EBC Business Continuity Planning Seminar
A violent earthquake, a security system breakdown, the death of a CEO. These are events that every company fears, and when they suddenly occur, industry giants can be brought to their knees. That’s why Business Continuity Planning (BCP) is essential. So to mark the establishment of a new Business Planning Committee, the EBC held a seminar, at the EU-Japan Centre for Industrial Cooperation, on BCP and safeguarding critical information during emergencies.
“One of the problems that follows loss of information is damage to the reputation of an organisation. It is a loss of competitiveness,” said head of security and fraud risk for HSBC Japan, Jeff Seay. Before his current role at HSBC, Seay worked for 20 years in cyber-operations and counter-intelligence with the United States Naval Criminal Investigative Services, and then with Deutsche Bank and Deutsche Securities. Today he is responsible for HSBC Japan’s administrative, technical and physical security controls.
One HSBC security control to counter data theft is a simple clear desk policy. “There are more potential information leak problems with what’s sitting on someone’s desk than almost anywhere else,” said Seay. Employees are required to remove all items with client and partner information, including business cards, before they go home. The policy has met some resistance, however. “That two metres square becomes the person’s own, they don’t want to be told how to deal with it,” said Seay.
But security threats can come from unexpected directions. Recently, an employee of a well-known bank in Switzerland walked out and slipped French tax authorities information on 24,000 accounts. And it is not only a company’s employees who pose a risk. “If someone really wanted to exploit your location, where’s the best place to go?” asked Seay. “They could probably just find out who you hire for your building maintenance, and ask them to go in,” he warns. After all, cleaners are the most invisible people in the building.
HSBC uses trusted vendors to dispose of confidential information, transporting it in armoured vehicles when required. But even they don’t deal with the most confidential information, which is instead shredded internally. Unfortunately, this is where BCP can come into conflict with environmental policy. “A good shred cannot be recycled,” said Seay.
Seay also noted that, “Good security is inconvenient by its very nature.” Nevertheless, employees must be able to work. The information employees access, and how they use it, is closely monitored both by computer and staff. But HSBC tends to adopt a “reactive” rather than “proactive” approach to suspicious transactions. “The fact is that people need to be able to use information to conduct business,” he says.
Protected business districts
In 1923, the Great Kanto Earthquake ripped through Tokyo, killing over 100,000 people, and wiping out residential and commercial infrastructure. The damage was widespread and complete. The very real threat of another quake, therefore, is a concern for every business in Japan.
Dr. Yukihiro Masuda, an assistant professor at Waseda Institute for Advanced Studies, said that Japan needs “a highly protected and independently secured business district to provide protection when the worst happens. Japan must assure the world of measures taken to deal with this threat,” he said.
According to Masuda, the protected business district should be 100 hectares in size, covering large swaths of Chiyoda, Shinjuku and Shibuya wards. The district would have a stable supply of energy and water, telecommunications equipment, a data centre and accommodation.
Masuda’s group has also developed technology to install in Tokyo buildings, such as a “cockpit” control room. “Whether there is an earthquake or a strong wind, the cockpit can immediately tell you what’s going on,” said Matsuda. Several buildings have already been tested, though with the immense number of buildings in Tokyo, it could be a difficult system to implement.
Yet – in one of the world’s most densely populated, typhoon-battered, earthquake-prone cities – surely no amount of preparation is too much.