Mark Lyn­der­say

The re­mark­able sto­ry of a con­fi­den­tial mem­o­ran­dum re­gard­ing a po­ten­tial ter­ror­ist threat be­ing cir­cu­lat­ed on so­cial me­dia with­in hours of it be­ing is­sues from po­lice head­quar­ters in T&T caused cit­i­zens no small dis­qui­et.This was a doc­u­ment that al­leged a plot against Prime Min­is­ter Kam­la Per­sad-Bisses­sar by an or­gan­i­sa­tion with a proven ca­pac­i­ty for in­sur­rec­tion in this coun­try.

That memo, pho­tographed and cir­cu­lat­ed wide­ly, sug­gest­ed se­ri­ous prob­lems with the way that in­for­ma­tion is shared and man­aged with­in the T&T Po­lice Ser­vice, but it isn't a prob­lem that's unique to a po­lice force or na­tion­al de­fence ser­vices, ac­cord­ing to Rober­to Ar­bel�ez CIS­SP, CISA Se­cu­ri­ty Pro­gram Man­ag­er for Mi­crosoft Latin Amer­i­ca.

Ar­bel�ez start­ed work­ing in the se­cu­ri­ty sec­tor at 16 while at uni­ver­si­ty and has 20 years of ex­pe­ri­ence in work­ing with se­cu­ri­ty so­lu­tions in most coun­tries in Latin Amer­i­ca, cre­at­ing so­lu­tions for both the cor­po­rate and pub­lic sec­tors."It's a prob­lem that cross­es in­dus­tries," he said in an ex­clu­sive Skype in­ter­view.

"It's the same is­sue for po­lice of­fi­cers, in telecom­mu­ni­ca­tions in­dus­tries and in bank­ing, pri­va­cy and se­cu­ri­ty are ba­sic is­sues that CIOs in large or­gan­i­sa­tions have to ad­dress. "So­lu­tions have been in place for decades which ad­dress those con­cerns. In the 70s the US com­mis­sioned a cus­tom so­lu­tion to se­cure com­mu­ni­ca­tion at the Pen­ta­gon."

"That process is now much eas­i­er to im­ple­ment and man­age be­cause of the tech­nolo­gies that the cloud and mo­bile have in­tro­duced."It's now pos­si­ble, Ar­bel�ez ex­plained, to lay­er se­cu­ri­ty so­lu­tions on top of cloud based dis­tri­b­u­tions.

The tech­nol­o­gy al­lows ad­min­is­tra­tors and users to set per­mis­sions that lim­it who can view a doc­u­ment to a very fine-grained lev­el. It's pos­si­ble to have a se­cured file liv­ing next to per­son­al in­for­ma­tion with com­plete con­trol over who can view each file.Se­cu­ri­ty mea­sures can block doc­u­ments from be­ing dis­trib­uted dig­i­tal­ly while al­low­ing full ac­cess for view­ing by au­tho­rised users.

Mi­crosoft, Ar­bel�ez not­ed, can se­cure voice and video com­mu­ni­ca­tions be­tween users and can ful­ly en­crypt com­mu­ni­ca­tions with­in Skype, the com­pa­ny's con­sumer lev­el VOIP so­lu­tion.It's an in­dus­try, he not­ed, which has seen the de­ploy­ment of sig­nif­i­cant­ly im­proved se­cu­ri­ty com­mu­ni­ca­tions op­tions over the last three years in par­tic­u­lar. Most of the soft­ware in­dus­try, in­clud­ing cloud providers are very aware of the need for se­cu­ri­ty, but for Mi­crosoft, it's one of the top two de­sign im­per­a­tives.

"For most coun­tries, the great­est chal­lenge is mak­ing the po­lit­i­cal de­ci­sion to im­ple­ment those so­lu­tions," Ar­bel�ez said.Oth­er is­sues arise with the qual­i­ty of im­ple­men­ta­tion of these sys­tems, and the com­mit­ment by ad­min­is­tra­tors to keep­ing sys­tems prop­er­ly or­gan­ised and se­cured.There can al­so be re­sis­tance to mov­ing ana­log based da­ta to dig­i­tal for­mats be­cause of the per­ceived se­cu­ri­ty of ana­log dis­tri­b­u­tion.

"Our prod­ucts are among the most se­cure and are more than ad­e­quate for im­ple­men­ta­tion in se­cu­ri­ty sen­si­tive sce­nar­ios," he said.The process be­gins with as­set in­ven­to­ry and clas­si­fi­ca­tion, which re­quires cus­tomers to or­gan­ise their doc­u­ments and com­mu­ni­ca­tions chan­nels in align­ment with their process­es and cul­ture, and it's some­thing that's done in­ter­nal­ly be­cause of se­cu­ri­ty con­cerns.

"This is one of the most tricky parts of the process," Ar­bel�ez ex­plains."It gen­er­al­ly can't be done by out­side ven­dors, and the process can take be­tween a year and a year and a half, we've found."

"Once that's done, the easy part is to im­ple­ment the com­mu­ni­ca­tions and doc­u­ment man­age­ment sys­tems." It's a process that can take be­tween three to six months, de­pend­ing on the com­plex­i­ty of the clas­si­fi­ca­tions that have been cre­at­ed by the cus­tomer.Im­ple­men­ta­tions take place in stages, with com­mu­ni­ca­tions be­ing the first.

A Skype based in­stal­la­tion can take around three to four months and a Share­point in­stal­la­tion for doc­u­ment dis­tri­b­u­tion can take a cou­ple of months.A full en­ter­prise or gov­ern­ment lev­el in­stal­la­tion by Mi­crosoft can take up to 18 months to com­plete, but it's done in phas­es.There can be a lot of rea­sons for not do­ing it, but it's Mi­crosoft's ex­pe­ri­ence," Ar­bel�ez said, "that so­lu­tions im­ple­ment­ed us­ing tech­nol­o­gy are safer and more re­sis­tant to ef­forts to abuse them than pa­per based sys­tems."

"Some­thing like the dis­tri­b­u­tion of a pic­ture of a doc­u­ment would not hap­pen in an or­gan­i­sa­tion that has im­ple­ment­ed a dig­i­tal­ly se­cured en­vi­ron­ment."