Benevolent Deception

Last week I asked if a business continuity practitioner should refuse an assignment if the client places restrictions on the plan.  This same issue could face an information assurance professional when working with a client.  This week we take a look at benevolent deception.

Both DRII and BCI assert in their codes of ethics that the BC professional must act in the client’s best interests.  But the problem is that a client could be mistaken about their best interests.  What if the BC (or information assurance) professional is in a position to serve the client’s best interests by deceiving him or her?  Consider the following case:

Exaggerating the Danger

A BC professional recognizes that her company’s data backup system is woefully inadequate by industry standards.  But she also understands that the risk of total data failure is so small that the upper management is not likely to be persuaded to invest in a more reliable backup system.  However, she could use some outdated server failure numbers to inflate the risk to the point where management will take notice.  Would this be acceptable?

Most commentators do not think that this deception is permissible.  But why is this?  There are some cases where it might be permissible for a professional to deceive a client for the client’s best interests.  Consider the following real life case:

Cancer Survival

By the time Lance Armstrong discovered that he had cancer, it had spread to his brain and filled up his lungs.  His doctor gave him a 1% chance of survival, but he told Armstrong that he had a 50/50 chance of survival in order to keep his spirits up, knowing that having hope has been shown to increase a patient’s chances of surviving cancer.  As we know, Armstrong survived.  Did the doctor act wrongly?

Most people would say that the doctor did not act wrongly, even though he deceived Armstrong.  The doctor applied what is known in the medical profession as “therapeutic benefit;” deceiving a patient for the patient’s own best interests.   

Therapeutic benefit is used less and less often today as doctors recognize the patient’s right to be told the truth about their condition, even when the truth may hurt.  There is no simple rule that will determine when benevolent dishonesty is permissible.  Some have suggested a "thank you" theory which states that it is OK to deceive someone if they will thank you for it later, but of course it is hard to know if a “thank you” will along come later, especially when protecting again a threat that may never occur.  Plus, what happens if the professional turns out to be wrong in his or her assessment? 

I don’t have an answer here.  I only raise these questions to generate discussion that will help the profession formalize the duties of the professional.

Last Week’s Quiz Question

What Vermont town is also the name of a foreign country?

This one is embarrassing.  I thought that there was only one Vermont town that shared the name of a foreign country, but students found no fewer than four examples: Peru, Jamaica, Georgia, and Caledonia.  Our winner is Linda Rosa.  Congratulations Linda!

This Week’s Quiz Question

Why did Vermonters huddle around their television sets at 10:00am., on December 28, 2009?

The winner receives four tickets to the Brookfield Ice Harvest: http://tinyurl.com/ydv4avg

Send your entries to jorlando@norwich.edu

Mechanic or Doctor?

Consider the following case (loosely based on an example from John Glenn):

Restrictions on the Plan
A Business Continuity consultant is hired to provide a company with a BC plan. The managers tells him before he begins that they will not accept a plan that suggests changes to the company’s disaster communications system because they are convinced that a phone tree works just fine and anything more is overkill. Should the BC professional refuse the assignment?

I’ve asked this question of business continuity professionals at a number of public talks and the responses fall into two categories:

Accept
Each organization operates under restrictions, and the BC profession's job is to deliver the best possible plan within those restrictions.

Refuse
The BC professional cannot put his or her name on a plan that he or she does not endorse, and thus should refuse the assignment on grounds of professional integrity (This is Glenn’s position).

The disagreement goes beyond this particular example to a more fundamental choice between competing visions of the BC professional. Compare the following two cases:

Mechanic
A 25 year old man takes his car to a mechanic for new rear shock absorbers. He tells the mechanic that he wants big truck shocks installed to raise the back end and make the car look “tough.” The mechanic tells him that the shocks will transfer weight to the front of the car and ruin its suspension when he hits a bump. The man replies that he will avoid bumps. The mechanic tells the man that he’s heard that line before and there is no way he will avoid hitting bumps. The man cannot be shaken from his position, and the mechanic finally relents with the comment “OK, it’s your car, but don’t say I didn’t warn you.”

