Article

Alexis Ternoy
Alexis Ternoy 22 April 2015

How To Get Security Right

In the age of internet security breaches, why would any company keep all their employee data in one place?

In the age of internet security breaches, why would any company keep all their employee data in one place.



In France, the UK and USA, employees are given a social security number which has increasingly been linked to a credit score number, a number for health care and so on. So why would Sony keep ALL the social security numbers of past employees in one place???


There are a few rules to doing security right.

First, DON’T keep all the data in one place

It’s real simple, keep current employee data separated from past employee data. Even if just to keep passwords up to date, keeping current employee data in a different database just makes sense. And after a year, once final tax documents are mailed, move past data into another database that can’t be accessed except by request. That is, some data should be walled off even from high level ranking users. Security means that top executives don’t have the keys to all the data. Specialized employees are given unique rights to some data. Thus walling some records off from high-level access by one user.

Second, DELETE old data

Yes, as horrid as that sounds to lawyers, some data should be deleted. Once an employee has left, after a year or two, social security data should be purged. And that goes for lots of kinds of data. If it’s sensitive to others, if released, but of no use to the organization – delete it. This is the "right to be forgotten" in French.

Third, LIMIT who can get what

Instead of having a ladder, where the top user gets access to everything, limiting people by segment is more secure. If the CEO has no access to employee data, but needs to go to accounting to get the data, that creates a security wall. And security walls can be created by having data split among servers. For example, one server can have all the employee data without the person’s name. This data would only have the employee number. The number would then be associated with a name on a different server.

Splitting the data among servers, creates a wall. If encryption is strong between servers, this security wall can be quite high and difficult to penetrate.

Having servers with dedicated security zones, also adds to the wall. Internal servers with secure data should have no internet access. If someone is offsite, and needs this data, they need to call into a person who is onsite and can access the data. A lot of people think that every server needs internet access.This is not true. Some data should be for onsite staff ONLY.

Fourth, SEPARATE data with more than one password

Ok, this almost goes without saying, but a one person password is ridiculous. Each database with secure data should have it’s own password and username pair. Anyone that accesses a database with important data, would understand the added security need. This mean a hacker needs to penetrate multiple layers of protection.

Take example on Wordpress great two step authentication, this now IS a standard.

Fifth, MONITOR your systems for users taking too much data

Anyone trying to get ALL the data on a server should trigger an alarm. Once a system is set-up, normal usage will conform to a pattern. After a while, administrators will see the average data consumed per user. This can create a rule. A rule that can be used to limit, and thwarts hackers - bringing them no joy. It’s not fun to only get a few records.

Rules can include too much data coming from the same IP address, the same user or just too much data being accessed from all users. When the limit is reached, fake data or further requests are denied.

Securing data is not that hard, and lots of companies provide software to make the job easy. Why did Sony not have better security?

 

Original Post

Read More on Digital Doughnut

 

Check out our latest videos!



Please login or register to add a comment.

Contribute Now!

Loving our articles? Do you have an insightful post that you want to shout about? Well, you've come to the right place! We are always looking for fresh Doughnuts to be a part of our community.

Popular Articles

See all
The New '4Ps of Marketing'

The New '4Ps of Marketing'

Neil H. Borden, in 1964, gifted the world with the 4Ps of the Marketing Mix: Product, Price, Place and Promotion. This concept has been a cornerstone of business marketing. However, there are new 4Ps of Marketing – just as powerful and just as game changing as Neil Borden’s.

Daisy Kent
Daisy Kent 18 May 2017
Read more
Digital Marketing Vs. Traditional Marketing: Which One Is Better?

Digital Marketing Vs. Traditional Marketing: Which One Is Better?

What's the difference between digital marketing and traditional marketing, and why does it matter? The answers may surprise you.

Julie Cave
Julie Cave 14 July 2016
Read more
4 Important Digital Marketing Channels You Should Know About

4 Important Digital Marketing Channels You Should Know About

It goes without saying that a company can't do without digital marketing in today's world.

Digital Doughnut Contributor
Digital Doughnut Contributor 5 November 2014
Read more
How To Calculate Marketing ROI

How To Calculate Marketing ROI

Calculating marketing ROI is an exercise in patience and accuracy. The formula to calculate basic, short-term marketing ROI is simple: ROI = (Incremental Profit – Campaign Cost) / Campaign Cost. But marketers know that the formula—while accurate—is far too often misapplied to their efforts.

James Loomstein
James Loomstein 16 May 2017
Read more
Forget SWOT, The Pareto Rule Holds The Secret To Your Online Success

Forget SWOT, The Pareto Rule Holds The Secret To Your Online Success

One of the most important principles I've learned is the so-called Pareto Rule. This principle holds particular importance for aspiring online entrepreneurs. If you are a Blogger, Digital Marketer, Amazon Seller, AdSense expert, then Pareto’s Rule applies to your business. Understanding it is vital to your success.

Alex Papaconstantinou
Alex Papaconstantinou 17 May 2017
Read more