ISJ hears from Toby Jackman MBE, COO of Fyio Technologies, who argues that physical security providers should not only question how sensitive workforce information is protected, but why so many copies exist.
An 8.7 million-person warning
In August, a cyber-attack on Manchester Airports Group exposed data relating to 8.7 million customers.
The Financial Times reported that the information included email addresses, telephone numbers, vehicle registrations and postcodes collected through airport Wi-Fi registrations and car park bookings.
Payment details were not compromised and airport operations continued.
Those qualifications matter, but so does the scale.
The incident joined attacks against Marks & Spencer, Jaguar Land Rover and the Co-op Group.
With each of the attacks prompting familiar and necessary questions:
- How did the attackers get in?
- Why were they not detected sooner?
- Which system needs to be patched?
However, there is the question of “did that information need to be there in the first place?” and this receives far less attention.
Organisations have legitimate reasons for collecting information and the issue is whether legitimate collection has become almost indistinguishable from routine accumulation.
The workforce paper trail
I have spent much of my career in military and commercial security, where trust has operational consequences.
For manpower intensive security providers, this question is particularly uncomfortable.
Recruiting, screening, mobilising and managing large, frequently changing workforces requires a substantial flow of sensitive information – including passports, visas, identity documents, security licences, qualifications, medical records and background checks – that may be needed before someone can be deployed.
The purpose is legitimate.
An operator must know that the person arriving at a client site is properly identified, screened, qualified and authorised.
The problem begins with what happens next.
A passport arrives by email, recruitment downloads it, HR uploads it and compliance receives another copy.
A mobilisation manager saves it locally, a client requests a personnel pack, the employee changes contract and the process begins again.
No individual intends to create a vulnerability as each action appears reasonable in isolation.
Collectively, they produce a sprawling estate of sensitive documents across inboxes, devices, shared drives, portals and third parties.
Some are current, others obsolete and many outlive their original purpose.
The information can reveal much more than conventional HR data including information like personnel, nationalities, roles, qualifications, clearances, client associations and, potentially, deployment locations.
In the wrong hands, it can support identity fraud, social engineering, coercion or targeted intelligence gathering.
At what point did establishing trust come to require permanent possession of sensitive personal data?
Does a client need a copy of a security officer’s passport or do they seek the confidence that the officer’s identity has been verified?
The limits of monitor, block and patch
Much of cybersecurity is built around three essential activities:
- Monitor the environment
- Block malicious behaviour
- Patch weaknesses
Organisations must protect the information they hold.
However, this model normally begins after the data estate has been created as it treats information proliferation as an established condition rather than a design choice.
Not a single security director would add unnecessary doors to a sensitive facility and argue that better cameras make them harmless, but digital workflows are able to create new stores, access points and copies every day.
More recently, I have worked closely with technologists examining how personal information might be controlled differently.
That work led me to an uncomfortable conclusion.
We are frequently trying to secure a pattern of behaviour that should not always exist.
Email, cloud storage and collaboration platforms are exceptionally good at moving information.
Communication and control are different problems.
Communication moves information and control determines where it should reside, who may access it, for what purpose and for how long.
We have inherited an architecture designed for the first problem and asked it to solve the second.
What if access were enough?
The alternative is not a world in which organisations hold no personal information.
Some information must be retained for legal, regulatory, contractual or operational reasons, and the organisation remains responsible for protecting it.
However, possession should not be the automatic price of access.
Imagine a different starting point where the individual or another appropriate custodian retains an anchored source document and the organisation receives accountable access to the information it needs for an identified purpose and period.
A recruiter can inspect identity documentation, a compliance officer can confirm a licence and a client can verify a qualification.
The information can be viewed without another uncontrolled copy beginning a separate life as the authority is clear, activity is recorded and access can expire or be withdrawn when the purpose ends.
Where retention is genuinely required, a controlled copy can still be taken and governed allowing possession to become an explicit decision, not an automatic consequence of interaction.
This is not another portal from which everybody downloads the same documents, it requires an architecture in which viewing is not synonymous with transferring and access does not quietly become a transfer of ownership.
In September’s ISJ (p18), IDEMIA’s Virginie Flam described biometric authentication in which the organisation receives confirmation without receiving the individual’s biometric data.
The same distinction matters here.
Do we need to collect the document or establish the fact it proves?
Trust is not weakened by this question, it actually becomes more precise.
In regulatory language, this is data minimisation made operational. In security language, it is attack surface reduction.
Every unnecessary copy not created is one less asset to discover, classify, update, protect and eventually delete.
More importantly, it is one less asset that can be stolen from that organisation.
Making secure behaviour easier
Policies alone will not solve the problem.
Instructions not to download documents, forward attachments or retain local copies are sensible, but compete with operational reality.
Recruiters work to deadlines, mobilisation teams must deploy personnel quickly and clients want immediate assurance.
When the approved process is slower than copying and sending, people find a workaround.
Good architecture should make secure behaviour the easiest option.
The cure is not another reminder to copy less, it is to remove the need to copy wherever access achieves the same purpose.
Fewer copies mean cleaner offboarding, less stale information and a smaller potential disclosure when a system is compromised.
Security resources can be concentrated on information the organisation genuinely must possess.
This does not eliminate cyber-risk, but it does reduce the opportunities available to an attacker and the consequences of a successful intrusion.
It moves security away from the perpetual treatment of avoidable exposure and towards designing some of that exposure out.
Why the security sector should lead
The physical security industry already understands these principles.
We are able to restrict access according to role, divide facilities into zones, issue temporary passes, record entry, exit and withdraw credentials when authority ends.
We do not give every visitor a master key merely because they need to enter one room.
Why should personal information be treated differently?
Security personnel occupy trusted positions in sensitive environments and the information surrounding their employment and deployment deserves the same discipline as the sites they protect.
Physical security providers are well placed to lead this change.
The sector understands that effective security is about controlling access according to identity, authority, purpose and time.
Applied to workforce information, those principles offer a different model of digital trust.
The questions after the breach
After the next major data breach, organisations will ask how the attackers entered, what they took and how the vulnerability can be patched.
They should also ask:
- Why were we holding this information?
- Who genuinely needed to possess it?
- Could controlled access have served the same purpose?
- Should that access have ended months or years ago?
The most successful security intervention may be one nobody notices as there is no alarm, investigation or heroic response because the asset was never unnecessarily placed within reach.
The next evolution in information security should not be limited to building stronger walls around ever-growing collections of personal data.
It should also mean smaller collections, fewer copies and more purposeful access.
Protect what must be held and remove what doesn’t need to be.
The copy you never needed to keep may be the most effective security control you never see.
Toby Jackman MBE is the Chief Operating Officer at Fyio Technologies. A former British Army officer and security executive, he works at the intersection of operational security, technology and personal data control.