Interview with David Whitlegg of itsecurityexpert.co.uk
This has got to be one of the most enjoyable interviews we have conducted yet. To say that David Whitelegg is a data security expert is an understatement of significance and a clear example of stating the obvious. Davids’ answers range from short and witty to detailed and fascinating. Here is a man who can and will tell you how to best protect your data. Ask him about his family or car and he may consider you a bot seeking personally identifiable information. A riveting and educational read. Dave plans to write a book. Sold!
General info
Name: Dave Whitelegg
Company: ITSecurityExpert Limited
Website: http://itsecurityexpert.co.uk
Family Status: Posting family details helps identity thieves!
Personal Blog: http://blog.itsecurityexpert.co.uk
Favourite Movie: Trains, Planes and Automobiles
Currently listening to on the iPod: REM - Accelerate
Favourite Tipple: Jack Daniels & Ice
Likes: Manchester City FC, gadgets and a decent curry!
Dislikes: Needless data breaches and “script kiddies” (IT illiterate kids pretending to be hackers)
Main interview
JON: What advice would you give to on the move laptop users who connect at public access points in Airports, Hotels, McDonalds etc?
DW: Using public WiFi access points, especially free access ones, can have considerable security risks, and users should certainly be weary. Hackers have even been known to have setup fake free WiFi hotspots, usually near airports, for the purpose of stealing personal and financial information of those unfortunate to connect. It is important to regard and treat any public wireless network as a non-trusted connection into the laptop. So firstly before connecting, ensure your laptop operating system has it’s firewall enabled (i.e. Windows Firewall), ensure the Operating Systems Service Pack and Patches are up-to-date, and make sure your Anti-Virus or Security suite is operating. Again ensure it has also been updated, at least in the last 7 days. Make sure you switch off any shared network folders and always try to ensure the WiFi network you are connecting to a legitimate one, look around for the official signage. Unless you are using public WiFi to “VPN” (encrypted connection) into your office network, consider everything you send over the wireless Internet connection to be readable by a third party, especially if the wireless network is not using any form of encryption. A third party (aka the bad guy) doesn’t have to access your laptop to steal information, but merely “listens in” to the data being sent by you through the wireless network to the Internet. If you are using web mail for example, it is a good idea to force the encryption, which can be enabled in most web mail providers, to enforce the encryption from the start you need to type an “https://” instead of “http://” before the Internet address of web mail provider in your web browsers. This will protect your web mail user-name and password from being readable by any third party listening in. As well as taking these sorts of pre-cautions, be sensible regarding what you do on public WiFi, by all means check the latest news reports and sports results, but you may want to avoid conducting your online banking until you get home. If you find you have a requirement to use public WiFi networks considerably, I would recommend going with a 3G Internet USB device, not only does it provide your own dedicated Internet connection and is much safer, but it may even work out cheaper.
JON: Do you recommend any specific hardware or software devices to any particular business sector?
DW: The Security Industry is moving towards offering a single device or application to deal with multiple security protection disciplines. The “one stop shop for all” security solution approach is ideal and works well for small business. However this is not my recommended approach for larger enterprises, where the business process and technical systems are highly more complex. In the enterprise the correct approach is to ”cherry pick” the best products for specific the business requirements, processes and system requirements. I find on some occasions security vendors are guilty of dictating the business requirement and the solution, rather than their customers, which can lead to little security benefit for a high financial and security trade off cost.
JON: What advice would you give to non technical owner / managers in small business regarding data security?
DW: I would encourage business owners and managers to initially take a step back, and map out data flow throughout their business, i.e. how data is collected, how information is used by the business, how it is stored and backed up. Once these processes are mapped out, highlight which areas are vital to the business operation and which require protection for the business survival. On the later consider the “what ifs”, so what if the data was lost or had been stolen, will there be regulatory and legal costs and consequences? Will there be a breach of contract? Will there be a loss of customer confidence in the business brand leading to losses in revenues? All data has a value associated with it, you need to take stock of this value, treat the data value in the same way as the business balance sheet. Once you understand the value, the next step is all about risk analysis and perhaps delivering risk migration solutions and processes, especially where the business is running needless and unnecessary risks right through to security risk v security trade-off decisions.
JON: What advice would you give to business owners who are concerned that the implementation of advanced security measures (which they want and understand they need) may limit their scope with regarding changing methodologies and reacting to market changes?
DW: Sometimes security measures can be seen as obstructive, especially within small business, however this is often not the case. A security process or solution can actually enhance the overall business processes. Lets take “Backupanytime” for instance, not only is this a far more secure solution to backing up data to CD-Rs, but it is a more reliable and efficient solution.
JON: Are there any circumstances in which you believe a data breach may be unavoidable?
DW: No, there are never ever any guarantees in security; information security is about reducing the risk of a data breach. The “human factor” in any organisation is nearly always the biggest risk, it is impossible to completely mitigate the security risk brought about by the interaction of human beings!
JON: What advice would you give to business regarding the procedures to adopt in the event of a data breach?
DW: It is essential to have a Security Incident Response plan and procedures in place ready for dealing with data breaches and security incidents. These days most businesses will have a disaster recovery plan, the exact same approach is required for dealing with data breaches. Businesses management should consider a data breach a matter of “When” rather than “If”. Once you have a Security Incident Response plan in place, it is important to test it is actually fit for purpose.
JON: What are your hobbies and passions?
DW: In recent years I have come to the realisation that I am a complete “Information Security Geek” outside business hours, my blog (itsecurityexpert.co.uk) is evidence of this. I mean last week I met up with Moscow Security Guru Eugene Kaspersky, the founder and CEO of Kaspersky Lab (Security Software), I guess most people would be happy to exchange business cards, but not me, I had to ask for the “fans” picture!
JON: From where do you get your inspiration?
I have been very fortunate to rub shoulders with some of the greatest global minds in the world of information security. One of the most inspiring would have to be Bruce Schneier. Bruce’s “stand back” approach to information security and philosophy is extremely refreshing in an industry which tends to be lead by vendor marketing buzz phrases. I recommend anyone, even with the slightly interest or knowledge in security, to read any of Bruce Schneier’s recent books.
JON: What’s the last book you read?
DW: High Noon: The Inside Story of Scott McNealy and the Rise of Sun Microsystems.
JON: What type of car do you drive?
As a security professional, I tend be careful what I publish about myself on the Internet, but I’m afraid my car is just a practical one rather than anything flashy at the moment.
JON: Where do you see yourself in five years time?
DW: If there is one thing I would like to accomplish in the next five years, it is to actually find the time to finish writing and published a security related book. I have a couple of irons in the fire at the moment, but it’s finding the time to finish them which is proving to be difficult. If any publishers are reading this, I need a month off on an exotic pacific island, 1,000s of miles away from civilisation.
Given the confidential and contentious nature of data security we recommend that if you have concerns about the data security of your organisation and would like Davids advice, you should contact him directly. Thanks again David. Great job.
The backupanytime team
Visitors, want to see more who’s who in data? Then watch next weeks who’s who in data.
