This chapter presents an overview of the issues relating to securing your company's or client's data -- and ultimately, their business livelihood. The "data security" arena is vast, so to give us a manageable scope we will look at three primary areas: preserving data integrity; long-term storage and retrieval of information; and disaster recovery and business continuity. The key concept behind data security is as follows: preserving the integrity and confidentiality of, and access to, your company's or client's information. Each of the three topic areas is a component supporting this concept.
- Preserving data integrity ("real" security)
- Long-term storage & retrieval
- Disaster recovery & business continuity
- Conclusion
- Self Check
[ I ] Preserving data integrity
Under the heading of "data integrity" or "real security" are a number of steps to take to make your business more secure. The first step in securing your data is establishing and maintaining strong password security (covered in Chapter 8).
Work with Management
The second step is to develop good working relationships with your management and human resources personnel. The goal is to be "in the loop" when employees are transferred or terminated so that you can take prompt action to adjust or remove the employee's access to company data. The following is a brief check-list of actions to take when an employee is terminated:
- Delete or disable the terminated employee's user IDs or accounts.
- Archive their data for long-term storage.
- Contact the user's supervisor or manager to arrange for transferring the user's data to them or to another user.
- Allow only authorized individuals access to a terminated employee's files and data: anything may be used either by an employer or an employee in an investigation or legal action.
No physical security arrangement will defeat a determined thief, spy or saboteur.
Designing security for network systems is a balancing act between the real costs of prevention and the potential cost of a failure.
Physical Security
The third step is to secure access to your network servers and other equipment. A good place to start is by locating sensitive equipment in a room with a lock on the door. This will keep out the mischievous and those curious, well-intentioned, folks who do so much damage to their own PCs. When establishing a secure server room or network center take the time and invest the resources to provide the room with stable electrical power and a good operating environment. A good UPS and air conditioning should come first on the list. More demanding enviroments such as hospitals, financial institutions, or government installations may require the continuous uptime provided by standby generator systems.
After that you can think about such things as temperature alarms, burglar alarms, and fire suppression systems. Tailor your level of security to that needed by the business. Banks and defense contractors need much higher levels of physical security than a company making party favors: judge how much your company is willing to invest accordingly.
Ever Watchful
The last of our steps to securing your company's data is a large one. You must be constantly mindful of what is going on in your environment and the office environment around you. This includes being aware of the human factors in security (Appendix A).
Conduct regular audits of user accounts and their associated levels of access. Adjust them as necessary, and don't hesitate to ask management if someone should have access to the information that they do. As time passes and employees move from one job function to another they tend to accumulate access privileges -- some of which they need to do their jobs, and some of which they probably do not need.
Get nosy and ferret out unsecured points of access into the company. A single user who leaves his PC running with a copy of PC Anywhere (a dial-up remote control package) with no password for outside access opens your company to invasion by thieves, vandals, and snoops just as if you'd left the back door standing open at midnight. Dial your company's telephone numbers and make sure you know the identity, purpose, and security behind every line that has a modem answer it. If you find an unsecured point of access do not hesitate to pull the plug until it is made secure.
Take a good look at what goes into your dumpster; make sure that your "trash" isn't ripe to become "treasure" to a "dumpster diver". Invest in a good shredder and use it to destroy old documents and printouts before they go into the trash. In some cases of industrial espionage, it's not who your customers are or what your pricing is, but how you run your company -- your business processes -- that are the real prize.
Ensure that old magnetic and optical media meet the same fate. Destroy, or at least erase, all floppy diskettes and tapes before disposing of them. Don't give away old company PCs or hard disks to employees or charities without first reformatting them. Some business environments will have very stringent requirements for data destruction. And, a lot more should but don't. Information is your company's life-blood; don't ever do anything to willingly give it away.
There are firms that specialize in high security document and media destruction. You can find them in the Yellow Pages and on the web. The workers above are operating a truck-mounted mobile shredder.
Viruses
In addition to watching over what goes in and out of your office, you need to be aware of a threat that moves within your office: viruses. Most computer viruses these days are created by programmer wanna-bes out to prove that they can do it, or people with some bone to pick with society or technology. Some viruses have been created by individuals and companies for specific ends -- to get revenge on an ex-girlfriend or for competetive advantage or profit. Generally they fall into the nuisance category -- the common cold of computing, not HIV or cancer. That does not mean that viruses can be ignored. You should use virus cleaning software to regularly scan your network and client systems for virus infection. You will also need to keep up a constant level of user education about how viruses are transmitted and how to remove them. Below is a table showing the three main types of virus, how they are transmitted, and (generally) what they do.
| Virus type | Method of transmission | Damage done |
| Boot sector | Carried from system to system on floppy disks | Can cause system to lockup, can destroy partitions on hard disks |
| Program virus | Infects executable program files | Can cause system to lockup, can modify or destroy data files |
| Macro virus | Sharing data files, through drives on the LAN, email, floppies | Can cause applications to malfunction, can corrupt data files |
The macro viruses deserve some special attention, in part because they are relatively new, and in part because they are so easy to spread. Some research organizations estimate that half of all virus infections today are macro virus infections. A macro virus is a clever perversion of a powerful feature built into many office productivity applications. Most apps, such as Microsoft Word and Excel, have powerful programming languages built in. Normally these languages are used to automate functions such as entering data into a form and making sure that it is properly formatted. Excel "macros" -- short programs written in Excel's internal programming language -- can be used to perform sophisticated numerical analysis.
Why Microsoft applications are such common targets will be left to your imagination and judgement.
Macro viruses exploit these programming languages to force the application to replicate the virus code into other data files, and (usually) perform some sort of mischief. The first macro virus -- the Concept virus -- caused MS Word to save all documents as document templates. The Wazoo virus -- another Word macro virus -- randomly deleted words in documents and inserted "Wazoo!" in their place... something both annoying and destructive. The latest MS Word macro virus isn't really a macro virus -- its written in Microsoft's VBA (Visual Basic for Applications -- an even more powerful language) -- and it exploits the linkages between MS Office applications to automatically propogate itself to the first fifty people in your MS Outlook address book.
The threat of macro viruses for damaging data and frustrating office staff is so large because the virus is in the data, not the application code or the computer operating system. So, any document sent from one system to another via email can instantly transmit the virus. All you need to do is double-click on an infected attachment in your email and your system has the virus too. Because of the asynchronous nature of email, infections reappear over and over again despite repeated virus cleaning. One of the best defenses is email server software that incorporates virus scanning and removal into its mail handling.
[ II ] Long-term storage & retrieval
It is not good enough that we safeguard information stored online. We must also provide for recovery of the online data in the event of some sort of failure or catastrophe, and we must be prepared to deal with the volumes of data that are too large or accessed too infrequently to warrant being stored online, but which still must be preserved.
Providing for recovery of online data generally takes the form of backups to tape. However, in computing environments where exposure to downtime would pose unacceptable financial burdens, more exotic technologies are employed. Technologies such as mirroring disk drives and whole servers over long distances (up to several miles) provide for nearly instant recovery from a computing outage. Most of us will operate in environments where daily system backups will provide an adequate ability to recover online information in the event of disaster.
A critical point to understanding the need for long-term data storage and retrieval planning is the following: not all information has to be retained forever, and some should not be. Various laws governing the operation of businesses in the U.S. establish minimum storage intervals for documents, whether they are in paper or electronic form. The primary source of the need to retain business documentation is the tax code. Most business financial records will need to be retained for seven years.
Steps for Action
There are several steps you should take to insure that your company is protected from exposure to penalties for not retaining documents, and exposure to legal liabilities due to improperly retaining documents that should have been destroyed. Remember - if a document does not exist it cannot be subpeonaed in a lawsuit.
First, you should work with your management to determine what kinds of electronic records warrant long-term retention. Document what must be kept, and for how long.
Second, develop documented procedures for purging information that is no longer needed. The documentation will help you in several ways. It will reduce the chance for accidental destruction of information that should be retained, and it will protect both your company and you in the event that you are the subject of legal action. If you have an established policy that calls for the destruction of all memos relating to finished work after one year, then you cannot be called to task in court for having destroyed documents that fall within that criteria. This is where the professional shredding outfits mentioned earlier can come into play.
Third, make sure that you have a means of restoring information that has been archived to off-line storage. The seven year retention interval for IRS records equates to two or three generations of computing technology. This creates an obligation on your part to make sure that a tape written five years ago is still readable by the systems you are using today.
Fourth (and last), be conscious of physical security of your backup media. Store tapes and optical cartridges in a locked, climate controlled, room. Don't leave tapes out in the open where the curious or criminally-minded can see and pilfer them. After all, it is much easier to overcome whatever security there is built into your backup tapes than it is to attack your online system head-on.
Electronic mail deserves special attention in this discussion. Some will recall the considerable embarassment suffered by Microsoft corporation during the trial brought against it by the U.S. Justice Department starting in 1998. Several top Microsoft executives were made to look quite foolish and dishonest when DOJ lawyers read to them copies of their own internal emails. This is far from the first case of electronic mail coming back to haunt its sender. Almost a decade earlier Lt. Colonel Oliver North faced a congressional hearing for actions taken by the Regan administration in the Iran-Contra scandal. He was there not because he failed to thoroughly destroy the operation's paper trail, but because copies of email regarding the operation had been retrieved by the Iran-Contra Independant Council from the White House's IBM PROFS system.
Email poses such a vexing problem because it goes so many places between sender and recipient, and because of how people use email. Modern email systems tend to leave multiple copies of messages lying about as they operate. A copy is saved in the sender's sent mail folder; a copy might hang out on the recipient's mail server; the recipient might save a copy in a folder. Even if they "delete" an email it's still there until they empty their "trash". Even then the email is probably still retrievable from their local or server-based message file. People also tend to be much more free in whay they'll say in an email than in more formal business communications (this is part of what got Microsoft in so much trouble).
The best advice I can give at this point is this:
- If your email system supports automatic purging of messages, turn it on.
- If you have an existing document retention policy, work with your company lawyers to have the policy extended to cover email and all other electronic documents.
- Encourage your users to use judgement in writing emails. Remind them that Internet email is insecure, and that any document (electronic or otherwise) might wind up in court. "Don't write anything in email that you wouldn't want to read on the front page of the Wall Street Journal" is a good rule of thumb.
[ III ] Disaster recovery & business continuity
Computing resources are critical components of a business' processes and livelihood. Any substantial disruption to a business' computing environment can hurt the business both in the long and short term. Computing failures lead to short term loss of revenues, and long term loss of customer confidence and missed opportunities. Research shows that 50% of businesses that suffer an outage of a week or longer will go bankrupt within four years. With that in mind, this section addresses planning for disasters and strategies to ensure continuity of business operations.
The role of IS
When a computing outage ocurrs it is called a "disaster". Anything that substantially disrupts company operations is a disaster. Our jobs as Information Systems professionals is to prepare ourselves and our company to recover from a disaster as rapidly and smoothly as humanly possible. Disasters occur on a scale from small to immense. The table below defines the three categories of disaster used in this course:
| Type of disaster | Description and examples |
| Catastrophic | Fire, flood, tornado, terrorist attack, war: anything that completely destroys a computing facility. The World Trade Center and Oklahoma City bombings, and the Kobe earthquake are examples of Catastrophic Disasters. |
| Major | An event that causes substantial damage to a computer system or facility that will disrupt operations for less than one week. The recent New England and Quebec ice storm is an example of a Major Disaster. |
| Minor | System or facilities failures with a duration of 24 hours or less. A server room UPS failure or a server hard disk crash are examples of a Minor Disaster. |
For more information take a look at the resources available from:
Preparation is the key
Quantifying the type of disaster after the fact will do nothing to restore your business to normal operation. Preparation in advance is the only method for mitigating the effects of a disaster. Just as disasters come in varying shapes and sizes, so do levels of preparedness. The level of disaster preparedness that is appropriate in your organization will depend on the type of business you are in. Financial institutions, hospitals, government agencies, and organizations critical to the national defense will require the highest levels of disaster preparedness. Other businesses whose business practices are very sensitive to computing outages, such as customer service centers, will also have a need for sophisticated disaster recovery planning, as well as business continuity planning. Business continuity planning differs from disaster recovery planning in that DRP is centered on restoring what has been destroyed, while BCP centers on continuing business operations while the recovery is going on.
Plans and testing
The bottom of the ladder of preparation is "none" -- you have no plan at all for recovery from a disaster. Too many small and midsized businesses operate in this mode. The first step up from the bottom is having an "informal" plan. Having an informal plan means that you have discussed recovery options with your peers and your management. Nothing has been committed to paper, but you have thought about it and hopefully outlined how you would respond to likely disasters. The top of the ladder is a "professional" plan. With professional level planning your disaster recovery plans are documented, communicated throughout your organization, and tested in advance. Without periodic testing you have no way of knowing if the disaster recovery plan you have crafted is a logistical masterpiece, or weak plan that leaves so much out that it isn't worth the paper it's printed on. In truth, preparedness is only half of the equation; testing is the other half.
The following table outlines steps you can take to prepare your business to recover from a disaster. They are grouped into categories from "basic" steps to "advanced" steps:
| Level | Actions to take |
| Basic |
|
| Intermediate |
|
| Advanced |
|
The information presented here is not meant to provide you with a recipe for disaster recovery, but to make you aware of the things you need to think of in devising a disaster recovery plan that fits your business' needs. It cannot be stated enough: thorough preparation and testing are the only methods that will preserve your company (and your job) if the unthinkable happens to you.
[ IV ] CONCLUSION
Chapter nine presents a high level overview of the techniques for securing your company's information, protecting it from legal action, and preparing for the 'unthinkable'. At this point you should be able to evaluate a network for weaknesses and participate meaningfully in disaster recovery preparations. Go through the questions in the Self Check section below to gauge your understanding of these topics.
[ V ] SELF CHECK
- What four steps should you take when an employee leaves your
company?
- You are setting up a server room in a new office building. What
should this room have in order to be a safe and secure home for your
systems?
- Describe human engineering, and what you might do to limit
its effectiveness among your user community.
- What types of trash should you check before it reaches the dumpster?
And, what should you do with it?
- Summarize the "four steps for action" in section II.
- Describe the three types of viruses and how they propogate.
- Name the three levels of disaster and describe each one in a
sentence or two.
- Do the same for the three levels of disaster planning.
|
[ CH 8 ]
[ TOC ]
[ CH 10 ] |
|
1998,1999,2000 Shipman | Created 3-30-98 | Updated 2-5-00