6e - Data Confidentiality

6e - Data Confidentiality

1. Why does data need to be kept confidential?

   • To comply with the Data Protection Act
     • Personal data must be kept secure and must not be revealed
   • Organisational reasons
     • Information maybe commercially sensitive
     • Could be of value to competitors

2. Keeping Data Confidential

   • Security policies
   • Choosing appropriate passwords
   • Changing passwords regularly
   • Locking workstations
   • Looking out for potential security breeches
   • Use of tools:
     • Anti-virus
     • Anti-spyware
     • Firewall

3. Encryption

   • The process of disguising messages or data
   • Uses random process set up using a special key value
   • Used to provide security of data
     • Especially during transmission through the Internet

4. Authorisation

   • Giving permission for users to access data
   • Levels of access rights
     • Delete - A user is allowed to delete data
     • Write - A user is allowed to make changes to data
     • Create - A user is allowed to create new data records
     • Read Only - A user is allowed to view data
   • Method's of supplying User IDs
     • Magnetic stripe on card
     • Smart chip on card
     • Biometric
     • User name

5. Authentication

   • Confirming that a user is who they say they are
   • Main ways of authentication
     • Password/PIN
     • Mobile Phone/Credit Card
     • Voice Recognition/Fingerprint
   • Network manager:
     • Force password change frequently
     • Minimum length password
     • Contains numbers letters and symbols
     • 3 incorrect password attempts locks account
   • User:
     • Make it something that isn't personal
     • Make sure no one is looking when typing it