1 / 9

Data Protection Policy (DPP)

Data Protection Policy (DPP). Kirsten Baxter, Karen Ernst (LS) Charlotte Maria Viala, Anne Schepens (HR) Tim Smith (IT/CIS) Derek Mathieson (GS/AIS) Computer Security Team ENTICE 2012/6/8. Do we lack a DPP?. ~/. ssh /FILE like ~/. ssh / id_dsa ~/. ssh /identity ~/. ssh / id_rsa

zlhna
Download Presentation

Data Protection Policy (DPP)

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Data Protection Policy (DPP) Kirsten Baxter, Karen Ernst (LS)Charlotte Maria Viala, Anne Schepens (HR)Tim Smith (IT/CIS)Derek Mathieson (GS/AIS)Computer Security Team ENTICE 2012/6/8

  2. Do we lack a DPP? • ~/.ssh/FILE like ~/.ssh/id_dsa • ~/.ssh/identity • ~/.ssh/id_rsa • ~/.globus/FILE • ~/.gnupg/FILE • ~/.mozilla/FILE • ~/.cvspass • ~/.gitconfig • ~/.*htpass* ~/*htpass* • ~/.netrc • ~/.pine.pwd • ~/.gnome2/keyrings • ~/.kde/share/apps/kwallet/ • ~/.subversion/auth/simple/ • ~/private

  3. Do we lack a DPP?

  4. Data Protection Policy (DPP) Data Classification Policy (DCP) The general classification scheme for all data that are stored and/or processed in electronic form. Data Storage Policy (DSP) The rules under which data must be stored. Data Access Policy(DAS) The rules under which data can be accessed. Data Transfer Policy(DTP) The rules under which data can be (digitally) transferred between data stores. Data Destruction Policy(DDP) The rules under which digital media must be wiped or destroyed such that any trace of data has disappeared from that media. See https://cern.ch/security/rules/en/dpp.shtml

  5. Data Classification Policy (DCP) Kirsten Baxter, Karen Ernst (LS)Charlotte Maria Viala, Anne Schepens (HR)Tim Smith (IT/CIS)Derek Mathieson (GS/AIS)Computer Security Team ENTICE 2012/6/8

  6. Policy • "Sensitive Data": Data is highly confidential; disclosure would compromise personal data privacy or/and could cause damage to CERN or CERN's reputation or impede the work of CERN; data must be encrypted or equally secured for storage and in transit; data must be protected by login; authorization is typically limited to named individuals, who have unrestricted access for operational purposes, and to specific groups, who have restricted access subject to case-by-case control procedures. • "Restricted Data": Data is confidential; circulation of data is required for operational purposes but wide-spread disclosure is unacceptable; data must be protected by login; authorization is limited to named individuals or specific groups, who have access for operational purposes. • "Internal Data": Data is not confidential as such, but is intended for an internal audience only; external disclosure is undesired; data must be protected by login; audience is "CERN", i.e. all Members of the Personnel. • "Public Data": Data intended for disclosure; audience is unlimited. • (We avoid using “confidential” as it is inconsistently used at CERN) • An extensive of examples intended as guidelines for each category can be found under https://cern.ch/security/rules/en/dcp.shtml

  7. Data Destruction Policy (DDP) Kirsten Baxter, Karen Ernst (LS)Charlotte Maria Viala, Anne Schepens (HR)Tim Smith (IT/CIS)Derek Mathieson (GS/AIS)Computer Security Team ENTICE 2012/6/8

  8. Policy • Digital media must be wiped when changing function or being retired from operations. • Digital media storing "Sensitive Data" must be wiped, in whole or in relevant part, once the data is no longer needed or has become obsolete. • Broken or defective digital media must be wiped unless repair is possible and under the condition that the acting company has an industry standard data protection policy in place. "Repair" also includes replacement of digital media under warranty provided that the acting company has an industry standard data destruction policy in place. • If wiping is not possible (and repair failed), the digital media must be physically destroyed independent of the classification level of the data stored. • Tapes are exempt from wiping due to technical and logistical reasons. However, they must be destroyed if they hold or have held "Sensitive Data".

  9. Procedure • Procedure for wiping: Most digital media can be wiped running the Linux command "shred -fvuzn1 /dev/hdXXX" ("shred -fvuzn1 FILENAME") or using FileShredder for Windows. In RAID-configurations, each medium must be wiped separately. For journaling file systems the partition must not be mounted in data=journal mode (see /etc/fstab). • Procedure for destruction: Digital media for destruction shall be brought to the operator's desk in the CERN Computer Centre (building 513), where they will be gathered in sealed containers and regularly collected by a third party company specialized in their physical destruction. Containers from Barec andcorresponding procedures arein place  See https://cern.ch/security/rules/en/ddp.shtml

More Related