Doctor
A patient comes to her doctor with a stuffy nose and asks for antibiotics. Her doctor informs her that she has a cold, which is a virus, and that antibiotics will not help a virus. The patient insists on the antibiotics, claiming that because she is paying for the visit and the medication, he must write her a prescription for what she wants. The doctor refuses on grounds that it would violate his professional integrity to write her a prescription that he knows will not do her any good.

Both the mechanic and the doctor are professionals faced with a customer requesting a service that they do not believe is in the customer’s best interests. But the mechanic acquiesces to the customer’s request, while the doctor refuses. The mechanic feels that it is his job to merely inform the customer of the facts and serve the customer’s wishes, while the doctor feels a higher professional calling that prevents him from agreeing to wishes that violate his professional integrity.

The choice between accepting or refusing the assignment in the Restrictions on the Plan example boils down to whether the duties of the BC professional are more akin to those of a mechanic or a doctor. If the BC professional simply serves the wishes of the client, like the mechanic, then the BC professional can provide a plan that he or she does not personally endorse. If, instead, the BC professional serves the best interests of the client, like the doctor, then the professional should refuse those assignments that require a plan that he or she cannot endorse.

The BC profession will need to choose between the paradigm of the mechanic and the doctor as it moves ahead. But even within those paradigms, there is considerable nuance between different cases, and exploring those cases will help guide the profession into the future.

Last Week’s Quiz Question
When were women first admitted to the Norwich University Corps of Cadets?

Answer: 1974

Winner: Marc Ariano

Marc receives a Personal H1Ni Protection Kit, including full-body rubber suit with 6 hour oxygen supply, airborn/food pathogen eradicating radiation kit, and webcam to communicate with family from a distance.

This Week’s Quiz Question
What Vermont town is also the name of a foreign country?

The winner receives a comprehensive, self-paced training course in SOX auditing, which can be completed in just under three minutes (including coffee break).

Send your entries to jorlando@norwich.edu

Compliance? We Don't Need No Stinking Compliance!

By Mark Fisher, MSIA instructor

I recently attended a conference where speaker after speaker talked about information security and compliance.  In the exhibit hall there were rows upon rows of vendors trying to sell products and services to help companies become compliant with Sarbanes-Oxley, Gramm-Leach-Bliley, or the Payment Card Industries Data Security Standard (PCI-DSS).   Everywhere I turned it was compliance, compliance, and more compliance.

I am not criticizing those companies.  It is important for organizations to comply with the applicable laws and regulations and it is very legitimate for vendors to advertise how their products and services can help reach those goals.  As a security consultant to community banks I know first-hand how focused on compliance my clients can be and I have used the need for compliance to sell my own services to them upon occasion.

One thing that concerns me is that we, as a profession, may be focusing too much on compliance to justify spending money and time on information security products.  I fear that by focusing on compliance in the near-term we are weakening our position in the long.  We want the organizations we serve to have a good program to effectively manage the IT-related risks that they face.  Unfortunately, that can be a hard sell sometimes and our organizations often balk at doing what we think they need to do.  To get them moving in the right direction we break out the big stick - compliance.  We tell them that they need to be compliant with X or bad things will happen to the organization.  Faced with that immediate, tangible requirement the organization opens up its wallet and starts doing the things we want them to do.  Score one for the good guys!

The long-term risk is that someday the organization will meet the minimum compliance requirements.  Meeting the compliance requirements doesn’t sound like a bad thing, but as IA professionals we understand that being compliant does not mean that the organization has an effective IT risk management program any more than having a driver's license means that you are a good driver.   The risk is that we will say "Congratulations on becoming compliant with X, now you need to do Y and Z" and the organization will say "Hold on! For years you have been using compliance to justify every IT Security expenditure.  Now you are telling us we need to do more? Why should I believe you?"  At that point we have lost credibility and will have a much harder time getting people to do what we know they should do.

