tfpl blog

The Cabinet Office has a new Head of Knowledge and Information Management: but what does it mean for EDRM?

The UK National Archives (TNA) used to be the main champion and driving force behind EDRM (Electronic Document and Records Management). In 1999 they issued a specification that defined the key features of EDRM systems as we know them, systems that:

• hold a corporate fileplan

• hold retention rules and access rules

• allow record folders and the documents inside them to inherit retention and access permissions from their place in the fileplan

TNA instituted a testing regime and approved those EDRM systems that met their standard. In the years after 1999 whenever a UK Government Department needed a corporate document management system they routinely specified that it must be TNA approved.

In 2005 the National Archives ceased testing new systems against theirtandard. One of the reasons for that they ceased testing was their preception that it led to an over focus on the technology. Just because an organisation implemented software that complied with TNA standards did not automatically mean that a couple of years later it would be churning out robust and reliable electronic records. So much depended on the configuration of the system, how it interacted with other systems on their IT estate, the quality of the fileplan and how (or whether!) users adopted it.

Not only have the National Archives now eased testing EDRM systems, they have also started adopting a distinctly neutral tone when talking about EDRM. Although they succesfully use an EDRM system (Objective) themselves in their own office, their official stance is that EDRM is one possible solution, that works for some organisations in some circumstances.

In 2007 Roger Smethurst, then Head of Information and Records Management at DEFRA, decided to pull the plug on DEFRA's implementation of a TNA approved EDRM system. Instead he implemented SharePoint, a system not built on the EDRM model (out of the box it has no place to store a fileplan). DEFRA chose not to plug in an EDRM system behind SharePoint, instead they made customisations to SharePoint to put in as much records management functionality as they felt they needed. DEFRA's implementation is seen by some as a model of how to implement SharePoint as your main document and records repository.

Roger is a refreshingly straight talking person. His has made his views on EDRM clear in many presentations over the past couple of years: he thinks the problem with it is that it requires ordinary staff to think and act like records managers.

Roger Smethurst has just been appointed Head of Knowledge and Information Management for the Cabinet Office. The appointment brings Roger back in contact with EDRM, after ditching it at DEFRA. The Cabinet Office have recently finished rolling out an EDRM system to all of its staff. My mind flashes back to the 2^nd TFPL SharePoint conference - Roger had just finished his presentation about DEFRA's SharePoint implementation. A member of the audience asked him what he missed about the EDRM system after DEFRA ceased using it. 'Nothing' replied Roger.

It is hard not to read into Roger's appointment further evidence of the TNA's cooling towards EDRM: Natalie Ceeney, Chief Executive of the National Archives, was on the interview panel.

James Lappin

Web 2.0 versus CRM

Many UK local authorities have implemented CRM (Customer Relationship Management) systems. One important use that Councils make of their CRM systems is to provide forms on their websites. Citizens can use these forms to submit comments, complaints or requests to their council. The CRM uses workflow to route the submission to the appropriate department; and to track, manage and record the response.

Tom Steinberg runs mySociety, a group that develops web 2.0 applications to enable citizens to influence government and politics. One of these applications 'FixMyStreet' makes it easy for anybody, anywhere in Great Britain to report something that needs repairing/cleaning/removing. They simply click on a map to indicate where the nuisance is and add any details they want to provide. They can also upload a photograph. The citizen does not need to know which tier of Local Authority (Borough, Unitary, County, City) is responsible for the problem. FixMySite will send an e-mail to the Council responsible, and track the response.

The service has angered Local Authority IT managers who, according to this report in The Guardian, gave Tom Steinberg a hostile reception at a recent SocITM conference. The problem is that the e-mails sent by FixMyStreet bypass the CRM systems, and the Council therefore finds the queries harder to process, control, track, record and report on. The IT managers want mySociety to build interfaces from FixMyStreet to the Council CRM systems. MySociety say that is unfeasible because there are hundreds of local authorities and each different Authority's CRM would require a seperate interface.

