Spreadsheets in the enterprise, considering confidentiality (pt 1/5) 0
Posted on 10, March 2014
in Category practitioner experience
by Stuart Gomersall, owner of our Distributed Development service.
This post is part of a series considering the security implications of using Excel / spreadsheets for decision making. At a macro level, it is about applying a framework (CIADA) as a lens reflecting on how standalone, general tools have considerable security constraints.
The initial observations that led to this post can be found here.
For the sake of this post, I’ll define confidentiality as “concerns regarding the unwanted disclosure of information.”
Confidentiality is complex as it is both role-driven and time-driven, i.e. sensitive data may only be applicable to me in my current role and for a specific timeframe after which it may become stale and elicit invalid results.
Without deploying additional layers (e.g. using the file system layer to assign access via login to specific roles) neither angle is covered by Excel (or any Office-style application). Access is blanket applied - you are in or out of the loop. Hidden sheets help, but security by obscurity is never a great design choice and is not sustainable. And let’s not get started on the concept of using a tool designed for collaboration with others as a store of sensitive and/or confidential information - it is certainly paradoxical!
All of the above really depends on the inherent “value” of the data (or asset) you are trying to secure, if it is public information then, by all means, use Excel. For example, the Guardian makes chart data available via Excel for further analysis. Sensitive financial or people data is another matter. It is crucial to apply a set of reasonable countermeasures to data and systems based on the valuation of the asset from each perspective of the CIADA model.
Assessing the alternatives available to maintain data confidentiality may be simple. If the alternatives are very obscure, very expensive or a change management bridge too far then go back to your valuation of the asset. You may be inflating the valuation based on an incorrect view from the relevant stakeholders. Or maybe rudimentary controls are appropriate as countermeasures.
My rallying cry is simple. Excel is fine, in context. Be sure to complete the valuation of the information asset as well assessment and deployment of appropriate countermeasures over the blind use of a collaboration tool.
Stuart is a Principal Consultant at BSG (UK). Stuart has led several large systems development projects using a variety of delivery methodologies (agile, waterfall, iterative) on time, on budget and to specification. He is the lead on our Distributed Development service.