Security of Data

Key Ideas from syllabus Security of data Understand the importance of and the mechanisms for maintaining data security Understand the importance of and the mechanisms for maintaining data security Understand simple processes that protect the integrity of data against malicious or accidental alteration; standard clerical procedures, passwords, levels of permitted access, write protect mechanisms, backup procedures, restoration and recovery procedures. Understand simple processes that protect the integrity of data against malicious or accidental alteration; standard clerical procedures, passwords, levels of permitted access, write protect mechanisms, backup procedures, restoration and recovery procedures. Backup systems Understand the need for regular and systematic backup and recovery procedures Understand the need for regular and systematic backup and recovery procedures

Part One Security of Data The two threats to data security Privacy of data Integrity of data - the correctness of data. Threats from whom? Employers - personal records Shops - account history etc. Banks - salary details Insurance companies - health record How can data be corrupted? Errors in input - human error Errors in operating procedures, e.g.run an update program twice in error. Program errors.

So simple measures are needed to protect data from theft and destruction (integrity)

Protecting data integrity Standard clerical procedures Input Data entry limited to authorised personnel Data entry limited to authorised personnel Large volumes of data keyed twice to guard against keying errors. Large volumes of data keyed twice to guard against keying errors. Total entries checked to verify completeness and guard against illegal entry. Total entries checked to verify completeness and guard against illegal entry.Output All output checked for inconsistencies. All output checked for inconsistencies. Shred sensitive information after use. Shred sensitive information after use.

Protecting data integrity Write-protecting disks

Protecting data integrity User Ids and passwords A sure fire way of protecting data is to issue passwords in order that staff in an organisation can gain access to data. Passwords are set according to these common rules: Passwords must be at least six characters Passwords must be at least six characters Passwords suppressed (starred out) on-screen Passwords suppressed (starred out) on-screen Files containing passwords must be encrypted Files containing passwords must be encrypted Users must keep them confidential, not write them down, keep them guess free and change them every 3 months. Users must keep them confidential, not write them down, keep them guess free and change them every 3 months.

Protecting data integrity Access Rights Three types of access rights to files/data Read only Read only Read/Write Read/Write No access No access Administrators can set up an “access directory” that can specify access rights, workstations, times etc. Administrators can set up an “access directory” that can specify access rights, workstations, times etc.

Protecting data integrity How do you protect against fraud or malicious damage to data? Careful vetting procedures for employees Careful vetting procedures for employees If someone is sacked, immediately revoke all access If someone is sacked, immediately revoke all access Separation of duties - prevent people having fingers in many pies Separation of duties - prevent people having fingers in many pies Physical prevention - lock people out, ID badges etc. Physical prevention - lock people out, ID badges etc. Passwords Passwords Staff education - vigilance against unauthorised users Staff education - vigilance against unauthorised users Security manager to check up on access to network, can monitor all workstations, log ins, access to files etc. Security manager to check up on access to network, can monitor all workstations, log ins, access to files etc.

Protecting data integrity Protection against viruses Anti virus software Anti virus software Don’t allow floppy disks Don’t allow floppy disks Software purchased is sealed - I.e. clear evidence it has not been tampered with. Software purchased is sealed - I.e. clear evidence it has not been tampered with.

Protecting data integrity Biometric Security Measures Fingerprint recognition Fingerprint recognition Iris recognition Iris recognition Voice recognition Voice recognition

Protecting data integrity Communications security Remote databases can be hacked into via the telecommunication network. One way illegal access is prevented is by using a “call back” mechanism so that when a remote user logs on the computer automatically calls them back at a prearranged telephone number. Remote databases can be hacked into via the telecommunication network. One way illegal access is prevented is by using a “call back” mechanism so that when a remote user logs on the computer automatically calls them back at a prearranged telephone number.

Part 2 - Data security: Planning for disasters!!!!!!!!! What are the threats to Information Systems? Terrorism Terrorism Fire Fire Flood Flood Theft Theft Sabotage Sabotage

Backup strategies Full backupPeriodic backup Incremental backup

Spot the backup strategy All updates to a file since the last backup will be lost. All updates to a file since the last backup will be lost. Time consuming, especially if large files being backed up. Time consuming, especially if large files being backed up. Copy all files at regular intervals. Copy all files at regular intervals.

Spot the backup strategy Backup all software and files. Backup all software and files. All contents of computers hard disk (software and files) is copied each day. All contents of computers hard disk (software and files) is copied each day.

Spot the backup strategy Backup only those files which have changed since the last backup. Backup only those files which have changed since the last backup.

Backup Hardware For small quantities of data removable disks are simplest. For small quantities of data removable disks are simplest. Larger backups use magnetic tape. Larger backups use magnetic tape. Rewriteable CD Rewriteable CD RAID (Redundant Array of Inexpensive) - mainly used for backing up on-line databases. RAID (Redundant Array of Inexpensive) - mainly used for backing up on-line databases. Backing up on-line databases: RAID - data written simultaneously on separate disks (normally three). If one fails other two will have data RAID - data written simultaneously on separate disks (normally three). If one fails other two will have data Transaction logging - each record has a before and after image saved so if a record is destroyed the omission can be traced. Transaction logging - each record has a before and after image saved so if a record is destroyed the omission can be traced.