The lesson to be drawn from this stand off? Organisations can invest in on-line channels of communciation which they hope that their audience use, but if their customers/citizens opt to use an alternative channel there may not be a lot they can do about it.

James Lappin

Twittering and the SharePoint Summit

This October's TFPL SharePoint Summit certainly left delegates with much to ponder following an event focused on the nitty gritty of Sharepoint implementations, designed to give us an insight beyond popular hype surrounding the product. But how will they reflect on their experience at the Summit?

Before this October I had a somewhat negative opinion of such things as Twitter and "smart phones" which I had discounted as gimmicky distractions conducive to naught but pointless chit-chat.  Julian Birkinshaw, during his inspirational reinventing management presentation at this October's ebic (Connect with the Future), asserted that the most committed and effective employees are also those who tend to be most active on social media at work.  My experience over the last two weeks has certainly acted to cement this view.

I watched somewhat outraged as my colleague, James Lappin, and my new buddy, KPMG's Thöre Donner, were furiously hammering away at their respective notebook and Blackberry  keyboards; I thought they were answering emails during the proceedings!  However, after a little investigation I realised they were actually twittering their thoughts on each presentation!

Their method certainly, hands down, topped my antiquated and tedious pen and paper note taking. In fact, after subscribing to twitter and becoming a "follower" of one "JamesLappin" and a "ThoreDonner", their "tweets" served to join the dots on the puzzle which were my notes.  Whether this was simply down to the fact that I am not a very good note taker or not, I decided at that moment that I will not be a spectator in this, the mobile version of the "personal media" revolution introduced by Paul Saffo at ebic.

Aside from being a useful point of personal reference, like a kind of public day to day diary, Twitter can serve to extend your network and broadcast information to thousands of peers.  For example, Ewan McIntosh's live blogging and twittering of Paul Saffo's keynote piece at ebic attracted an audience of 6000 people in addition to the 70 delegates who were present, increasing its reach almost 100 times and on a global scale.  Ewan wrote this blog live at ebic. Interestingly, James Lappin mentioned to me that, this may also raise the possibility of future conference speakers being selected on the basis of their popularity on social computing media...

Anyway, here's how Twitter works: I literally just clicked the search function on twitter, typed "Sharepoint" into the search field and hit enter.   I am now viewing, in chronological order, what thousands of people are pondering about SharePoint.  If I think that person is interesting, I will choose to follow him or her and will subsequently receive their tweets on my homepage feed.  The concept is known as microblogging, so the premise behind it is that you should keep your thoughts concise with a maximum of 140 characters per blog.  But there is no limit to the number of blogs you can post.  So if you're at a SharePoint Summit, for example, I can search sharepoint and tune into your sentence by sentence report.  Here are some examples of what I picked up from James and Thöre's tweets during the proceedings:

JamesLappin Sharon Richardson is up next, here is a link to her SharePoint blog http://sharepointsharon.com... 4:19 PM Oct 14th

JamesLappin Sharon says that SharePoint is not best of breed in any of its areas. A specialist cms, search, collaboration system will do it better. 4:30 PM Oct 14th

JamesLappin Microsoft is investing lots of money into Facebook. Sharon speculating how facebook might influence future sharepoint development 4:40 PM Oct 14th

JamesLappin Sharon predicts the next generation of SharePoint will include Access, more social computing, and folksonomy/tagging capability 5:08 PM Oct 14th         

                                                    

thoredonner Jones Lang lasalle say MySIte is a massive quick win! 3:29 PM Oct 14th         from TwitterBerry

thoredonner mysite can improve links and navigation into your intranet by up to 500 per cent. 3:33 PM Oct 14th from TwitterBerry

thoredonner Business language is English and so the global site will be English.  Legal documents will in the correct language 3:34 PM Oct 14th from TwitterBerry

thoredonner Multi language takes planning and time 3:34 PM Oct 14th from TwitterBerry                                                                 

                           

 

