovate they need the space to think, to dream, to test ideas, to make mistakes, to be protected, to be trusted. Many processes in a business look to ensure each pound spent is put to good use - how can you tell when you are innovating? Other processes look to take out, or mitigate, as much risk as possible - er that's killed that innovation then! and even more processes ensure that all your resources are aligned behind delivering corporate objectives... well if innovation is a corporate objective then you are ok, but I don't see that often.

Times are going to get increasingly tough financially and this runs the risk of limiting innovation so if we are too see innovation in a business whose predominant culture is to minimise risk, then we need a few candidates to take the odd bullet or two.

Will you volunteer?

and finally as Oscar Wilde said ""An idea that is not dangerous is unworthy of being called an idea at all."

"If at first the idea is not absurd, then there is no hope for it." – Albert Einstein and

"If you're not failing every now and again, it's a sign you're not doing anything very innovative." – Woody Allen

2010 will be both exciting and demanding for the public sector...times are a changing, hold on tight, but let's be nice

As part of the Pre Budget Report, Government published a number of reports to support the Pre Budget Report. One of the reports was an update on benchmarking on back office functions and in summary it said that:

• HR must move to 1 HR person to 77 FTE from a median of 1:44
• Finance to reduce its cost to 1% of operating cost from a median of 1.4%
• Marketing and communications to reduce their costs by 25%
• ICT had to reduce its cost by reusing its systems
• Consultancy costs should be reduce by 50%
• We should reduce occupancy to 10 square metres per FTE
• Reduce the cost of the senior civil service by 20%

You can open many papers on any day and you will see references to public sector cuts, downsizing, reform... And they are right. Whether we wanted a burning platform or not, we have one, and I guess we change or burn. No news there, many companies have gone through it or are going through it. I have gone through this in a past life, when we had to transform a business due to poor financial performance, or basically close down. At times it isn't nice, or pleasant, or something you take daily joy from, but on occasions it does need to happen.

But behind the headlines, comments and thoughts, which are often written with a zeal, are people. People like your family and friends. People you care about, people you want to see succeed and be happy.

Change is a funny old thing, it's dead easy when you do it to others; we must change the process; we must restructure; we must change the ...; in reality this is all code for you must change, but I'm all right. Well not anymore.