Data Security: What's It all About?
A statement of the obvious: data security is critical. Your customers depend on their computers and the data they
process. The loss of critical computing resources can mean disruption of sales, lost customers and, in extreme
circumstances, business failure.
Your customers depend on your applications to protect their sensitive, sometimes personal, data. In our modern,
high-tech world, it is critical to your success that you make prudent decisions concerning the security of your
customers' critical information.
In this portal, you'll find the best information available to help decision makers like you begin the process of
constructing a secure, reliable IT infrastructure, and help you down the path to success.
The Risks to Data Security
There are many, diverse threats to data which a manager of the typical mid-size business must overcome. For his information systems, five key threats should be top of mind:
| 1. |
User error – A simple mistake on behalf of an employee could lead to the loss of megabytes of
critical company data. From the deletion of a critical file to the accidental deletion of database records,
your customers could face large expenses and significant down time recovering the disaster created by a simple
mistake. |
|---|
| 2. |
Employee theft – Employees need access to sensitive data in order to perform their jobs. Your
customers have to limit the information to which employees have access, ensure that terminated employees no
longer have access to sensitive data, and be able to track who's touching what, when and how.
|
|---|
| 3. |
Privacy violation – How do your customers protect the personal information with which their customers
entrust them? Security breaches can mean that personal data can fall into the hands of the wrong people. In
order to maintain your customers' trust, you must ensure that their data is safe and sound. In addition, many
governments are now legislating privacy, which can mean fines or imprisonment if sensitive customer data is not
secured. |
|---|
| 4. |
Disaster – What natural disasters or unfortunate accidents might affect business? Magazines daily
contain news of organizations that have faced unbelievable catastrophes. In the event that your or your
customers' organizations are hit with a fire, flood or other disaster, how will the data be protected?
|
|---|
| 5. |
External attack – While less common for small business than the Fortune 1000, preparedness against
external attacks is crucial. These attacks may take many different forms, from viruses to intrusion by hackers.
Proper security measures must be taken to prevent disruption from these adversaries.
|
|---|
These five key vulnerabilities can lead to critical data loss and may ultimately lead to business failure. Additional information can be found at the following links.
Learn about the Pervasive security solution.
Up
Horror Stories
What happens to the unprepared? Some businesses haven't taken the time to prepare themselves from the risks we've identified. Without preparation, you and your customers face a much higher probability that such an attack is fatal. Follow the links below to learn about some businesses that didn't make it:
Learn about the Pervasive security solution.
Up
Planning for Data Security Success
You know the risks. You know what happens to those who don't prepare for them. Now what?
You can take steps today to arm yourself and your customers against these and other risks. A vast amount of free information from sources like the US government's Small Business Administration can be used to help define the practices and procedures you can follow when something bad happens (and to keep it from happening in the first place).
Learn about the Pervasive security solution.
Up
Latest News and Updates
If you want to get some of the latest information on the threats you face, these websites will keep you up-to-date with the latest news from key areas of IT security.
Learn about the Pervasive security solution.
Up
Government Regulation
New government regulations around the world, covering various areas of consumer privacy and public disclosure, have created massive new demands on companies and individual professionals operating in certain key industries. These laws require greater scrutiny of data access and data storage methods. The following section provides a brief overview of the latest legislation and directives:
USA: Healthcare
Health Insurance Portability and Accountability Act (HIPAA)
Signed into law by President Clinton in 1996, HIPAA is intended to improve the efficiency and effectiveness of the US healthcare system by standardizing and supporting the electronic communication of patient data. A set of national implementation guides now provides specific standards, which include strict rules on privacy and control of patient data. Any organization operating within the healthcare industry must understand the ramifications of the HIPAA legislation. In order to begin your HIPAA education, refer to the following links:
USA: Customer Data
California SB 1386
Designed to protect residents from identity theft, California Senate Bill 1386 protects California residents from unintended disclosure of personal information by ensuring that residents are notified of a security breach that affects their personal data. Taken to its furthest extremes, SB1386 affects any organization doing business with California residents. For more information on this bill see the following links:
USA: Financial Institutions
Gramm-Leach-Bliley Act
An excerpt from the GLBA Act best describes the purpose of this legislation "It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' non-public personal information." (Title V)
USA: Accounting Practices
Sarbanes-Oxley
As a response to corporate scandals in large public companies in the US, the Sarbanes-Oxley act was signed into law in July 2002. This new law has far-reaching impacts on the disclosures and accounting practices of public companies in the United States. Based on timetables issued by the government, public companies must comply with Sarbanes-Oxley by a specified date.
Europe: Personal Data
EC Directive 95/46
The Data Protection Directive adopted in 1995, EC 95/46 protects personal data with specific rules on the processing and free movement of such data. Firms which collect online data must disclose the actual collection, the purpose of the collected data, and the identify the recipient. In addition the act prevents transmission of data to a country that does not have adequate protections.
Europe: Transmission of Personal Data
EC Directive 2002/58
The Directive on Privacy and Electronic Communications is designed to complement EC 95/46. This act covers all communication, including electronic communication. Specifically, article three of this legislation requires measures to protect personal data while in transmission and storage.
Europe: Privacy in the EU
EC Directive 45/2001
Similar to EC 95/46 and 2002/58, this legislation extends privacy laws to the Community itself.
Europe: The Foundation of Personal Data Security Law
OECD Principles
Enacted in 1980, the OECD Principles state that, "Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data."
Japan: Healthcare
HPB 517
Japan's HPB 517, similar to the US's HIPAA act, is a healthcare specific law that protects the accuracy and authenticity of data storage, transmission and protects the patient privacy and access control.
Learn about the Pervasive security solution.
Up
Industry Standards
ISO 17799
ISO 17799 is a standard established to provide best practices in the areas of business continuity, planning, and security. ISO 17799 can be used by an organization to develop and evaluate its disaster planning activities.
Visa CISP
"Customers who offer their card numbers to merchants through the mail, over the phone, or online want assurance that their account information is being guarded. For customers, it all comes down to selecting and doing business with a reliable, reputable entity. For merchants, it is a matter of protecting cardholder information and assuring cardholders that their personal information is safe." Excerpt, CISP Overview
Learn about the Pervasive security solution.
|