Reinventing management with Julian Birkinshaw at ebic

Our second keynote speaker did not disappoint. Julian Birkinshaw delivered an inspirational presentation on the evolution of management. However, before Julian's eagerly anticipated contribution, we gained a valuable insight into the KIM supplier and media market from:

• Mark Bootherstone, European marketing director of Dow Jones, who gave a fascinating insight into how his organisation is moving forward and beyond the search box in researching and delivering news relevant to its subscribers. 
• Jeremy Bentley, the managing director of Smartlogic, outlined the indexing challenge which unstructured corporate data poses to organisations today and a look into the innovative techniques vendors must address that challenge with.
• Lynn Collier, director of archive and compliance solutions at Hitachi, gave an overview of how her organisation has adapted its R&D to meet the new global challenges it faces.  The separate business unit R&D functions of this transnational corporation have been networked to link and apply innovation across its seemingly unrelated areas of business.

The premise of Julian’s speech was that management should be reinvented before it consumes managers.

Julian described variety as the lifeblood of progress yet management is very limited in the variety of practice it applies. To illsutrate, Julian gave some interesting and different management models which go against the grain of convention:

• TopCoder, a software development organisation which tenders projects through its global network of freelance developers. The best solution is then selected and the successful developer is rewarded financially and additionally gains repute and recognition from his peers.

• Happy Computers for its unique management and recruitment policies in which CVs were completely disregarded in favour of bringing applicants in to participate in training sessions.  Applicants are selected on the basis of their performance during these sessions.

Julian then proposed his framework for the rethinking of management in light of the technological and human drivers of today and the foreseeable future where:

• Objectives would move from being goal-driven to oblique, a move described as the cornerstone of long term profitability.  Oblique goals give the organisation a direction in which to work as opposed to an outcome based vision - so what happens if you achieve your goal? Two contrasting mission statement examples were provided:

<><><><>

Exxon Mobil	IKEA
“We must continuously achieve superior financial and operating results while simultaneously adhering to high ethical standards."	“To create a better everyday life for the many people.”

• Individual motivation would be managed intrinsically instead of extrinsically where the discretionary human attributes initiative, creativity and passion would be accommodated.  This is contrary to sole reliance on the contract-able (outsource-able) attributes of employees such as obedience, competence and diligence which are associated with high staff turnover.  To illustrate, Julian emphasised two factors which are and will increasingly impact on the management environment.  One is the widespread expectation of generation Y that the workplace should be less restrictive of social activity and the other focuses on the new challenges to KIM that new “Web 2.0” technologies will pose.  Julian further highlighted that the most committed employees also tend to be the ones whom spend the most time on non-work related social matters, using W2O media, during work hours.

• Management will shift from a bureaucratic to an emergent focus which would simplify co-ordination and processes by allowing them to shape themselves into models which work best for a given organisation.

• And decision making would draw increasingly from collective wisdom which is more reliable than individual wisdom alone. An argument anecdotally supported by reference to Who wants to be a Millionaire? where the expert (call a friend) was right only 65% as opposed to 91% of the time when the audience was consulted.

The message that I got from Julian's presentation is that despite what the management FAD of the day is - the principles of an organisation's management structure and processes should be formed as a result of an iterative process - and one size does not fit all. 

The Social Impact Award at the Schloss-Charlottenburg

Thursday gave delegates and facilitators alike a chance to unwind following a rigorous two days of content and activity packed conference proceedings. After a prompt one hour site seeing coach tour through the vibrant and beautiful streets of Berlin - during which our lovely guide inadvertently highlighted the difference in German and Anglo-Saxon humour several times (to our amusement) - the evening took off with the conference dinner and entertainment at the magnificent Schloss-Charlottenburg.

As well as the fantastic food, delegates enjoyed and took advantage of this opportunity, with the aid of alcohol, to find out a little more about each other.

Richard Kellett-Clarke and Roger James then took stage to announce the winner of the ebic 2008 Social Impact Award. 

Deaf Parenting UK’s Asif Iqbal won the award for his two-person organisation in recognition of their extraordinary KIM achievement by delegates. 