Every one of us has to sell the idea of security to people every day.  We need to justify to our organizations why they need to spend hard-earned money on our projects rather than put it in their pockets or spend it on other activities.  As professionals, we owe it to those that we serve to have honest discussions about what we really want them to do and why.  In the short-term explaining risk management may be harder than just using the threat of non-compliance, but in the long-term organizations that understand and embrace the need for strong IT risk management will be in a much stronger position than those who chase after compliance alone.

Last Week’s Quiz Question

In 1992, Vermont’s capital city of Montpelier was inundated by flood waters in mid-winter.  What caused the flood, and what is the name of the river? 

Answer:  The Winooski River flooded due to an ice jam.

Winner: Srinivas Chandrasekar

Srinivas receives the very first information security textbook, published in 1964, entitled: “Protecting your data center from intrusion and malicious attack: Understanding the tensile strength of steel and concrete.”  Congratulations Srinivas.

This Week’s Quiz Question

When were women first admitted to the Norwich University Corps of Cadets?

The winner receives a Personal H1Ni Protection Kit, including full-body rubber suit with 6 hour oxygen supply, airborn/food pathogen eradicating radiation kit, and webcam to communicate with family from a distance.

Send your entries to jorlando@norwich.edu

Disaster Recovery Gets Personal

By Nicholas Takacs, CISSP CSSLP MSIA

With all of the focus on disaster recovery and business continuity in the last decade, coupled with an amazing growth of information assurance, we still get back to the common issue of people. How do we train them to act in secure and responsible manner? My mantra when doing any type of seminar or educational event is to focus on building knowledge that can be taken home and applied to the audience members' personal lives. Why? Because that's one of the easiest ways to develop good habits, similar in many ways to all of the other "good habits" we should have. Of course, you're probably thinking to yourself that good habits should start at home, much like parents should do for their kids. Unfortunately, with the rapidly changing pace of technology, it would be near impossible for any family to keep up with all of the critical changes, and know which ones were important enough to embed in their daily activities.

There's also a much bigger gap between protecting the real world versus protecting the electronic world. Consider this... what would you do if you woke up at 3am tomorrow morning and saw flames in your house... you would gather up the kids, pets, and get out of the house as fast as possible. Now, what would you do if your computer's hard drive "died" (super-techie term) containing financial information, documentation, pictures, and other personal information? Do you have a plan? Would you know what to do, other than calling a chain-geek squad member?

I wanted to take a moment to remind everyone that as important as security and disaster recovery planning is to your organization, it's just as important, if not more important for your personal life. With the costs of consumer technology coming down rapidly (a 1TB removable hard disk costs less than $100), making regular backups of critical data and information should be as routine as taking out the garbage or paying your bills. There's really no excuse... even consider Windows provides built-in backup software (not that I'm a proponent of it, but it's there, and it works as a basic solution). I confess though that I did forget to do a backup off of my netbook a few weeks back, and of course, Murphy's Law of Magnetic Disks kicked in, and I lost a bunch of information. Thankfully, I was able to recover most of it, but the time I spent going through that process could have been averted with a simple 10 minute automated backup. Shame on me as a professional for not knowing better. Take my example as a lesson learned. Make sure you have disaster recovery plans in place for your personal data and information. Disk is cheap... make a copy!

While I focused primarily on personal information protection, I want to be clear that having disaster recovery plans for your family is important for all aspects of your life. Human life comes first above all else... I firmly believe that after my wife and kids are safe, I'll make sure my pets are safe, then I'll worry about all the rest. I'd trade all the photos, videos, etc. any day if it meant the difference between life and death. I hope you can take something out of this short article and apply it to your home life. It will ultimately benefit you, your family, and believe it or not, your organization too.

Last Week’s Quiz Question
Who was Harold "Doc" Martin? in the history of Norwich University?

Answer: The first African American student admitted to Norwich U in 1916, where he majored in electrical engineering.

