Security Policies

Security Policies

1. What is a Security Policy and what is included

   • the data protection act puts an onus on the company to keep information secure from potiental misuse
   • physical security - use of physical methods rather than software methods e.g. locks
   • Logical software methods - usernames and passwords
   • Continuous investigation of irregulaities - query any transactions made out of the ordinary by customers
   • operational procedures - set up disaster recovery programmes
   • staff code of conduct and responsibilities - must not download from the internet
   • personal administration - make sure staff are fit to task and are trained to prevent misuse

2. Operational Procedures to prevent misuse

   • establish disaster recovery programmes - series of steps to recover data
   • screening potiental employees - ensure they are fit to task and are CRB checked
   • establish security rights for updating webpages - only certain staff should alter web pages
   • logon procedures - usernames and passwords
   • encryption of transmitted data

3. Methods to prevent Deliberate Misuse

   • controlled access to the server - retina scans to enter room
   • physical security - locks on rooms and doors
   • firewalls - to prevent agaisnt hackers
   • proxy servers - to allows compter to make indirect communitatiosn
   • secure wireless networks - WAP or WEP codes
   • access rights - suitable usernames and passwords

4. Methods to prevent accidental misuse

   • don't open unknown emails - they may contain malware
   • access right to change data - read only copies
   • backup - to external devices e.g. removable discs
   • checks on transmitted data - check all information throughly
   • protect against power surges - use interuptable power supplies

5. Factors of risk analysis

   • process of identifying the risk - needs to be idenfitied to deal with it
   • assessing the likelihood of the risk occuring - power cuts are inveitable but explosions are less likely
   • assessing the short and long term consequences - how long it will take to recover data
   • how well is the company equipped to deal with the threat - reviewed periodically due to change in needs

6. Threats to data

   • Terrorism - cyber attacks to server - loss of reputation
   • Criminal Vandalism - attacks on firewalls - loss of business and income
   • Fire - electrical fire - cost of recovering data
   • Natural disaster - floods and earthquakes - cost of recovering hardware
   • theft of data - hacking to take private information - legal action