Echoing popular regret among delegates that the other Fellows would leave empty-handed despite their fantastic achievements, Richard Kellett-Clarke, in a surprise announcement, awarded each of the runners up a €500 consolation prize courtesy of Idox Group.

Delegates were then whisked back to the Kempinski Hotel where networking continued... in some cases (myself and some prominent colleagues who shall remain nameless included) to the very early hours of Friday morning.

The Green, the Blue and the Orange

The schedule for Thursday 2nd of October saw ebic 2008 depart from the kind of conference proceedings you would normally expect with the introduction of an eagerly awaited and innovative scenario session.  But first, Tony Sheehan, Di Martin and Jessica Frankel gave us their take on current and future issues around KIM in large organisations. 

• Tony Sheehan presented 10 challenges, using Arup as a case study, which affect KIM in organisations today;
• Di Martin stressed a proactive KIM policy as paramount to maintain the relevance and efficiency of today’s higher education library services;
• and Jessica Frankel predicted the demise of the corporate library with the commoditisation of information and the continued drive to outsourcing, which she stressed is not always the solution despite what management may think.

After lunch, the scenario sessions kicked off and we got down to the business of the day with delegates breaking up into groups to take turns debating in each of the three worlds. Just to recap:

The Green World: Companies Care

• Social responsibility dominates the corporate agenda and
• concerns about demographic changes, climate and sustainability become the key business drivers.

The Blue World: Corporate is King

• Big company capitalism rules as
• organisations continue to grow and
• individual preferences trump beliefs about corporate social responsibility.

The Orange World: Small is Beautiful

• Companies begin to breakdown into collaborative networks of smaller organisations and
• specialisation dominates the world economy.

The Green World – Companies Care

The discussion commenced with some initial confusion as to whether we were actually in the Green world.  Before getting round to debating the question at hand delegates spent some time reinforcing their understanding of the world by running through some of the political, economic, social and technological drivers that would bring such a world to being, those were:

                                       

Political	Economic	Social	Technological
Green   legislation	Increasing oil prices	Popular   demand	Technology   which masters the physical interactions of human beings such as Halo.
Non-compliance   penalties	Energy savings	More significant culture shift to green	Availability of green fuel
Taxation	Customer/client   pressure	Trust only in green co.s
	Damage   to Reputation

The significant developments/events/trends that will impact on KIM activity that delegates in this session came up with follow:

• Local human resourcing to cut out the travel involved in global expertise sourcing.

• A push towards remote collaboration/interaction to negate business travel

         o    Which may give rise for a need to archive e-conversations
         o    And a greater difficulty in justifying business trips to management

• Green information legislation

         o    “Open source green knowledge” along the lines of FoI
         o    which would perhaps require a knowledge “gatekeeper” or facilitating officer
         o    to implement consistency in green practice throughout the organisation.

• The need to embed a green corporate culture, necessitating employee training

The Blue World – Corporate is King

The conversation, similarly to the green world, initiated with a contextual discussion on how corporations would operate.  Would the company swallow up smaller players or would it primarily operate through subcontracting?  Who would hold the balance of power, employees or the corporation? Would there be room for individual innovation in the latter case and as such should the knowledge manager become the “crucible for innovation”, an innovation broker?

In discussing what KIM activity would ensure success in this world, delegates posited:

• the ability to capture the value of KM successes and present them in a language that makes them understood and appreciated by management and accountants;

• the development and maintenance of a mechanism within a potentially strict hierarchical environment which would ensure a voice for marginal employees and departments;

• the promotion of clear corporate vocabulary within the framework of - what would likely be - a tightly structured information strategy;

• ensuring the effective delivery of relevant business intelligence from information vendors (which may be the primary source for data as in-house equivalents become a redundant expense)

• supporting the proliferation of initiatives which would most likely be top-down from an apolitical/non-partisan stand point;

• and that the management of networks, supporting technology and best use of available human resources - for the encouragement of innovation in a potentially rigid corporate environment - would be key.