The winner is Sherryl Fraser. Congratulations Sherryl.

Below is a list of past winners. Remember that the person with the most wins at the end of the program gets a prize so awesome that we haven’t even conceived of it yet.

Matt Bambrick (2)
Andrey N. Ahernyaev (2)
Dianne Tarpy
Sam Moore
Autumn Crossett
Gil Varney, Jr.
Glen Calvo
Thomas Reardon
Sherryl Fraser

This Week’s Quiz Question
In 1992, Vermont’s capital city of Montpelier was inundated by flood waters in mid-winter. What caused the flood, and what is the name of the river?

The winner receives an original copy of the very first information security textbook, published in 1964, entitled: “Protecting your data center from intrusion and malicious attack: Understanding the tensile strength of steel and concrete.”

Send your entries to jorlando@norwich.edu

Is This A Security Breach? You Make the Call

by Rebecca Herold

I want to take a closer look at some of the issues and requirements within the HITECH Act, which dramatically expands the reach and requirements under the U.S. Health Insurance Portability and Accountability Act (HIPAA)...

So, what is a "breach" under the HITECH Act?
The general question of "what is a privacy breach" is one that too few organizations have really answered, documented, and prepared response plans to cover. The HITECH Act "SEC. 13400. DEFINITIONS" contains the following:

(1) BREACH.--
(A) IN GENERAL.--The term ''breach'' means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.
(B) EXCEPTIONS.--The term ''breach'' does not include--
(i) any unintentional acquisition, access, or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate if--
(I) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate; and
(II) such information is not further acquired, accessed, used, or disclosed by any person; or
(ii) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at same facility; and
(iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person.

A problem facing information security and privacy practitioners is that they have many different laws with breach response requirements that all define a "breach" differently. However, if an organization documents their own meaning of a breach to meet the most restrictive of the requirements, they should then be doing pretty good to hit most, if not all, of the compliance requirements with regard to a "breach."

Note that the HITECH Act definition does not limit a breach to just electronic information. This is good! Many, many breaches have occurred with print information, and also audio ("heard") information, though it is harder to determine if someone has overheard someone else talking about PII. Such circumstances would commonly occur in public places, or through phone systems and voice mail.

It is also good to specify exceptions to what is considered to be a breach. You do not want to start notifying individuals for every single little thing that MAY be, COULD have been, or POSSIBLY was something that was considered to be a breach. You don't want the general public to become complacent and get breach-notice-fatigue as a result of having so many people notifying them that their PII may have been inappropriately accessed, used or disclosed.

Don't get me wrong, I *WANT* organizations to tell the impacted individuals when they've lost their PII, when it's been stolen, or when it has otherwise been misused.
However, consider the following situations:

1) An employee mistakenly sends another employee within the same organization an email containing a file with customer PII. The errant recipient notices this right away, notifies the sender of the mistake, deletes the message, and mail logs confirm these activities.

I know an organization where this situation actually occurred, they decided to treat it as a breach, and went through their entire breach notification process to thousands of individuals. There resulted a whole mess of misunderstandings, the customers were alarmed, there was much bad press, and the entire situation was just downright bad.
If they had been using the HITECH Act breach definition, this would have likely been an exception under (B)(ii)

2) One of the cleaning folks found some medical records in a trash can in the office area of a clinic where they were contracted to work. The person cleaning recognized that the papers contained protected health information (PHI) and other PII (thanks to her training and ongoing awareness communications!) and she called the clinic manager. The manager went immediately to the clinic and collected the confidential papers from the cleaning person. The clinic did not notify the individuals whose PII papers had been found; they determined that the person cleaning did not make copies or otherwise use the information inappropriately.

Under the HITECH Act, this was likely appropriate under (B)(i) since the acquisition of the PHI was made during the course of the cleaning person's contracted job responsibilities and there was no further access, use or disclosure of the information.

