Paul Matthews – iStart keeping business informed on technology

What you need to know about GDPR

Jennene Kelly — Mon, 28 May 2018 23:27:59 +0000

So what’s all the fuss about? It’s actually a really significant change to the rules around personal data, and it really does affect you.

Here’s a quick summary:

The EU says the changes attempt to “harmonize data privacy laws across Europe, protect and empower all EU citizens data privacy and reshape the way organisations across the region approach data privacy.”

One of the more controversial impacts of the new rules, and the reason it has such a world-wide impact, is what they call the “extra-territorial applicability“. This means that it applies to all companies worldwide who are dealing with information about people residing in the EU, even those simply offering goods or services to EU citizens. It hits everyone and it’s huge.

One of the key changes is around consent. Basically if a company is going to store or process personal data such as names, email addresses and the like, it needs to have explicit consent. The small print in the middle of a 10-page “terms and conditions” aren’t enough – it has to be in complete plain English.

The method of consent has to be recorded as well and proper records kept. This is significant – for example, if you have a mailing list you need to be able to show when people opted in and how.

The fines are huge too. Companies can be fined up to 4 percent of their annual global turnover for breaches, with big fines for even seemingly minor issues.

Companies must now also tell people if they’ve had a breach. We’ve seen a heap of this lately – people’s information being stolen and companies keeping it quiet to try to avoid reputation damage. Do that now and it could cost 2 percent of global revenue.

Other changes are familiar to Australian’s, such as the right to obtain any information that is being held about them.

There’s heaps more as well, such as the controversial “right to be forgotten” This basically gives EU citizens the right to have Google, for example, remove references to them on searches. And again, the rules apply globally – not just to EU companies.

The new rules also put into law the concept of “Privacy by design” for software developers. Basically software developers have to show they’ve built privacy into software from the ground up, not just tagged it on in the end. This has been a long time coming.

So some really important things to think about from a IT Professional perspective as well, even if you’re not based in the EU.

View the full regulations here

ABOUT PAUL MATTHEWS//

Paul Matthews is chief executive of the Institute of IT

The post What you need to know about GDPR appeared first on iStart keeping business informed on technology.

Time to call in the pros

Jennene Kelly — Sun, 29 Mar 2015 22:27:44 +0000

In 1907 a group of engineers and bridge builders in Quebec, Canada, embarked on an ambitious project to build the longest bridge in the world. But before the bridge was completed it was to cost almost 100 human lives.

On August 29th the partially built bridge collapsed, killing 75 workers and injuring another 11. A Royal Commission of Enquiry found a lack of experience of the type and size of bridge and clear mistakes had caused the disaster and held the designer and consulting engineers responsible. Construction began on the bridge once more in 1916, but disaster struck again, when the central span was being raised into position, and fell into the river killing 13 workers.

The managers had been made aware of the problem that caused this second collapse a full six weeks prior by the engineer responsible for the construction of the centre section, but hadn’t taken any action. All in all, 88 people lost their lives to predictable failures.

So what does all of this have to do with IT and technology today?

It was after this double tragedy that the concept of the Professional Engineer was born. Engineers realised that they couldn’t continue to have such devastating failures caused by inexperience or not following reasonable standards of practice. And they could no longer tolerate decision-makers ignoring their professional advice.

A similar sentiment has been growing in the international IT community since 2008, when the national tech professional bodies from Canada, the UK, Australia, South Africa, Japan and elsewhere came together to discuss whether it was time for the IT profession to also put in place minimum competency standards. Since then, all of these countries, and many others have done just that.

In New Zealand’s case, the road towards the Chartered IT Professional accreditation that was officially released in February began when the IITP (then called the NZ Computer Society) released a 2008 discussion document outlining a range of problems in the industry and calling for the profession to form independent competency standards to address them.

As well as continual significant failures in major IT projects in both the public and private sectors, some of the issues highlighted included the global IT skills shortage; significant reduction in technology undergraduates and in the percentage graduating; negative perception of IT as a career amongst youth; and lack of retention of skilled individuals in New Zealand.

In other words, our bridges were falling down and we needed to do something about it. New Zealand’s response, run by the Institute and named IT Certified Professional (ITCP), was released in late 2009 to great success.

Up until that point, IT was almost the only vocation or profession remaining without a set of independent benchmarks outlining the minimum expected standards of skills, knowledge, ethics and professionalism for people operating the field. And we’re not just talking about the established professions such as accountants and lawyers here. Almost every area you can think of, from plumbers to librarians and architects, has minimum standards in the form of an overarching professional certification. The reason for such accreditations is that there is a real difference between someone who knows what they’re doing and someone who doesn’t. Professionals have the right to differentiate themselves and a responsibility to come together within professional bodies and define minimum standards.

In February the IITP converted the ITCP to the Chartered IT Professional NZ, issued under license from the UK-based BCS, the Chartered Institute for IT. It also introduced a new Certified Technologist accreditation for those in the first few years of their career. The reason for the change is to increase the recognition of Kiwi IT professionals both in New Zealand and around the world, and to provide credentials that are immediately recognisable by the public.

Those accredited have committed to adhering to standards of professional conduct and ethics and have agreed to be professionally accountable if they don’t. In return, they have the weight of the entire profession behind them when they say that a project can’t proceed because if it does, the bridge will fall down.

