Culture Clash

What wins: the unstoppable force, or the immovable object?

Recently we’ve been engaged in a process, like many local authorities, of connecting ourselves up to the Government Secure extranet. In order to do this (and access a range of applications hosted by central government and other agencies) then public sector bodies have to clear a number of hurdles in the form of the Code of Connection (CoCo) – a list of security standards that we have to meet in order to provide assurance that the sensitive data that will be carried will be secure.

So far, so sensible. But there’s a problem: the rules (devised by the Government’s security wing, CESG) state that a local authority must own the equipment that is being used to access the service. That is the immovable object in the opening statement of this posting. So what is the unstoppable force?

The consumerisation of ICT has been on our minds for a long time, and even more so with the advent of cheap (or free) cloud computing services like Google Apps. If the ICT department can’t come up with solutions that satisfy the requirements of ease, speed and convenience demanded by today’s digital natives, they will simply move their data somewhere that does. To this end IT strategy has largely been about providing fast access on any device, from any location, to data.

So we have a problem: how can we enable these consumer devices to access our data whilst protecting the security of our connection to the rest of government?

Possible answers include segmenting our network to provide services to unmanaged devices on one side and fully managed services (including public sector network) on the other. But this is expensive. Alternatively, some argue that a bootable device (like the BeCrypt trusted Client) could be used to provide a trusted platform on any machine to access secure GC services. We don’t yet know if these solutions pass muster with CESG though: so stay tuned.

We’re really interested to know if other local authorities have dealt with this problem and if so, how they’ve gone about mitigating the downsides.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: