The unencrypted hard drive - missing from a prison…

The Information Commissioner’s Office really had no choice but to come down hard on the National Offender Management Service recently, after a portable hard drive used to back up the prisoner intelligence database went missing from a prison security department.

Although nobody knew when it had actually gone missing, it could have been gone for almost a week since it had last been used on 18 May 2013 for the weekly back up - but was missing when staff went to back up six days later. It had not been locked in the fireproof safe afterwards, contrary to policy.  Not only was it missing, it was also unencrypted and had not been password protected. It contained sensitive information about almost 3000 prisoners, including names and dates of birth, length of sentence, offence(s), physical descriptions and distinguishing marks, plus intelligence information about drug use and links to other prisoners or organised crime - certainly not the sort of details you’d want to lose.

Although only nine staff members had access to the area where the hard drive was used and the area was controlled by a keypad system, the door to the Security Department could be opened by anyone on the prison staff.

To make matters worse, this wasn’t the first time something like this had happened. Back in October 2011, an almost identical breach involving 16,000 prisoners in another establishment had taken place, and the ICO had been told that because of this, encrypted hard drives had been supplied to 75 prisons that had been using unencrypted portable hard drives to back up prisoner intelligence information. Unfortunately, nobody realised that the encryption software required manual activation and the IT provider was never asked to check that the encryption software was working, so all the 75 prisons carried on using insecure portable hard drives for at least a year afterwards.

The software has now been activated and automatic upgrades enabled. The hard drive was never recovered although it doesn’t appear to have been accessed and there was no evidence that it fell into the wrong hands.

Because there had already been a virtually identical serious breach, the Commissioner considered that this was a very serious contravention of the seventh data protection principle;

“Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data”

The National Offender Management Service was fined £180,000. It just underlines the fact that even though you think you’re doing everything you can to comply with the rules, sometimes it can be the simplest thing you overlook that can lead to a damaging security breach. 

Do you know where your backup drives are kept, and have official policies in place to ensure that they don’t go missing? Are the drives encrypted? Can you imagine what would happen if the personal information you keep backed up were to be lost, either for your business or your clients? If you’re unsure of how to make sure that this sort of faux pas doesn’t ever happen to you, contact me and I will be delighted to provide you with guidance and advice.

Bring your own device - and don’t lose data

Working from home and being able to take work out of the office makes working life easier but can be a nightmare for data privacy. With an estimated 56 per cent of employees reporting that they either very frequently or frequently stored sensitive data on their laptops, smartphones, tablets, and other mobile devices, the chances of confidential information getting lost or into the wrong hands are very high. 

Bring-Your-Own-Device (BYOD) is part of the modern workplace. It’s becoming more and more normal for business information to be stored in or accessed by devices that are not fully controlled by IT administrators, and the possibility of data breaches caused by personal devices that aren’t properly protected is also on the rise. 

Protecting business information on mobile devices can be as simple as encrypting files and/or password protecting the device - it won’t stop them being lost but IT admin will be able to selectively remove sensitive encrypted data and the chances of someone using stolen information maliciously are much smaller if it’s not possible to get straight into any files that may be sensitive. The issue is clouded when the device actually belongs to the employee and not the business, however.

Most businesses think nothing of allowing employees to use their own devices to access email, office calendars and contacts, and a strong BYOD policy is vital if company information is accessible on the go, via personal devices. 

Which devices are allowed?

It’s up to you to set the boundaries and specify what’s acceptable. If you only want to support employees’ personal Android devices and not iPhones or iPads, or vice versa, make that policy and stick to it. 

Enforce strict security rules

People don’t like having complicated passwords and lock screens - they get in the way of fast access to their devices and longer, more effective passwords are also easier to forget. If they are using their own mobile devices for work however, you can’t afford to leave them on a swipe and go setting. If your staff members want to be able to use their own gadgets for work too, they will just have to accept that they need to use a complex password to access them.

Banning apps

This also applies to corporate devices - social media browsing apps, email applications and VPNs or other remote-access software need careful consideration when you’re formulating a data protection policy. Although the devices are people’s own, they will have to consider business needs if they want the convenience of using them for work, and that includes not using apps or settings that could potentially compromise data security.

Businesses also need to consider what could happen if an employee leaves the company - you will have to have an agreed policy in place allowing you to remove any access tokens, e-mail, data and other access permissions.

Does your organisation have a BYOD policy? Do you have permission from your employees to delete information from their personal devices remotely when they leave, or if it’s lost/stolen? What safeguards are in place to ensure that staff don’t store sensitive information remotely? If you need advice on setting BYOD policies that keep your sensitive data safe, contact me and I will be delighted to provide you with guidance and advice.

Why I like Data Protection?

I was asked the other day why I enjoy working in data protection. If I'm honest I disliked data protection before I completed my training and got the qualification, I found it confusing and cumbersome and wondered how anyone could actively comply to the many rules and elements, some of which seemed contradictory. Having completed the training and passed the 3 hour exam(!) I really understand the Act. The Data Protection Act can feel like looking a puzzle when you have no picture, you have the pieces but they made no sense as to how they fitted together. In fairness the Data Protection Act is a cumbersome piece of legislation. There have been bits added on over the years and other regulations brought in to support it, such as the privacy and electronic communication regulations (PECR). I can see why some organisations find it difficult to understand and struggle to comply especially if they don't have access to a knowledgeable advisor. 

When we work with organisations, our first question is always "What do you want to do with the information?". Once we know what information you want to collect and its purpose we can fit the other pieces into place to support this. Each organisation has its own challenges to overcome to comply with the Act and it is wonderful to ease that journey for them by providing advice which meets their needs. I have a wonderful job supporting organisations to look after personal information which helps them grow their business.

Are you protecting your customer information?

One of the most valuable things a company has is its information on customers and clients. Most businesses have information about past customers but also a potential pool of future customers through a mailing list.

So you have details which are valuable to your business but how secure is that information?

Can a member of staff download your customer database onto a memory stick?

Would you know that it had happened?

Can a member of staff email your database to themselves or someone else?

The ICO can prosecute staff who send emails containing personal information. A paralegal was sending emails to himself containing personal information about clients before he left one law firm to join another, the ICO prosecuted.

A car rental manager was prosecuted for selling information about customers, who had an accident, to a claims company. The car rental company picked up an irregularity and reported it to the ICO.

People are concerned about the security of their information and want to do business with organisations that hold their information securely and don't share it with other organisations. Do you systems ensure that your customer information remains yours and you know who has access to it at any time?

If you are concerned about your data security contact me at Audit & Risk Professionals and I will be happy to talk you through how we can help.