'Let's stop talking about the big, bad central computer'

Thursday, March 04, 2010

Joseph Waller, managing director of XML Solutions, dispels some of the myths around the security of centralised IT systems compared to preferred localised options

In the run up to the election the enthusiastic use of the term 'centralised computer system' by politicians is aggravating a major oversimplification in the planning of government IT. Though such simplifications are often necessary in the media, I believe that this particular simplification is in danger of causing the British taxpayer the loss of hundreds of millions of pounds by fallaciously encouraging politicians to go in search of 'non-centralised systems' as a cure-all that doesn't exist.

Most of the problems viewed as challenges of centralised systems, are in fact simply the challenges of any integration scenario. There are a number of issues that people commonly raise when they think of so called 'centralised systems'.

"What if the system breaks down? What's the contingency?"
In IT, the use of resilience and availability techniques mean that there is never a single server, a single network card or a single database storage location upon which a system is reliant. Despite this, there is some common sense in having two completely different systems supplying the same data that no deployment pattern can improve upon. However, if you get the system twice you pay for it twice. All this said, resilience is rarely the concern driving current comments on centralised systems. So let's move onto to the more pressing concerns.

"What if someone breaks into the system, surely they'll then be able to access any data they like?"
Modern IT systems have many barriers to taking full control of a system. However, more crucially for this debate, a distributed or local system is not less susceptible to this flaw. If a set of systems have been genuinely made interoperable then their interfaces, their security measures and even their security policies are the same. Once you have overcome any security measures an intruder will be able to access all of the distributed systems as if they were one system. Put another way, a distributed but integrated set of systems are logically equivalent, in security and accessibility terms, to a centralised one.

It is more important that national services are constructed around a holistic, effective access control framework which ensures that the public have control over who accesses their records. An emphasis on a centralised system as the cause of such failures is a huge distraction from the real challenge. It is not where the data is that should determine who has access, but what the data is or rather whether it is sensitive.

"Won't everybody's processes have to conform to what one system dictates?"
If poorly designed, the use of a single IT system sometimes restricts business process flexibility. However, in modern IT large shared solutions are often only providing technical "services" designed to perform a particular function, which other systems incorporate as they wish. Furthermore, what most restricts the flexibility of processes is the necessarily shared data model and finite set of services and messages. In a distributed yet integrated system the same shared data model and shared services would be required. The real challenge for many large programmes has been creating these services and data models in a manner that can grow and change as the business changes.

"Should we place all of the power and control over a large system in the hands of one organisation? What if that organisation is not trust worthy, or is simply incompetent?"
There are those currently suggesting that large scale IT solutions can create commercial relationships which are difficult to get right and often prove to be highly inefficient. It is beyond the scope of this article to comment on this commercial question. However, from a technician's perspective the other concerns over centralised systems are a distraction from this genuine debate.

The real question for the public should be do we want integrated systems with all the associated efficiencies and conveniences? If so, we need the stomach to tackle the privacy issues and questions over the public's control of their own data. Let's stop talking about the big, bad central computer.