An ounce of prevention is worth a pound of cure

By Martin Blackhurst, head of IT security at Redstone Managed Solutions

Posted Tuesday 2nd March, 2010

Martin Blackhurst, head of IT security at Redstone Managed Solutions.

Public sector managers are living in challenging times when it comes to preventing data loss for their organisations. Compliance with security regulations has become a real headache for managers within the NHS, local and central government and other public sector bodies trying to manage their complexity whilst at the time battling with the ever growing pressure to reduce IT spending.

Council IT departments alone are under heavy pressure to reduce costs. The latest SOCITM IT Trends Report forecasts that capital spending will fall by 20 per cent in 2010, with central IT spend falling by eight per cent. This is the largest decrease since Socitm began producing the report in 1986.

But can we really afford to cut corners on data loss prevention? The answer is definitely not. It is now more critical than ever for public sector organisations to focus their attention on data security because not only is it their responsibility to ensure that sensitive information isn't leaked to the outside world, but they will suffer heavy penalties for not doing so.

New powers, designed to deter personal data security breaches are expected to come into force on 6 April 2010. The Information Commissioner's Office (ICO) will be able to order organisations to pay up to £500,000 as a penalty for serious breaches of the Data Protection Act (DPA). A University Hospital NHS Trust recently found in breach of the DPA would have been given far more than a wrap on the knuckles after April this year, when an unencrypted laptop containing sensitive personal information was stolen from one of its vehicles.

This begs the question, why were so many records downloaded, unencrypted, onto laptops in the first place? Furthermore, since 2008, NHS organisations have been able to procure free encryption, as a result of a directive & bulk purchase of licenses by CfH, the agency responsible for the NHS National Programme for IT. The new Data Protection Act will be a real wake up call for organisations to more carefully examine their IT security strategy and take action.

There is added compliance pressure from other regulations, such as the official IT security standards set by the Government's Code of Connection (CoCo), the Regulation of Investigatory Powers Act 2000 (RIPA) which regulates the disclosure of communications data and access to electronic data, and the Freedom of Information Act 2005 which is diametrically opposed to the requirements of CoCo and RIPA.
There can be no shortcuts when it comes to protecting data and it is up to business managers within public sector and private organisations to understand and act on the risks involved rather than delegating the task to the IT department.

One of the major issues when faced with tackling data loss prevention is working out exactly where the data is that you need to protect. This is a huge task for many public sector organisations which have numerous departments with data saved on numerous servers on different types of platforms. Each department may have its own data which is accessed in various ways by office based or mobile workers. Furthermore, the shift towards closer integration and data sharing between public sector services has cast the net of access to data even further beyond the realms of the organisation that originally 'owned' the information.

So what steps can be taken to ensure that new and existing compliance is met and a high standard of data loss protection is in place?

1. Security Policy - Critically, a business manager needs to work with the IT department to ensure that there is a security policy in place that outlines the acceptable usage of data in and out of the organisation. There needs to be clear direction for each employee on their level of access to data and the level of usage, for example whether data can be downloaded onto USBs, laptops or whether data can be pasted into an email or accessed out of hours. Communication of the policy should become part of the induction process and most importantly regular workshops need to be held with employees to ensure that the users are educated in a positive way to avoid future transgressions.

2. External threat prevention - It is imperative to make sure that there is adequate malware protection and intrusion detection in place to prevent individuals outside the organisation trying to access any data.

3. Encryption - The security policy needs to enforce encryption if data is copied onto removable devices such as USBs, and CDs, or stored on laptops. Policy should also dictate who within the workforce can be permitted to copy or manipulate information outside of the realms of normal use.

4. Data classification - By discovering what data you have it is then possible to classify it by its content as being highly confidential, confidential or for everyday business use. A consultancy provider can help an organisation to classify their data and discover their data through specialist data discovery tools. Once data has been classified it is easier to apply data loss prevention policies for different types of users.

5. Identity and Access Management - Data security should be closely tied with an identity and access management solution which allows a business manager to set the rules on who has access to what data in the organisation. By setting specific rules, it will manage any changes in the workforce in relation to data access, e.g. if an employee leaves the organisation or changes role.

6. Consolidation - With various types of software and hardware required for effective data loss protection from both external and internal threats, it is often the case that an organisation may need to approach multiple suppliers. It can be more beneficial and cost effective to work with technology solution providers who can provide more objective recommendations and a better understanding of the public sector's requirements.

Data loss prevention is unquestionable. In the face of compliance, budget cuts and multiple IT systems it can seem like data security is too big a mountain to climb. But by investing some time in your IT security strategy, consulting with technology solution providers who understand your constraints and ensuring that the whole organisation is on board with security policies it is certainly an achievable goal.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------

Peter Wenham, who is an IA consultant and the Leader of the Crime & Security Forum of the Communications Management Association (CMA) gives the following tips to tackling data classification.

1. Understand what data you have - by holding well constructed workshops with senior management led by an external consultant experienced in Information Assurance (IA) matters.

2. Find out where the data is - managers of each department need to discuss with their staff where the organisation's data is located, for example, on file servers, laptops, databases, email, or desktops, with a view to identifying duplications and copies (known or otherwise).

3. Identify the sensitivity of the data - whether it is public, protected, secret or top secret and decide who should have access to it.

4. Set standards across the organisation - by setting standard definitions of roles within the organisation it makes it possible to identify consistently the grading of your workforce and each individual's access rights to data. For example, some employees may be able to access data, but not edit, others may be given no access at all.

5. Conduct a final gap analysis - to ensure that the new grading system of the workforce matches up with the existing access controls.

6. Work out a plan of action - whereby the IT department could look to tightening up its security strategy and senior management may need to provide a budget to enable the IT department to generate better data access controls.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------

This article was posted on Tuesday 2nd March, 2010.

Categories: IT & IT Security

David Miliband has told GPSJ that he 'feels sick' about what the government has done to the 'Building for Schools' program and sais he felt it was 'absolute vandalism' in an interview with editor Stuart Littleford. Speaking at a party meeting in Manchester Mr Milliband also said that 'New Labour' wasn't new any more and labour politics needed re-inventing and what really mattered was the substance. » Read More

» Pet goat tortured in brutal and sickening attack

A pet goat has had its horns ripped from its head and left in agony with broken and dislocated legs in what is being described as a barbaric and sickening attack. The goat known as 'Sid' was attacked late on Thursday night and found in his field early on Friday morning in agony. » Read More

» Nineteenth Century technology could save Councils millions by reducing their electricity costs

Jobs are being lost that could be saved - one local authority employee said. -We've had energy efficiency proposals sat on our desk for two and a half years. If we'd actioned them, we could have kept the key staff members we're about to loose. Considering all of this this, it is surprising how few energy efficiency measures have actually been deployed. So what barriers are making it hard for the public sector to act? » Read More

» Having your photo taken - is it right up your street?

You're out in the street and someone takes your photo without asking. What can you do? And do you have any control over what they do with that image? » Read More

» I2 Marriage made in Heaven

What do you get when the worlds leading analysis and data software provider merges with a leading open source intelligence research institute? Hopefully an even more successful business providing data faster and more accurately to its service users. At least that is the outcome i2 CEO Robert Griffin is hoping for as he heralded the group's newly formed partnership with risk intelligence specialists World Check at its Brussels client conference in June. » Read More