Security of Data

1. Security of Data

2. Key Ideas from syllabus Security of data • Understand the importance of and the mechanisms for maintaining data security • Understand simple processes that protect the integrity of data against malicious or accidental alteration; standard clerical procedures, passwords, levels of permitted access, write protect mechanisms, backup procedures, restoration and recovery procedures. Backup systems • Understand the need for regular and systematic backup and recovery procedures

3. Part One Security of Data The two threats to data security Privacy of data Integrity of data - the correctness of data. Threats from whom? How can data be corrupted? • Employers - personal records • Shops - account history etc. • Banks - salary details • Insurance companies - health record • Errors in input - human error • Errors in operating procedures, e.g.run an update program twice in error. • Program errors.

4. So simple measures are needed to protect data from theft and destruction (integrity)

5. Protecting data integrity Standard clerical procedures Input • Data entry limited to authorised personnel • Large volumes of data keyed twice to guard against keying errors. • Total entries checked to verify completeness and guard against illegal entry. Output • All output checked for inconsistencies. • Shred sensitive information after use.

6. Protecting data integrity Write-protecting disks

7. Protecting data integrity User Ids and passwords A sure fire way of protecting data is to issue passwords in order that staff in an organisation can gain access to data. Passwords are set according to these common rules: • Passwords must be at least six characters • Passwords suppressed (starred out) on-screen • Files containing passwords must be encrypted • Users must keep them confidential, not write them down, keep them guess free and change them every 3 months.

8. Protecting data integrity Access Rights Three types of access rights to files/data • Read only • Read/Write • No access • Administrators can set up an “access directory” that can specify access rights, workstations, times etc.

9. Protecting data integrity How do you protect against fraud or malicious damage to data? • Careful vetting procedures for employees • If someone is sacked, immediately revoke all access • Separation of duties - prevent people having fingers in many pies • Physical prevention - lock people out, ID badges etc. • Passwords • Staff education - vigilance against unauthorised users • Security manager to check up on access to network, can monitor all workstations, log ins, access to files etc.

10. Protecting data integrity Protection against viruses • Anti virus software • Don’t allow floppy disks • Software purchased is sealed - I.e. clear evidence it has not been tampered with.

11. Protecting data integrity Biometric Security Measures • Fingerprint recognition • Iris recognition • Voice recognition

12. Protecting data integrity Communications security • Remote databases can be hacked into via the telecommunication network. One way illegal access is prevented is by using a “call back” mechanism so that when a remote user logs on the computer automatically calls them back at a prearranged telephone number.

13. Part 2 - Data security: Planning for disasters!!!!!!!!! What are the threats to Information Systems? • Terrorism • Fire • Flood • Theft • Sabotage

14. Backup strategies Incremental backup Full backup Periodic backup

15. Spot the backup strategy • All updates to a file since the last backup will be lost. • Time consuming, especially if large files being backed up. • Copy all files at regular intervals.

16. Spot the backup strategy • Backup all software and files. • All contents of computers hard disk (software and files) is copied each day.

17. Spot the backup strategy • Backup only those files which have changed since the last backup.

18. Backup Hardware • For small quantities of data removable disks are simplest. • Larger backups use magnetic tape. • Rewriteable CD • RAID (Redundant Array of Inexpensive) - mainly used for backing up on-line databases. Backing up on-line databases: • RAID - data written simultaneously on separate disks (normally three). If one fails other two will have data • Transaction logging - each record has a before and after image saved so if a record is destroyed the omission can be traced.