1 / 21

Personal Data Protection and Security Measures

Personal Data Protection and Security Measures. Justin Law IT Services - Information Security Team 25 & 27 November 2013. Agenda. Data protection. Data is one of the most valuable assets of the University

jalia
Download Presentation

Personal Data Protection and Security Measures

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Personal Data Protection and Security Measures Justin Law IT Services - Information Security Team 25 & 27 November 2013

  2. Agenda

  3. Data protection • Data is one of the most valuable assets of the University • Data could be any factual information that is stored on computer, USB drive, Cloud and of course, on paper. • Risks of Data: • Theft • Loss • Leakage • Tamper

  4. Data Classification

  5. The importance of data classification • Allow us to identify the data • Manage the data better • Employ appropriate level of security for the data

  6. Three-level Data Classification In order to handle data properly, data should be classified into categories- classification level. Three-level Classification:

  7. Three-level Classification • Public • Data is generally open to the public. • No existing local, national or international legal restrictions on access. • Example: Events and Activities, communications notices and publications.

  8. Three-level Classification • Sensitive • Data is “Official Use Only” • Protected from unauthorized access due to proprietary, ethical or privacy considerations • Example: Student Data; University partner or sponsor information where no NDA exists

  9. Three-level Classification • Restricted • Data is protected by regulations, University policies or contractual agreement • Unauthorized access may result in significant financial risk or negative impacts on the reputation of the University • Example: Personal Information, Payment Records, Medical records

  10. Data Handling • Level of precautions and security controls are relevant to the data classification • More protections for more sensitive data

  11. Data Handling

  12. IT Security Good practices

  13. Workstation • Use complex password, more than 8 characters • Enable login password and screen saver password • Logout when unattended • Do not install P2P software on computer that handles confidential data • Physically secure the notebook PC, tablet PC • Avoid using public computer to access confidential files • Using VPN or other secure channel for remotely access from the outside of the university

  14. Storage • Data could be stored on personal PC, file server, mobile phone, NAS, Cloud, etc… • Access control • Need ID and password • Read, write, deny access • Logging • Use encryption • Backup

  15. Removable Storage • Only store sensitive data on portable devices or media when absolutely necessary • Use Encryption • Erase the data after use • Don’t leave USB drive unattended • Keep it safe • Don’t use USB drive from unknown source. • Report to supervisor if lost USB drive that contains sensitive data

  16. Cloud storage • Before putting data to Cloud, you should consider: • Privacy and confidentiality • Data retention • Impossible to eliminate • Data ownership • Data Encryption • being uploaded to, or downloaded from, and stored in the cloud • Exposure of data • to operator, local and foreign government and government agency

  17. Social Networks • Social networks are a great way to stay connected with others, but you should be wary about how much personal information you post. • Privacy and security settings • Once posted, always posted • Keep personal info personal • Know and manage your friends

  18. Mobile Security • “New Technology, old Privacy and Security issue” • Lost or stolen devices • Enable screen lock • Encrypt the data, such as email and documents • Alert the automatically login of company email and file server • Malware and virus • Steal bank details, Company Data, • Personal identities, Email addresses • Install mobile security apps • Use Remote Wipe, Encryption and Anti-Virus

  19. Phishing email Sample of phishing email Hyperlink Http://evil.com/cheatu/login.htm

  20. Phishing Phishing is the act of attempting to acquire information such as usernames and password by pretending from a trusted entity, e.g. ITS or other department of the university • Signs of a phishing email: • Not addressed to you by name • Asks for your username and password • “Business letters” but comes from suspicious email accounts • What to do if you received phishing email • Delete these suspicious emails • Don’t reply or click any link on them. • Refer to HKU Spam report web site http://www.its.hku.hk/spam-report

  21. Thank You

More Related