3) In January 2008, an official from the Wisconsin Department of Health and Family Services announced in a public statement that a mailing contractor used by Plano, Texas-based EDS (to whom Wisconsin outsources Wisconsin's Medicaid, SeniorCare and BadgerCare state health plan computer processing activities) accidentally printed the Social Security number (SSN) on the mailing labels of 260,000 plan members. The Wisconsin agency notified all those who had their SSNs printed on the mailing labels and EDS offered free credit monitoring to the individuals.

Under the HITECH Act would this have been considered a breach, or a breach exception according to "(iii) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person"?

This is a great question without one clear answer! Even though the SSN was on the mailing label for all with access to the letter to see, the U.S. postal service is generally considered as being a "secure" mode of delivery by the U.S. government, with trusted workers who do not do bad things. Of course, there have been several documented instances of USPS workers doing bad things with the mail, but in general the US government views the USPS as being trusted. Just talk to an IRS representative about tax returns not being delivered and they will tell you that!

I heard differing opinions from the information security practitioners, privacy officers and lawyers to whom I posed this question.

But what about all the other 48 U.S. state and territory breach notice laws; would these three situations have been considered as breaches under them?

An important part of security incident and privacy breach response planning is determining what types of situations are breaches, and clearly defining and documenting that definition. Then, providing training to personnel followed by ongoing awareness communications about what are and are not considered as being breaches.

Last Week’s Quiz Question
How many gallons of sap does it take to produce a gallon of maple syrup?

Answer: 40 gallons
(Note: There was some disagreement on this one, as The Cornell Sugar Maple Research & Extension Program asserts that it takes 42 gallons of sap to make a gallon of maple syrup. But the question refers to quality Vermont maple syrup, not inferior syrup from other states.

This week’s winner is Thomas Reardon. Congratulations Thomas.

This week’s Quiz Question
Who was Harold "Doc" Martin? in the history of Norwich University?

Winner receives a free copy of the new ISO 1,200 page information security policies standard.

Submit all answers to jorlando@norwich.edu

Part Two…. And the Coup Goes on….

The coup situation has become even more grim:

• Air travel out of the country is very limited; the airport has been closed for a few days

• It is uncertain when the airport will reopen

• Outbound communications are minimal; you are able to make a few local calls, including to a US Consulate employee staying at your hotel

• Communications with your office have been impossible for the past few days; the coup leaders physically cut the communications lines

With the ticket situation scarce, you and a team member go to the airport to buy the tickets there. You are first in line but somehow it still takes hours to buy the tickets. At the adjacent airline’s ticket window, a near riot breaks out in a stampede to get tickets. Fortunately, just a glare and some M-16-assisted shoves by the soldiers quiet the crowd in seconds—but you are edgy and nervous with about 60 people behind you shoving you up against the ticket counter. Four hours later….

Success! You have your tickets to leave! Finally, you call your office to give them the good news that you have secured seats on the second flight out of the country. But wait—your Regional Manager [located in another foreign country] orders you to stay in your current location for an extra day or two, and then go in the opposite direction to a different country; otherwise, his budget will show a variance. But what of the risks in remaining in a hostile environment? What of the ongoing and additional risks to your team and to the sensitive information you have? Unfortunately, he’s not concerned with those risks and orders you to get tickets to go to the alternate location.

The Operations Manager is NOT happy when you inform him of the change in destination. He now must arrange for and accompany you to the office’s travel agent located in the heart of the battle zone. The agent prepares the tickets and you are ready to leave—but wait!-- the manager is not authorized to sign for the air tickets—but his secretary is! However, he cannot ask the secretary to come into a battle zone controlled by tanks and armored personnel carriers. You call your office and explain the situation to the Regional Manager, but he thinks you are making up the story. Grudgingly, he agrees to speak with the Operations Manager who confirms the circumstances and explains the situation to the Regional Manager as well. Finally, the Regional Manager agrees to let you take the original flight—but threatens that you will be responsible for the budget variance). You and your team finally go to the airport the next day and do take the second flight out of the country and arrive at the new location (not in the United States) about 3:30 a.m. local time.

