UNIT 3C Security of Information

SECURITY OF INFORMATION Firms use passwords to prevent unauthorised access to computer files. They should be made up letters and numbers. Change your password often Leave your password next to your workstation Use upper and lower case (i.e. CAPITALS and small letters) Tell it to anyone Keep your password confidential Use obvious names and numbers DODON’T

HOW SHOULD FLOPPY DISKS BE HANDLED AND STORED? DO DON’T Label all disksPlace near magnets Store with metal strip at the top Place heavy objects on top Keep in storage boxesLeave near radiators or heat Keep storage boxes safe outwith office hours

KEEPING ICT EQUIPMENT SECURE Make use of passwords Make use of ID cards and keys Make use of voiceprint and fingerprint Make use of restricted access to certain information to a select number of employees only

WHAT IS A COMPUTER VIRUS? A computer virus is a program that has been created to interfere with computer systems. The virus may result in the system failing, hard drives being wiped of information or a message – supposedly funny – being displayed on screen. Viruses can be spread around computers by floppy disks, CD ROMs or the Internet Organisations must install anti-virus software (e.g. Norton Antivirus) – this will scan the hard drive and floppy disks etc. looking for viruses and disinfecting any files where a problem is found.

DO’S WHEN LEAVING YOUR WORKSTATION Use a screen saver or password Store floppy disks and CD ROMS in lockable boxes Remove floppy disks or CD ROMs from the disk drives – always! Remove all originals and printouts from public view

Back Up Procedures Computer system faults – resulting in programs failing Fire, flood or computer damage Malicious damage to hardware or software Theft Power failure Computer data should be copied (backed-up) regularly as data held on a computer disk may be lost or corrupted due to: All organisations should have a back-up procedure e.g. always save a copy to the hard drive or network and a floppy disk or CD ROM. The 2 copies should be kept in separate places.

DATA PROTECTION ACTS (1984 & 1998)  Just about everybody has information about themselves stored on computer files e.g. within the school system information would be held about you would include: NAME, ADDRESS, DATE OF BIRTH, TELEPHONE NUMBER, EMERGENCY CONTACT NAME, PRIMARY SCHOOL. Information of this type is called ‘PERSONAL DATA’ but…….  There is a danger of this data falling into the hands of someone who has no right to see it.  When filling in certain forms there will be a small box at the bottom of the form – unless you tick this box, this means your information may be passed onto others.

DATA PROTECTION ACTS (1984 & 1998)  There is also a danger that the information held on a computer about you may be:  Inaccurate  Out of date  Misleading  To overcome this problem the potential problem, the Data Protection Acts 1984 & 1998 were passed  The aim of these Acts is to protect individuals who have information held about them on a computer.

DATA PROTECTION ACTS (1984 & 1998) There are 8 main principles of the Data Protection Acts

DATA PROTECTION ACTS (1984 & 1998) 1.Information must be collected and processed fairly and lawfully- People must be told what use will made of the information they supply about themselves. 2.Data should only be held for specified and lawful purposes - Organisations that hold personal data for use, must register with the Data Protection Registrar.

DATA PROTECTION ACTS (1984 & 1998) 3.Users must use and disclose data only for the registered purpose – All staff must know what the data can be used for – list uses clearly and succinctly (to the point). 4.Data must be adequate, relevant and not excessive for its purpose – when designing forms to enable the collection of data, ensure relevant questions only are asked.

DATA PROTECTION ACTS (1984 & 1998) 5.Data must be accurate and, where necessary, kept up-to-date – Ensure that there are procedures in place to check update or destroy inaccurate information. 6.Data must be held for no longer than is necessary – Procedures should be in place to ensure that data is destroyed as soon as it has been used for the purpose e.g. credit card details should be destroyed once orders are despatched if customers have paid for goods over the telephone.

DATA PROTECTION ACTS (1984 & 1998) 7.People must be allowed to access data about themselves without undue expense at reasonable intervals- Staff should know the procedures to follow if e.g. a customer seeks their credit rating information 8.Data users must take appropriate security measures to prevent unauthorised access, disclosure, alteration or destruction of data – including accidental loss or destruction

DATA PROTECTION ACTS (1984 & 1998) 8. (Continued) - data must not be transferred outside the European Union

DATA PROTECTION ACTS (1984 & 1998) If the principles are disobeyed : The Data Protection Registrar can serve 3 types of notice.

DATA PROTECTION ACTS (1984 & 1998) 1. Enforcement Notice – The data user is required to take specified action to comply with a particular principle. 2.De-registration Notice – This cancels part or the whole of the data users register entry. 3.Transfer Prohibition Notice – This prevents the data user form transferring personal data overseas.