
Today an increasing number of organisations – emergency services, government departments and financial institutions – hold information nationally and access it nationally, and, in some cases, offshore it.
There is relatively little offshoring of information by government. But corporate organisations, credit helpdesks and so on hold their customer relations management overseas.
They share information over the web with a vast number of IT systems and databases. It is almost impossible for anyone to know on what scale this information is accessible.
The aggregation of information, in itself, escalates the level of sensitivity. So there is greater risk of abuse or corruption, either intended or accidental.
Unfortunately, shared technology increases risk, and criminals and vandals are using this same technology to remotely attack data systems. These attacks can be very successful, and by their nature make the deterrent of legal action more difficult.
We are faced with different threat levels to network-based information systems. These range from the careless user who leaves a disc on a train to foreign intelligence services who engage in cyberwarfare against perceived enemies.
So in the quest to satisfy the network-enabled world's increasing demand for effective data protection, the first step is an accurate assessment of risk.