Types of Sensitive Information.Technical and legal protection of your personal and business and data.
The online space hides numerous risks of data loss or breach related to confidential information or know-how and that’s why its preliminary protection is essential. Moreover, the devices for file maintaining and sharing themselves hide many risks which could be associated with intentional acts or accidents.
The computer security is an information security applied to computer and network technology and it’s a significant and ever-growing field in the computer science. The term computer insecurity, on the other hand, refers to the concept that the computer systems are inherently vulnerable to attack and there is an evolving race between those who use the security systems vulnerabilities and those who must explore new mechanisms of security.
In the recent years a number of security concerns have arisen because of the increasing amount of sensitive information at every level and its moving from the material primary existence in digital form.
On a personal level the credit card fraud, internet fraud, and other forms of identity theft have become widespread and so the individuals need a proper protection. The existence of large databases of classified information in the computer networks is also changing the face of the national and the international politics. The cyber-warfare and cyber espionage are making more and more important the national security and strategy question around the world.
There are some basic recommendations which could guarantee your personal and your businesses privacy security.
1. Enable "remote wipe" on all mobile devices.
The most banal and common risk of losing confidential information is in case of device theft or loss. This makes easy the access to your correspondence and personal data for unauthorized subjects.
In such cases, a useful tool is the "remote wipe" that allows you to remotely destroy your data on the missing device. Almost all smartphones have such commands, for example: Find My iPhone, Exchange ActiveSync, Mobile Tracker. Since the device must be connected to Internet to respond to a remote wipe command, it is very important to be enabled Passcode Wipe as well. The principle of this function is that if the password is entered incorrectly enough times , the device will erase all user’s data effectively keeping it out of the hands of your phone’s "new owner" even when the remote wipe couldn’t be successful.
2. The Password - A double-edged sword.
The advice of the security experts that we often don’t respect is to use a different password for each site or online service. This will minimize the security threat when one site happens to be breached. Undoubtedly, you should use a unique password for each application or service where you may be handling sensitive information. If like most of the people remembering several passwords it’s a problem for you the solution to this problem is called "password manager" - like one password to store all your passwords under a single secure key.
3. What is "cloud computing"?
This phrase is often used in reference to network-based services which appear to be provided by real server hardware, and are in fact served up by virtual hardware, simulated by software running on one or more real machines. Such virtual servers do not physically exist and can therefore be moved around and scaled up or down on the fly without affecting the end user, somewhat like a cloud becoming larger or smaller without being a physical object.
Companies supplying clouds are: Amazon (Amazon Web Services), Google (Google AppEngine), Microsoft (Microsoft Azure), Apple iCloud, Salesforce, Sun Microsystems, IBM, Oracle, VMWare, in Bulgaria (Cloud bg) and others.
The E-mail is the primary way of communication and exchanging information on Internet. The hidden risks in the digital communications are that the information in them is unencrypted, making it easy to access and breach. Actually, unencrypted is generally all the information gathered in the hard disk and that makes it accessible to anyone with physical access to the electronic device.
In this case useful is the " Cloud”. From a financial point of view it’s a suitable and accessible remedy for protection of the small and medium business with limited financial and technical resources. Putting all communications in the cloud guarantees securely encrypted and what is more important two-way encrypted communications, because even if you or your company have taken measures to protect the sensitive data it is not certain whether your customers have done that and if not - the risk still exists. This is exactly the function of the cloud - double protection from unauthorized physical access. The password-protected web application ensures only authorized individuals can access your and your customer’s sensitive data.
The Cloud ensures the security of the information also in case of random events such as physical damage of the devices, unauthorized appropriation, hacking or even authorized actions of inexperienced employees.
More importantly, considering security has been the chief concern with cloud technology, cloud computing vendors have an additional incentive to put a special emphasis on security from the start.
4. The importance of the full disk encryption on all devices.
The use of full disk encryption (FDE), a solution that encrypts a system’s entire hard drive including the operating system, applications and data, ensures the security of your temporary files and other data available on your laptop, smartphone or other device and it’s an additional measure which is useful independently the information collecting in the cloud. Some solutions for full disk encryption are developed and offered by security vendors such as Symantec, Check Point, McAfee, Sophos and others. Moreover, the latest operating systems and mobile devices have built-in hardware encryption.