More to come...

Last Week’s Quiz Question:

What Vermont family is known for producing Olympic ski champions and runs a low cost ski hill behind their home?

Answer: The Cochrans of Richmond, Vermont.
http://www.cochranskiarea.org/history.html

Winner: Glen Calvo

This Week’s Question:

How many gallons of sap does it take to produce a gallon of maple syrup?

The winner receives a GPS with alarm feature that sounds when you have overshot your airport.

Send your entries to: jorlando@norwich.edu

You're Drab

The hood color for the MSBC gown has been chosen and the winning color is--get ready--drab. This is the recognized color of business.

I was originally thinking fuchsia with a hot pink liner and perhaps aqua highlights, but I guess that drab would work as well.

Perhaps we could come up with a new name for this color. Any ideas?

I would also be interested in hearing about heroic events involving drab. Was the color worn by Napoleon? Was it the first color to climb Mount Everest? Did drab ever save a baby from a burning building?

Most importantly, I want to get inside the mind of drab and ask: Who (or what) is drab? Is drab hiding any secrets? Are their skeletons in drab's closet?

Why did drab choose this moment in history to appear? Does drab have anything to tell us, or do we have something to tell it?

Does drab consider itself "just a color," or a whole movement, and perhaps a way of life?

Risk Management During a Coup

By John Mason

Many employers have overseas locations; a former employer of mine does. My team was at such a location conducting an audit when a violent and bloody military coup occurred; so now there’s a new government, right, in the far-off capital with most of the same rules? Yes and no. Most of the rules do seem to be the same but with a few additional ones (e.g. the person pointing the M-16 or AK-47 at you wins the argument). Too, the coup has started in YOUR location, just a few blocks away—and now the Operations Manager storms into the conference room to tell you that they are not sure how to get you back to the hotel, since the parking lot is halfway between you and the battle zone. They discuss the possibility that they will have to make you walk on the roof to get to a different part of the building while they try to bring the car.

Eventually (miraculously?), the staff gets you back to the hotel. You’re safe—well, at least until army trucks arrive at the front of the hotel and disgorge about 50-100 troops. Surprise! The coup leader has decided to stay at your hotel tonight! Visions of restaurant servers and housekeeping staff taking up arms in a counterrevolt dance through the air. And what of the confidential information stored in your briefcase or computer? Is someone going to search your room and seize it? Should you delete the work and hope for the best or do you wait it out to see what will happen? When will the coup leader leave? What are the chances of getting out safely?

Risk. Yes, we hear about it, work with it, and handle it most every day, whether consciously or not as we go about our jobs and work with others. Yet, how does one handle or address risk when it’s up close and personal? Sometimes there are a variety of choices, and other times there does not appear to be any alternative to the current solution set (though with the latter, I fully subscribe to the empty set being a set and thus an alternative). The process of “thinking outside the box” or “putting oneself outside the box” is frequently much harder than it seems when the risk is staring one in the face (and fear, buried or on the surface, is a factor as well).

To be continued….

Last Week’s Quiz Question:

Name either of the two Vermont towns that is also the name of a foreign capital (Note: Moscow, Vermont is not a town, just a location).

Answer: Athens, Berlin

Winner: Gil Verney Jr., who won an Information Assurance Practitioner Beanie Baby.

This Week’s Quiz Question:

What Vermont family is known for producing Olympic ski champions and runs a low cost ski hill behind their home?

The winner receives A Norwich University t-shirt with the message “My mother went to Residency and all I got was this lousy t-shirt.”

Submit all answers to John Orlando at jorlando@norwich.edu

Human Resiliency and the Navy Seals

A number of months ago a fishing boat containing four football players—two NFL and two college players--capsized off the coast of Miami. The boat turned over in heavy seas. Initially all four players clung to the side of the upside down boat waiting for rescue. After about three hours one of the NFL players told the others that he quit, and then took off his life vest, let go of the boat, and allowed the waves to carry him out to sea. Shortly afterwards the other NFL player did the exact same. Both had reached the end of their tether and simply gave up.

