Protecting Data and Information BTEC learning Aim E Protecting Data and Information

Pre topic task Make a list of threats to a computer. Make a list of how to protect against these threats. Write a short paragraph on why you think businesses see protecting data as important.

Keywords Malware – software created to steal data by gaining access to an IT system without users consent Router – an electronic device that enables data transmission between devices

Characteristics of threats to data You need to understand the importance of keeping data secure. Think about how you put your data at risk and how businesses can put their data at risk. Obvious and disclosing passwords or using the same login for multiple devices Leaving devices open to others (not locking computer when leaving workstation) Posting information globally Using personal devices for business operations

Activity Research these threats listed below and find out: What they are. What they affect How could they be used How can they be protected Viruses and malware Hackers Phishing Accidental damage Extension – What is auto save and how can it be a beneficial feature.

How can this have an impact on individuals and organisations Consider what data an individual has and how it can be stolen, manipulated or deleted. What impact would this have? Organisations If data is leaked or used against an organisation consider the implications on their reputations and the relatability of the business.

Protecting data We now know that business will spend a lot of money on protecting data. Think in more detail in how and why they do this. File permissions Access levels Backup and recovery procedures Passwords Physical access control Digital certificates protocols

Activity What are the features, characteristics and implications to anti-virus software?

Antivirus software Antivirus software is designed to search out and stop attempts to corrupt the system. Depending on the software your antivirus system will either: Scan in real time any files that are saved or opened Perform deep and full scans and check entire storage devices (periodically) Heuristic analysis (look for ‘virus like’ activity) Research the virus databases The more your system is exposed the greater the risk to your system Constant scanning and checking for viruses can affect the CPU and the system and slow down the PC

Research In your group pick 2 antivirus software packages each and compare: Price Features Versatility Implications Impact on other software 1 2 3 4 5 6 Price Features Versatility Implications Impact on other software Score ( / 10)

Firewalls What is a firewall? Controls and manages the incoming and outgoing network traffic based on the security rules. Software applications (stored locally (not on the network)) Hardware based (part of the router) Firewalls use a variety of methods to protect data including: Basic port blocking Advanced stateful packet inspection (SPI) Research these methods and write them in your book.

Encryption Research what encryption is and list some methods for encrypting data. What are the implications? If the code key if forgotten (data cannot be decrypted) How is the key shared (risks to security) Data is vulnerable when it is being transmitted, consider paying for items across the internet, sending emails, sending personal data. Encryption is essential to ensure that during the transmission process data is secure. Web pages use https to encrypt, emails use PGP to be encrypted. However when performing a bank transactions data is encrypted and decrypted so that the bank information is protected. If the holder of the information takes a break during the transaction the data is accessible to others during this time. So it is advisable to avoid disruptions and using public devices for such transactions.

What does legislation aim to stop? Hackers Fraud and theft Copyright infringement Abuse Cyberbullying Trolling Indecent images harassment

Legislation Research: Legislation What does it protect? What are the consequences for breaching? Data protection Act 1998 Computer Misuse Act 1990 Freedom of Information Act 2000

Legislation Research some case studies where these acts have been broken in real life and explain what happened. What is the impact on individuals and organisations? Data Protection Act – data is not shared without the permission of the individual it relates too. There are eight principles to the data protection act. Everyone is entitled to read their own medical record and the records held about you by the place of study (e.g. school). However there are certain exceptions to this. Staff or individuals in charge of entering data must be aware of any consequences arising from storing the data. The freedom of information act has affected public bodies as if the public request to see the data they must release it, the idea of this act was to ensure greater transparency to government bodies but over the years it has revealed surprising data which has led to legislative change. E.g. the MPs expenses issues.

Protection of data It is vital for individuals and organisations that data is protected via different methods, some of these are: File permissions – password protection on certain files and folders Access levels – certain users are allowed to access certain systems or apps Backup and recovery procedures – data must be backed up regularly in case of a disaster, most systems often have automatic backup procedures. Passwords – computers and logins should be kept secret and shouldn’t be easy to guess. Physical access control – leaving the computer or device unattended and unlocked exposes you and your data Digital certificates - these are unique codes which helps to identify a transaction, such as a bank statement. Protocols – this is the agreement between devices, secure data relies on some form of encryption, protocols allow the devices to communicate and transfer data. TASK – using these areas above draw a flowchart on how an organisation can protect data.

Codes of practice for the protection of data Information commissioners office (UK) and professional bodies in intended to ‘uphold information rights in the public interest by promoting openness by public bodies and data privacy for individuals’. The ICO provide guidance and interpretation of legislation. Small business may use leaflets to explain data protection but larger organisations may have an employee who is named as the data controller and deals with the process of personal information (HR). The Crown Prosecution service will become involved when breaches to data occur. Professional bodies will have codes of practice which must be followed to ensure legislation is not broken,

Exam style question