Legal Protection from unauthorized disclosure. Types of sensitive data.
Personal Information.
In today’s world of increased personal privacy protection over 80 countries and regional organizations have enacted strict national information privacy laws, guidelines, regulations and even criminal laws regarding the use, processing or removal of personal data beyond certain borders without the expressed written consent of the individual.
In Bulgaria, for example, the sensitive personal data is protected by Law for Personal Data Protection and the competent executive authority in case of infringement is the Commission for Personal Data Protection.
In the European Union from 1995 came into force the Data Protection Directive which provides a rigorous standard for privacy protection legislation for all member states.
Presently, the EU is drafting a General Data Protection Regulation (GDPR) which should replace the Directive considering the consequences for the inviolability because of the recent technology changes such as social networks and cloud computing. The GDPR is expected to be adopted in 2014 and to be implemented by the member states before 2016.
The Commission’s proposals update and modernize the principles of the 1995 Data Protection Directive in order to guarantee the right of personal data protection in the future. They focus on: reinforcing individuals’ rights, strengthening the EU internal market, ensuring a high level of data protection in all areas, including police and criminal justice cooperation, ensuring proper enforcement of the rules and setting global data-protection standards.
What will be the key changes?
1. The ‘right to be forgotten’ will help people to manage better the data-protection risks online. When they no longer want their data to be processed and there are no legitimate grounds for retaining it the data will be deleted.
2. Whenever consent is required for data processing, it will have to be given explicitly, rather than be assumed.
3. Easier access to one’s own data and the right of data portability or better - easier transfer of personal data from one service provider to another.
4. The companies and the organisations will have to notify all serious data breaches without undue delay, if possible within 24 hours.
5. A single set of rules on data protection, valid across the EU.
6. The companies will have to deal only with a single national data protection authority – in the EU country where they have their main establishment.
7. The individuals will have the right to refer all cases to their home national data protection authority, even when their personal data is processed outside their home country.
8. The EU rules will be applied even to companies not established in the EU, if they offer goods or services in the EU or monitor the online behavior of the citizens.
9. Increased responsibility and accountability for who manage personal data.
10. Will be removed those unnecessary administrative burdens such as notification requirements for companies who manage personal data.
11. National data protection authorities will be strengthened so they can better enforce the EU rules in their own countries.
With these changes the individuals can be confident that they can go online and take advantage of new technologies regardless of where they come from, whether it’s shopping for a better deal, or sharing information with friends around the globe. This reinforced trust will also help businesses grow and allow them to serve consumers throughout Europe with adequate safeguards for personal data, and with lower costs. This will help stimulate the internal market, boost growth, create jobs and foster innovation.
Confidential Business Information (trade secrets)
The confidentiality of the sensitive business information is established through non-disclosure agreements which are legally binding contracts between two parties in a professional relationship. NDAs may be one-way, such as in the case of employee who receive confidential information about the employing organization, or two-way between businesses needing to share information with one another to accomplish a business purpose. Depending on the severity of the consequences the violation of non-disclosure agreement may cause an employment loss, loss of business and client contacts, criminal charges or a civil lawsuit.
Unlike personal information, there is no internationally recognized framework for the protection of trade secrets, or even a common definition of the term “trade secret” but many countries and political jurisdictions have taken the initiative to punish the violation of the confidential commercial data in their criminal or civil laws. More commonly, the breach of commercial confidentiality is punished by the civil law.
Classified Information
In many countries the unauthorized disclosure of classified information is a criminal offense and depending on the severity of the violation may be punishable with fines, prison or even death penalty. For less significant infringements may be imposed civil sanctions ranging from disciplinary sanction to revoking of security clearance and dismissal.
The popular, controversial Wikileaks is just one of many manifestations of the growing cultural sentiment that is becoming an additional challenge to the security and integrity of classified information in the digital world.
Sabina Popova
© 2014 1Legal.Net Blog Copyright
Materials published on this blog are copyrighted. No part of them can be copied or used without the express permission of the author.
There are no comments at the moment.