The Orange World – Small is Beautiful

Given the networked and thus naturally KM aligned nature of this world, we got straight down to business here.  The question required us to discuss the KM roles and skills which would be most valued by organisations in such a scenario.

• It was immediately decided that knowledge managers would be more integral to the daily operations in such a world, perhaps as brokers between disparate professional and commercial networks.
• It was then proposed that in an environment where organisations are small and resources limited, that most workers would require training in the basic tenets of knowledge management so the role for experts may perhaps lie in consultation and training.
• The KM function would additionally be essential to project managers in locating and recruiting the human resources they require.
• Knowledge managers as experts would be additionally required to stay in tune with skill locations and information within the right networks (as knowledge harvesters).
• Such a scenario may give rise to a KM guild, or multiple knowledge agencies which would compete for the custom of the many small organisations. 

Our diligent facilitators and reporters were on hand in each of the three worlds to stimulate and record the debate in each world covering all three questions.  The outputs are being consolidated as I write and will be with us at the end of October - and will definitely make for interesting reading.

Tomorrow’s talent, citizens of the future, tomorrow’s content and tomorrow’s enabling technology

Bill Parsons, Ewan McIntosh, Melanie Goody and David LeCore shared their insight on tomorrow’s talent, citizens of the future, tomorrow’s content and tomorrow’s enabling technology during the second half of day one at TFPL's ebic 2008 conference in Berlin last week.   

Bill Parsons argued that organisations would have to align with issues relevant to the future work force, such as the environment, to attract new talent. This new talent would also demand new technology which will enable it to operate and interact with others beyond what is seen today as the normal work environment. Another trend identified by Bill was that the future’s talented workers would largely determine their job prospects by location rather than vocation. Finally, Bill argued that there is a correlation between how enjoyable and fun a workplace is and its attractiveness to new talent.

The crux of Ewan McIntosh’s lively presentation centred on understanding “generation Y” and the technology with which they operate as essential to facilitate their presence better in society. Ewan spoke contrary to popular belief of gen. Y as lazy and self absorbed. He argued that generation Y are passionate about the issues which affect them. He illustrated this point with youth action which saw a demonstration of 500 mobilised, through Bebo, against planned school closures in Scotland, which largely led to the scrapping of the plans. 

TFPL's eminent KM guru, Melanie Goody, then took the stage and focused on the content of tomorrow. Using the “rear view mirror” in her forecasting, Melanie examined the themes of ebic in 1998, 2005 and 2008. In doing so, Melanie highlighted the trend in the KIM space where content sources have moved from structured and externally published material, to the ungoverned and unstructured digital universe. As such the content management problem for the foreseeable future relates to how new content can be governed and managed efficiently especially with the increase in storage costs that the exponential growth in content will incur. Nothing highlights this better than the fact that aggregated global electronic information is growing 60% a year of which 70% is created by individuals but corporations are accountable for 85%.   

In dealing with this complexity corporations should learn from past mistakes of enforcing the use of rigid systems and focus on implementation issues rather than technology in itself.

Tying in with Melanie’s closing remarks, David LeCore, outlined a seven step guide in implementing new technology in your organisation:

1. What is the problem that the technology will solve (what is the business case)?
2. Will the technology solve that problem? Pilot it and find out.
3. How long might it take for the technology to become obsolete?
4. Take advice and manage expectations.
5. Understand your own organisation in terms of its culture and ensure support from the very top.
6. The technology is just one component in solving the identified problem, consider other components such as employees, management, culture, process, content and budget.
7. And finally measure the benefits, set bench marks and compare the success of implementation, user participation and satisfaction and the impact of the technology on such things as KPI.
   

Alun Davies followed with many points which can be related to and echoed David Lecore’s seven steps. He encourages us to focus on the opportunities that technologies such as those encompassed by Web 2.0 offerand that there should be tolerance for the way people want to work.

