Enable Trusted Sharing
The following sections describe the stages required to develop, provide and operate the WARP Trusted Sharing service. An introduction to the service is also provided together with a description of the infrastructure required.
1. Introduction
The Trusted Sharing service creates a trusted environment to facilitate the sharing of sensitive information, such as incident or threat data. WARP members must have confidence that any information they share will not cause them harm or embarrassment, otherwise they may not be inclined to share information at all. Sharing sensitive information allows members to be made aware of information that would enable them to take timely preventative action, benefiting from other members experience. Just one timely early warning of a major incident would more than justify any costs of WARP membership.
This service delivers the 'Reporting' part of the Warning, Advice and Reporting Point.
The following report conducted by IAAC and commissioned by NISCC at the time, provides background on how WARPs compare and relate to Trusted Sharing initiatives around the world.
Sharing is Protecting - IAAC in partnership with NISCC
A research programme looking at why people share and how trust can be augmented to increase the tendency to share was carried out recently. For more information go to tools for building trust
2. Service Development
Trusted sharing relies heavily on procedures, which have to be developed to ensure that sensitive information is anonymised, and only distributed in the correct form. It is important to ensure data is collected in a consistent manner to allow for the creation of statistics, the searching of historic data, and to facilitate distribution via the Filtered Warnings Service. The following form gives a good example of the kind of data that should be collected by a Trusted Sharing Service where WARP member reports are entered on this form by the WARP operator:
Incident reporting form for a WARP Trusted Sharing Service (pdf)
Incident reporting form for a WARP Trusted Sharing Service (MS Word)
3. Service operation
Reporting can be achieved via the telephone, email or face to face dialogue, with appropriate security safeguards as outlined in each WARP's security policy. In all cases an incident reporting form should be provided to help members contribute the required information.
Where anonymity is required, the identity of the reporting member will only be known to the named individuals working for the WARP provider and controlled within the terms of a membership agreement or an information sharing agreement which might be bi-lateral with each member.
The information reported will be analysed, checked to ensure anonymity, and then shared with other WARP members using either the Filtered Warnings Service, or another dissemination route. The WARP operator will facilitate any ensuing dialogue to ensure that the information is used by members to maximum advantage while safeguarding the interests of the reporting member under the terms of the agreements
When duly sanitised and anonymised, such incident information may also be passed to other WARPs with whom a trusted relationship exists, and to CPNI, for collating and monitoring national trends.
A case study on how the Mid Yorkshire Chamber ( MYCCI) WARP operator was able to help warn WARP members of a specific Telecommunications related fraud as part of the MYSWARP Trusted Sharing service. Using the peer to peer sharing capabilities of FWA, this was also shared with other WARPs.
Case study - Mid Yorkshire Chamber Trusted Sharing
4. Software – Trusted sharing
Trusted Sharing features, based on the Microsoft Sharepoint software platform is available from the WARP Multi-Service Platform (WARP MSP) application which is described within the WARP software page. These include on-line reporting within a single sign-on environment with the other WARP services.
Next step: Ensure you are aware of all the resources available to you.