Interesting quote from 2013 Information Security Breaches Survey

David Willetts introduced the Survey at the InfoSec Europe 2013 conference, which contains an interesting quote, “93% of companies where the security policy was poorly understood had staff-related breaches versus 47% where the policy was well understood”.

This statistic is widely used to support IS awareness campaigns, but it begs a question.   How do you ensure security policy is well understood?   Especially in a devolved organisation like the University of Oxford?

IT Risk Management Exercise

EDUCAUSE has published an article, "IT Risk Management: Try This Exercise at Your Institution" to help institutions manage IT risk threat and IT risk opportunity more effectively.   It is based on experiences at Princeton and Oxford.

I would be interested in comments...

Only 33% of universities have IT Risk Management programmes

​In March 2013, EDUCAUSE conducted a quick poll on IT risk management in the ECAR Update subscriber newsletter. The poll was intended to informally assess the higher education
community’s thoughts on this important topic. Results of the poll, which had 104 respondents, are given: http://net.educause.edu/ir/library/pdf/ECARpollAPR2013.pdf 

33% of institutes have adopted an IT risk management programme, and a further 33% are planning to implement one.

The poll was proposed by Oxford and Princeton Universities.

10 Steps to Cyber Security

Guidance from BIS; includes:  Executive Companion and Guidance Sheets.

Useful resource.

Foresight Future Identities (2013)

The UK's chief scientific adviser, Professor Sir John Beddington, has produced a new report -   Future Identities, which examines how the changes in technology, politics, economics, the environment and demographics will affect the development of society in the UK and how policy makers can best respond.

He concludes:  mobile communications, the internet and social media will combine to have a profound effect on UK society over the next decade as we enter an era of always-on hyper-connectivity.

He sees Cybercrime as a 'Technology driver for change (3.2.4) and introduces the terms 'smishing' and 'vishing' (can you guess?).  In section 4.2.6 he addresses 'crime and criminal justice'.

Eight Brilliant Minds on the Future of Online Education

Interesting report from Davos, with eight amazing speakers.

The advent of massively open online classes (MOOCs) is the single most important technological development of the millennium so far.  Do you agree?   

WEF report: Risk and Responsibility in a Hyperconnected World

A colleague has just brought a World Economic Forum report to my attention. It has a sub-title of 'Pathways to Global Cyber Resilience'.  There is an interesting emphasis on 'collective action - individual gain'. I would be interested in comments...

There are excellent pictures too!