A third player held on until the next day, when he thought he saw a light in the distance and let go of the boat to swim to it. He was never seen again. The fourth player climbed on top of the boat and was rescued after two days at sea; hypothermic, but alive.

A friend of mine noted that the three hours that the NFL players held on is the approximate length of a football game. Perhaps this is most likely a coincidence, but it reminded me of a documentary I saw about the Navy Seals. Navy Seal training is by far the most difficult in the military. During Hell week they go for three straight days without any sleep at all, and then get two hours a night of sleep for the next four days. In between they are kept wet, cold, tired and constantly moving.

Navy Seal instructors have found that strength athletes, such as football players, are not the most likely to make it through the training. Endurance athletics do much better than strength athletes because Navy Seal training requires the ability to perform for long periods of time in miserable conditions. In fact, the Navy Seals often have a recruiting table at triathlons. Is it possible that football training developed a psychological resiliency duration of three hours among the NFL players?

A couple of years ago I heard a fascinating keynote address at the CPM conference by Dr. Maurice A. Ramirez, who talked about the importance of caring for the psychological needs of workers during an emergency. He ran the temporary hospital at the New Orleans airport after Katrina. As part of their operations they had a red phone that was solely used by staff to call their family or friends. Eventually some FEMA bureaucrat decided that the phone was against regulations and removed it. Productivity immediately fell.

Business continuity experts spend a great amount of time setting up the systems and procedures to continue operations during a business disruption, but less time is spent preparing for the psychological needs of the employees that will be put under tremendous pressure during a crisis. They often assume that employees will simply do as their told. But if your community is struck by a disaster, you will care for your family before your employer. Most of the police force in New Orleans disappeared after Katrina because they cared for their family before their civic duty.

Human resiliency is becoming a hot topic within business continuity, and hopefully we’ll see it given more attention in the future.

Last Week’s Quiz Question:
Undergraduate students who live a military lifestyle at Norwich are called “Cadets.” What are Cadets called when they first enter the university as freshman?

The answer is Rooks. Rooks walk in the gutter, navigating around upper classmen, when they first come to Norwich University until they are “recognized,” which normally comes around Thanksgiving of their first year.

The winner is Andrey N. Chernyaev. Congratulation Andrey!

This Week’s Quiz Question:
Name either of the two Vermont towns that is also the name of a foreign capital (Note: Moscow, Vermont is not a town, just a location).

The winner will receive a coveted Information Assurance Practitioner Beanie Baby.

Culture and Crisis Management

Submitted by Gerry Lewis, MSBC Faculty Member

In the last decade or so, as a consequence of a variety of unfortunate events, an amalgam of knowledge has been gathered about crisis management. Yet, the majority of organizations remain in the early stages of developing a comprehensive and interoperational preparedness and response plan. Currently, many organizations focus on security and resiliency with respect to infrastructure, operations and IT functionality. Certainly, this level of preparedness is essential to any plan, yet it is insufficient if it remains the primary focal point. All organizations should be as vigilant about the viability and availability of their workers as they are on IT, infrastructure security and other aspects of continuation of operations.


Each professional orientation and every workplace has a unique culture. Hospitals differ from retail establishments. Financial institutions are unlike manufacturing settings. And, while both are educational institutions, colleges are dissimilar from public schools. While this may seem a simplistic concept, it appears to go unnoticed when it comes to crisis planning. Cultures evolve over time and set the operational guidelines, interpersonal dynamics, beliefs systems and written and unwritten rules of conduct.