ABOUT PAUL MATTHEWS//
Paul Matthews is chief executive of the Institute of IT

The post Time to call in the pros appeared first on iStart keeping business informed on technology.

How to avoid the IT hall of shame

Jennene Kelly — Thu, 04 Apr 2013 21:41:23 +0000

Two thousand and twelve certainly saw its share of high-profile IT gaffs. The year seemed to lurch from scandal to scandal, with the two most prominent security stuff-ups being the calamitous launch of TradeMe competitor Wheedle, taken down after just a few days amidst what had become a fever pitch of complaints about gaping security holes; and the revelation that up to 736 publicly-accessible kiosks in WINZ offices throughout New Zealand weren’t properly locked down, allowing access to sensitive documents including details of abused children.

Add to that the long-running and far from resolved Novopay fiasco and 2012 certainly wasn’t a good year for the reputation of our profession.

In fact New Zealand’s Privacy Commissioner Marie Shroff has gone as far as labeling it the “year of the data breach” and, given the above issues and others such as the ACC Pullar affair, it would certainly be difficult to argue that she’s wrong.

So what really happened and what do the issues of the past year have in common? Wheedle was a well-intentioned and, by all accounts, well-resourced company that promised to finally take on incumbent behemoth TradeMe in the online auction game. Backed by the founder of Mainfreight, its battle cry included claims of good technology, 40 servers on standby and millions in advertising.

But despite all of this, the founders seriously let themselves down on the IT front. For example, they allegedly didn’t even bother encrypting passwords sufficiently and left gaps in their website that allowed members to change other members’ auction details (including reserve and buy-now prices) leaving the site open to serious abuse. In fact they made a litany of fairly entry-level coding errors and simply got the basics wrong.

It was later revealed that the website development had been outsourced to developers in India, presumably to save costs.

The WINZ kiosk situation should never have happened either. In this case, the Ministry of Social Development built hundreds of self-help kiosks to enable the unemployed to edit their CVs and search for jobs. A great idea, and for the most part they did everything right. However there were two fundamental – and basic – flaws to their execution.

The first was technical; the kiosks were connected smack-bang in the middle of the Ministry’s network with no separation, physical or logical. This meant that a somewhat minor oversight when locking the kiosks down (the ability to access network locations through Microsoft Word’s ‘Open’ dialog box) became a major issue, especially when it was combined with access to sensitive files such as phone logs, invoices and other information, including that of abused children.

While somewhat unforgivable, this wasn’t even the biggest oversight. It emerged later that the Ministry had been made aware of these issues. In fact they’d hired an external security company to audit the kiosks, then simply ignored four out of the six security issues identified, including the major lack-of-separation issue that caused the breach.

Interestingly, a request for funds to do the separation properly had been made. It was apparently ignored and the project pushed ahead without it, probably to save costs. It’s worth noting that the cost of the two recent Deloitte reports into what went wrong is an astonishingly high $450,000 so far – and that’s before the fix has even started.

So again, ignoring the basics caused potentially catastrophic results.

Then there’s Novopay, the New Zealand Ministry of Education’s payroll solution built on Australia’s Talent2 system. Those that have worked in IT for any length of time will know there are often teething problems in the implementation of any new system, especially one as complex as a payroll system for upwards of 90,000 people in hundreds of schools across a country. Teething problems are more or less a given, which is why they are factored into the rollout plans for major new systems.

Already two years overdue and undoubtedly millions over budget, did the powers that be push ahead with the Novopay launch knowing there were still issues, amidst political and financial pressure to get it done? It appears the pre-launch testing showed the system wasn’t ready; only 37 percent of trial users thought it was ready to go. Yet on 20 August 2012 they kicked it off anyway, flicking the switch on all schools and all teachers in one fell swoop.

The promised ministerial inquiry into the resulting mess will hopefully shed light on why they didn’t roll it out to a small group of schools first to identify and resolve most issues before they became totally overloaded by a backlog of thousands of problems. Kicking things off in 50 schools would have identified most of the problems that have subsequently appeared, but in a way that meant they could actually deal to them quickly and without affecting too many people. Not only is that best practice, it’s also common sense.

As you can probably see, a pattern is emerging here, one that we see constantly repeated in IT. It is a pattern of standard good practice being ignored, budgets being cut and cost or political pressure leading to cutting corners with disastrous effect.

In short, it demonstrates a naively held view that cutting costs in the implementation of IT projects won’t have the dire consequences that we see time and time again.

Isn’t it about time we stopped being so foolish? So, how do you prevent your company being the next 6 o’clock news item on privacy, security or IT failing? It’s simple really: just resource and do the job properly. Play by the rules, don’t cut corners, follow established good practice and don’t be fooled into false economy and believing that saving a few bucks now won’t cost you a bunch down the line.

The price of doing it right is seldom more than the cost of cutting corners when all is said and done. And as Wheedle, MSD, Novopay and many others have discovered, getting it wrong in IT can come at huge expense to your wallet… and your reputation.

ABOUT PAUL MATTHEWS//

Paul Matthews is chief executive of the Institute of IT Professionals New Zealand

www.iitp.org.nz

The post How to avoid the IT hall of shame appeared first on iStart keeping business informed on technology.