The day’s conference proceedings closed with informal and simultaneous pitches by the ebic fellows (introduced last week) into the work and systems which had earned them their place as finalists. Delegates moved between 10 minute presentations designed to further inform delegates of their work. Delegates were given until Thursday, 5pm, to submit their votes. 

As a voter, it was a very difficult decision for me. All of the ebic Fellows were deserving of the prize as far as I and others could observe and it seemed unfair that three would ultimately lose out. Initially I opted to vote for the candidate to whose cause I could most relate. However, I decided that doing so would be unfair given that the finalists were chosen on the merit of what they had achieved rather than the worthiness of their cause but that hardly made the decision any easier as all had achieved remarkable results with the very limited resources that they have.

Paul Saffo's vision of the future at ebic

Uncertainties, hindsight, contradictions and technology failures were cornerstones of eminent futurologist Paul Saffo's riveting keynote speech, at TFPL's ebic conference in Berlin, as key indicators of what looms on the horizon: 

• When predicting what the future holds, look back twice as far as you’re looking forward in order to identify trends and analogues. 
• Never diminish uncertainties when looking into the future – they are key indicators. People tend to see uncertainties as risks and we are all generally risk averse and often neglect their consideration in our forecasts often resulting in inaccurate predictions.
• Big change is hard to see, technology pundits are often wrong twice: when a new technology they champion fails and when it succeeds a number of years later after they’ve discounted it.
• The information revolution is over and the personal media revolution has dawned. 
• When a technology becomes successful it transforms into a medium of entertainment with the mobile phone as a prime example with 10% of the online music industry being comprised of ring-tone sales for consumer entertainment. 

It takes 20 years for a technology to take off after its inception and this often happens with the introduction of complementary components, for example: 

• TV took off 20 years after the introduction of widespread broadcasting technology in the 1950s.
• The internet and email became ubiquitous in the late 1990s with the inception of the WWW, the client-server and peer to peer vehicles.
• Habitat: a failed 1980s virtual world precursor to the thriving 2000s Second Life.

There has been a shift from mass media to personal media. Personal media is what is now driving online technology. Paul underlined this point with reference to the fact that David Letterman's rant  about John McCain's interview cancellation was viewed many millions of times more on youtube than the TV broadcast on CBS.

The Characteristics of Mass and Personal Media

                                   

	Mass Media	Personal Media
Medium	TV	The Web
Location	Living room	Anywhere
Interaction	Watch/consume	Consume, participate, create
Broadcasted by	Few Mass Media Outlets	Many millions of individuals
Model	Product/Service	Subscription

Personal media has some way to go before maturing in the same way that mass media has, the vast majority of the world' population doesn't even have an internet connection.  At the moment, personal media as such is at the stage of experimentation equivalent to that of TV in the 1950s.  Paul illustrated this with an analogy between Winky Dink (1950s) and weird applications of personal media such as Dr. Horrible's Sing-Along Blog.

As a result of the personal media revolution we are now moving from the service/consumer economy to, what Paul terms, the creator economy where consumers are also producers (e.g. bloggers, youtubers).

Google has been a success because it's managed to monetise the smallest quantum in a search string; the next industry mover and shaker will be one who successfully monetises single clicks on the internet, as the next smallest quantum.

Sensor technology will be the next step in evolving and further personalising consumer products and is presently embedded on a small scale in a number of retail products, an example being the Nike Plus training shoe. It detects, as an example, whether your pace is fading and subsequently instructs your iPod to switch to a more motivating song. 

The increased reliance on sensor technology will ultimately give rise to the widespread introduction of robotics in our daily lives, which Paul described as a complex series of sensors. He illustrated the potential popularity of robots with anecdotes about people giving their robotic domestic vacuum cleaner, Roomba , names and even taking it on holiday with them!  Moreover, Paul's most revolutionary prediction (as far as I am concerned) is that in 20 years, 50% of all US traffic will be robot driven.  The technology exists: Paul made reference to the Urban Challenge robot car race.