Nothing can disrupt a culture more than a crisis. Further, the response of an organization to a crisis may be dramatically influenced by its culture. To operationalize this, let’s look at a few critical questions: What are the services or products that are provided and to whom? What are the “customer expectations” of the organization? If a crisis occurs, do you shut the doors and all go home… as in the case of a restaurant or school? Or, is the expectation that “all hands remain on deck” as would be expected of a healthcare facility? Is the organization public or private? Is it for profit or non-profit? Does it have employees who have been there for decades or is it a revolving door of transitory workers searching for better employment? Has it had a previous history of critical events that have impacted its viability? Is it union or non-union? Demographically, is it made up of predominantly “babyboomers,” “gen xers,” “yers” or “zers?” How about the “genderization” of the workforce? There are a variety of other determinants that help to ascertain a cultural assessment and thus facilitate a determination as to how the culture is structured and thus how it may react to a crisis.


Crises, contracts and covenants
In addition to customer expectations, employee/employer expectations (written and unwritten rules) are critical components that may be severely tested during times of crisis. In, Why Do Employees Resist Change, Paul Strebel talks about 3 levels of “personal compact” between employees and employers:

Formal-

• basic tasks-
• job description
• Conditions of employment
• Salary, benefits, etc

Psychological- unwritten/unspoken

• Commitment
• Loyalty
• Effort
• Trust

Social- unwritten/unspoken

• Values matching
• Career development
• Promotions
• Conflict resolution
• Layoffs
• Risk sharing

People do not work just for monetary reward. After the formal level (contractual) has been established and satisfied people then look beyond to a deeper level of unwritten/unspoken expectations (covenants) between employee and employer that satisfy their sense of esteem and appreciation. This is the level where organizational resiliency lives and flourishes or withers and dies.


Last week’s Quiz Question:
Vermont has four seasons; summer, foliage, winter, and _________.


The answer is “Mud Season.” Vermont has many dirt roads, and they turn to muffler-sucking mud during the spring. A true Vermonter becomes an expert at navigating mud without getting stuck, assessing which lines to pick upon approaching different situations.


The winner is: Andrey N. Chernyaev. Congratulations Andrey.


This week’s Question:
Undergraduate students who live a military lifestyle at Norwich are called “Cadets.” What are Cadets called when they first enter the university as freshman?

Send answers to: jorlando@norwich.edu

The winner receives one free entry into the Dog River Run, and will get a chance to crawl and run through the dog river with Cadets carrying a stone before the first day of classes.

Ethical Issues in Penetration Testing

Imagine that you are charged with implementing and testing security policies at your organization. You know that most security breaches exploit employees who are lax in following security policies, and so you hire an outside agency to test if policies are being followed by employees. The agency uses the following tests.

Piggybacking: An operative wearing a suit and tie, and carrying a briefcase, stands at the front entrance to a corporation. He waits for an employee to unlock the door with his ID scan and follows him in.

Shoulder Surfing: An operative notices employees standing outside a door smoking on their break. He walks over and mills about looking over his shoulder as employees type the keypad code to reenter the building. With that information he lets himself in.

Computer Technician: Two operatives walk in to an office wearing “Computer Doctors” jumpsuits. They tell the administrative assistant that they have an order to fix the system. The assistant tells says that “Mr. Smith did not tell me about this, and he’s on vacation and can’t be reached.” They reply that “We’re booked for the next two weeks. The system is overheating and could melt down at any moment. It has all of the customer information on it. If it burns up because we were not allowed to work on it, somebody’s going to get into a lot of trouble. Are you sure that you didn’t forget the order?” The assistant nervously lets them in.

Bribery: An operative posing as a representative of another company approaches an employee outside of work and offers him $50,000 to get some memos concerning the company’s plans for a new product.

Are all of these forms of penetration testing ethically permissible? What do you think?

Last Week’s Question:

Until recently, Norwich University owned what other college in Vermont?

The answer is: Vermont College in Montpelier

The winner is Autumn Crossett. Congratulations Autumn!

This week’s Question:

Vermont has four seasons; summer, foliage, winter, and _________.

The winner receives two tickets and round trip airfare to the Information Assurance Hall of Fame, housed at an undisclosed underground bunker in the Appalachian Mountains.

Send your guesses to: jorlando@norwich.edu