the importance of survivability

I was at the hospital the other day, as an outpatient. 

The hospital was brand new with state of the art technology throughout. After following the obscure route to the department I required, I was greeted by a queue.  Not a big queue, but a definite queue, all the same.

The person behind the reception desk, who was by herself, explained to me and the other people in the line that the computer systems were down, as they were constantly integrating the old and new systems,  consequently unless we knew the consultant we were seeing it might be a wait.

The wait did in fact happen and the line started to move out of the department into the adjacent corridor.

It made me think that there are some serious implications of a hospital system going down. 

1. When the system went down, there was only one person left to do the job of three or four.  Certainly with a computer system the job was a one person job, but without it more staff were required. This meant the computer was saving money for the NHS as long as it was working.
2. It is critical that a hospital computer work, in this instance, there were two other terminals with old databases which could be manually searched for the information but things such as the time of appointments and other key information was missing.  This made me realise the importance of a survivable system for hospitals but also for all places of work where information time is money.
3. The third issue is that of redundancy, without the back up computer systems the wait would have been a lot longer.  The fact that there was redundancy of information meant that the hospital did not grind to a halt but managed to limp along.

As we progress into the 21st Century, it is important to realise that if it is digital it is transitory in nature and can easily be destroyed, manipulated and  lost. Without hard copy we are all at risk of losing important things as more critical information about our lives is put into digital format.

the dependability issues of caller identification in the digital age

I recently did a Soapbox piece for Telecare Aware (http://www.telecareaware.com/index.php/telecare-soapbox-the-security-of-telecare-confidential-information.html) on security of information in relation to telecare operators and I think that this is something that needs to be addressed more widely.

Recently, I received a call from the bank about a matter that they wished to gauge my opinion on.  Fair enough, you might think, but before they could do the questionnaire, they needed to go through the obligatory security protocols.  The first of these, like the previous post was "are you Mr" "what is your date of birth"..... etc.  Now, correct me if I am wrong, but there is a fundamental security issue with adopting this approach.

Firstly, there is no way for the caller to verify it is really me without me providing them with personal information which they must already be in possession of to verify this. (dependability problem number 1)

Secondly,  I must provide my personal information prior to them being able to provide theirs. In fact, their ability to identify themselves effectively is dependent on me identifying myself to them satisfactorily. This is because they cannot provide any of the personal information about me to me without breaking their code.  They could provide the odd number from my account, but so could anyone who has my bank account details, such as anyone I have given a cheque to or paid by card or any one who knows someone at a call centre that does the work for a bank or utility company / online shopping company etc. (dependability problem number 2)

In other words the details they are likely to provide are already, possibly, out in the public domain for those who want to get them.

This leads to the third issue. If the information they can provide is not unique to me, how can I guarantee their authenticity?  The simple answer is that I can't, in fact no one can actually truly guarantee beyond doubt that they are talking to the person they think they are talking to without visual confirmation. dependability problem number 3)

Thus we arrive at stalemate. Clearly the caller from the bank knows I am who I am, as they have called me on my mobile phone.  I do not sound like a child (hopefully) and I, in all probability am the person they are to contact.  Clearly, exceptions could occur, but this is always the case, but these are cases of more serious fraud.

Thus, we need to design a system of  authentication which allows the caller to identify themselves to the called,  without the current security breaches that are enforced.  One method would be a password system such as the one to log into the bank.  Another is a an app that the caller could use on their phone to authenticate the call from a bank or some other body.  The app would not be too difficult to do provided the companies are able to give up the numbers they use to call on, but most have a system where the caller number is withheld.

So, we have  to go back to the drawing board.  We need to rethink telephone communication and the security implications of caller identification.  If we do not, then we put ourselves at risk, as the respondents, who are forced to provide personal data to a virtual voice who does not and cannot identify themselves to the same standard as online users experience. (dependability problem number 4)

We hear a lot about hackers and scamming but the security in place by major companies is neither usable or effective for the either party nor is it secure.