A manifesto for records managers in the age of web 2.0

Between 2pm and 3pm this afternoon I participated in a records management webinar hosted by Steve Bailey on his Records Management 2.0 Ning site. Steve set up the Ning site to provide a place for records managers to discuss how to adapt our profession to the web 2.0 world.

The task of the webinar was to see whether we could come up with a manifesto for records management 2.0, drawing inspiration from the Librarian's 2.0 manifesto. The group wanted to retain the positive tone of the Librarian's manifesto, and in particular its positive attitude towards change.

The points flew in thick and fast: here is how the manifesto stood at the end of the webinar:

1. I will recognize that the universe of information culture is changing fast and that records management needs to respond positively to these changes to provide systems, policies, advice and services that are helpful to our organisation, our teams and our colleagues.

2. I will educate myself about the information culture of my users and look for ways to incorporate what I learn into records management services.

3. I will let go of previous practices if there is a better way to do things now, even if these practices once seemed so great.

4. I will take an experimental approach to change and be willing to make mistakes.

5. Whilst we recognize the need for final assured quality in record-keeping systems this should not inhibit experimentation, innovation and development.

6. I will not fear Web2.0 services, but rather will take advantage of services users need to deliver agreed benefits to their business/organization.

7. I will avoid requiring users to see things in records management terms but rather will shape services to reflect users' preferences and expectations.

8. I will be willing to go where users are, both online and in physical spaces, to practice my profession.

9. We recognise that it is not easy for our colleagues to keep records: they are overloaded by too many e-mails, and they are faced with a multiplicity of different tools and systems where information can be created and captured

10. We recognise that we will never have a perfect records system, and can never guarantee that our organisation will have full records of everything it does, but we will work to improve the organisation's capability of keeping and understanding ts records

11. We will, at all times, strive to maintain a balance between the needs of our users and the legal, regulatory and operational requirements of our organisations

12. I will recognize that organisations change slowly, and will work with my colleagues to expedite our responsiveness to change

13. We will strive to deliver a service users can trust and that is transparent and open to all stakeholders

James Lappin

Has the Firewall had its day?

There was a lot of talk about firewalls at the Web 2.0: Practical appplications for business benefit conference this week.

Luis Suarez said that there was no point in organisations using their firewalls to block applications such as facebook and instant messaging. People bring their mobile phones to work which gives them access to that stuff anyway. Employee are no longer dependent on the devices provided by their organisations.

Euan Semple said that firewalls give an illusion of protection, but information within the firewall is only a cut and paste away from the world wide web.

John Meakin, head of information security at Standard Chartered bank said that firewalls are increasingly failing to do the job that they are asked to do. They were designed to shield an organisation's entire network. Your firewall is tasked with protecting:

- all of your informations systems
- all of the servers that the systems sit on
- all of the devices that the systems run on
- all of the information that the systems hold

As time has gone on this task has increased in complexity. Organisations have massively increased both the number of channels through which they connect to the outside world, and the volume and variety of information they exchange through those channels.

This increased complexity means that people in information secuity roles like John's are forever having to patch and mend weaknesess in their firewall. John says that he feels like the dutch boy with the thumb in his dyke. It was a powerful image: such fragile protection against the might of the sea.

For John the answer is to give individual systems/ servers/ devices/information objects their own protection, through encryption. The challenge with encryption is getting users to apply it. The technology is freely available to the end user already (Microsoft issue it as standard in Vista) but there is no user friendly interface to it.

Standard Chartered have started an ambitious project to reduce reliance on the firewall by protecting the information itself rather than the network it is housed upon. They are building a user friendly encryption interface which will prompt people when they save or communicate information to decide:
- whether or not it needs encryption protection,
- whether or not they want to prevent recipients forwarding it on, printing it, copying it, or cutting and pasting from it.

If Standard Chartered get this right, and if their users buy into it (big 'ifs'), then they will be able to worry much less about any weaknesses in their firewall. Even if secret information did find its way out onto the web, the only people able to access it would be colleagues with the encryption keys.

James Lappin