OPERATIONAL SECURITY OF UBIQUITOUS INFORMATION - Cyberwar-Netwar: Security in the Information Age - page 96

Amaral : I recall my experience of some years in the insurance sector. Do you choose
to buy insurance or do you need to buy insurance? Let me tell you that the insurance
revenues not only in Portugal, but in countries such as Spain and Italy, come mostly from
the insurance that you require to buy. They do not come from insurance that people
choose to buy because they do not feel safe. They want to buy insurance and diminish
financial risk exposure. I am reminded of a play by Shakespeare, “The Merchant of
Venice”, with its promise of a pound of flesh. But we are talking about a Latin country
here, Italy. I cannot imagine Shakespeare would ever have written “The Merchant of
Hamburg”. So, it is cultural. Some things people feel obliged to do and others resent
being told what they must do. The way is to follow the development of European
culture. Staff of organisations have already been to schools and universities so it is
difficult to have this influence through normal education. There can of course be
postgraduate programmes. I perform this job in university and see that people are willing
to listen and to learn, but it takes time because, if you take this approach, you will lose
ten years or more. So I think that newspapers and television and everything that creates
the cultural mindset of people today, could perform a good job if they had influence. I
sometimes have discussions with people who work in the media and I do not particularly
like what is happening right now with the media in Portugal because there is much prime
time taken up with things that are not really interesting. But the argument is that if
culture does not evolve, neither does content. I believe it could be the other way round.
Our feelings of insecurity regarding the Internet come from the media. The Internet is
actually more secure than using your Visa card in a restaurant. But this feeling of
insecurity regarding the Internet persists. Why? Because of the media. And so if the
media created this insecurity, could it also create the opposite? I know that to influence
culture you have to get to people, to use what you have at hand such as education. If you
want to immediately be able to evolve this culture in the right way, there are certain
things that will have to be done, and I see no-one investing in that direction. That is the
problem. Green papers, white papers, books, do not discuss these matters which to me
are very important. I suppose it comes down to a political problem, but I am not a
politician, so who am I to criticise?
Valente : If I understand correctly, the idea is to apply risk management techniques
from financial markets to management of information? So you basically have to assign
some measure of value to different information sets and different information segments.
And we have three dimensions to do that; strategically operational, time critical and
content. And you say the third and perhaps the most important dimension is the
information intensity of the activities' content, and if I have an activity which has
valuable information, that activity should be secured to the detriment of another activity.
If I have an activity which is information intensive but the information per se is not
extremely valuable, how do we measure the value of the information there? Because if
we do have a knowledge-management system spread throughout the organisation, it
captures not only extremely valuable knowledge information content but also captures
pieces of information which are not as valuable. How do we measure information value?
Amaral : You always have to make a framework for information value. This value is
something that has been studied now for fifteen years. You have several frameworks.
The most well-adapted framework for this is competitive intelligence. I am perhaps not
the person who knows the most about competitive intelligence, but for me the question