Data Loss Risk Reduction is a set of measures to ensure that you mitigate the risk to your data being stolen or inadvertently ending up in the public domain.
Some of the issues to consider when reviewing the security risks of your information systems, processes and evaluating how to minimise the risks of data loss. We have a related resources that cover some additional considerations for those with data in the cloud, or using some form of outsourcing.
There have been many high-profile incidents of data loss – where large volumes of personal information have found their way into the public domain. These include health records, financial records and employee details.
A commercial organisation also faces the additional risk of data being lost to a competitor and must implement a data loss risk reduction set of policies and procedures.
Larger data losses from government departments and large corporations have hit the media headlines. However, any organisation, no matter its size, could suffer a data loss unless sensible precautions are taken.
Need help with a review? Get in touch with SI ICT
A recent government report states that approximately 31% of small/micro businesses have experienced some sort of security breach or cyber attack in the 12 months according to recent research commissioned by the Department for Culture, Media and Sport (DCMS).
DCMS report
Audit the use and storage of personal data
Evaluate potentially sensitive and confidential data that is stored by your business:-
- Staff records with date of birth, medical information, salary and bank account details etc
- Customer and supplier records with bank/credit card account details, pin numbers, passwords, transaction information, contract information, discounts and pricing
- Financial and performance data and business plans
- Confidential data is not always conveniently stored in a ‘secure’ database. Often employees need to create and circulate ad hoc reports (using spreadsheets and other documents) that are usually extracts of information stored in an organisational database. This sort of data retrieval is quite often done at the expense of data security – as the database itself invariably will have access controls, but these ad hoc reports usually do not.
- Investigate and evaluate what is happening to data and what controls are in place to prevent accidental or deliberate loss of organisational information.
Risk analysis and data loss risk reduction
If all or some of this data is lost who could be harmed and how? What harm would this cause to the organisation and clients (data subjects)
Once these questions have been answered, you can start to take the steps to mitigate the risks of organisational data loss.
Some steps that should can be undertaken to reduce the risk of data loss:-
Undertake regular backups and store backup data securely off-site
- If high risk data is stored in the cloud understand what security mechanisms are in place and how you can retrieve all of this data if necessary
- Review the type of information that is stored on all devices (including laptops, mobiles, tablets etc) that are used off-site. If such information contains personal and/or confidential data try to minimise or anonymise the data. Ensure that the most appropriate levels of data security and data encryption are applied to this data
- If mobile devices are permitted for use with organisational facilities, ensure there is an active bring your own device (BYOD) policy in place. In addition, implement appropriate security controls to restrict the type of data that can be stored on such devices
- Ensure that your organisation’s websites that process online payments have the highest levels of security available such as using the latest versions of SSL for data transmission. If you are not passing the processing of payments to a payment gateway service, and will be storing any credit card information, either on disk or in memory on your own servers, you will need to comply with the Payment Card Industry Data Security Standard (PCI DSS).
- Review the use/availability of USB, and other writable media such as optical devices within the organisation and think about restricting access to these devices to authorised users only, via appropriate security settings, data encryption, and physical controls
- Ensure that company websites and networks are tested for vulnerabilities from attacks and consider hiring penetration testing firms to conduct these tests on your behalf.
- Have a procedure for dealing with sensitive information and its secure disposal once the data is no longer required, this should also include the disposal of print outs
- Have a procedure by which any personal/corporate data stored on mobile devices can be deleted or access removed
- Train staff on their responsibilities, the organisation’s data security procedures, and what they should do if data goes missing
- Train staff to identify rogue emails, ransomware, malware, and other potential threats as well as the procedures that should be followed if they identify these potential threats.
Security breach
In addition to data loss risk reduction strategy, it is also good practice to have procedures in place in the event a security breach occurs.
Concentrate on four main areas:-
- A recovery plan and procedures to deal with damage limitation.
- A recovery review process to assess the potential adverse consequences for individuals, how serious or substantial these are, and how likely they are, to happen again.
- Notification procedures – this includes not only notifying the individuals who have been, or potentially may be affected. If the security breach involves loss of personal data then the Information Commissioner (ICO) should be informed. There may be other regulatory bodies and other third parties such as the police, the banks and the media who need to be informed.
- Post-breach – ensure that appropriate measures are put in place to prevent a similar occurrence, update procedures and train or re-train staff accordingly.
Resource National Cyber Security Centre (UK)
Need help or support with your organisations security - data loss risk reduction?
Book a Free Consultation with SI ICT