e-skills UK Guide

Protecting important data

Protecting business data

This Guide is designed to help you protect your data from unauthorised access and inadvertent corruption. It will help you to find out and list what of your business data needs securing.  By going through this process you can hopefully make sure nothing is forgotten about.

Why bother with data protection?

There is a great deal of ‘hype’ surrounding security.  As a result many people are driven by the latest scare story.  Since the basics of data security tend not to make the news they are easily overlooked.  A list of your needs gives you the best chance of capturing all your security requirements and allows you to:

• Take an overview of your needs and create a set of measures that get you the best balance of security and inconvenience.
• Show the list to others to get feedback as to whether there is anything missing.
• Create a useful document to review your security measures if there is a new threat.

It is important to put this process into perspective and don’t let it come in the way of running your business. Deal with the threat proportionately and you will be fine. For the majority of small businesses the biggest threat to their data is a member of staff accidentally deleting or damaging a file.

Taking stock of your security needs

We suggest you think about your own business and the types of data and systems that could be vulnerable:

• Databases and data collections. Most businesses will run a small database or data collection. Initially this data may be on a simple spreadsheet. Think where you store your customer and supplier data. What about payroll or other internal data that could be very sensitive if it fell into the wrong hands? Both the file and probably the directory where it is located should be secured with a password.
• Email and contact data. Many small businesses could not survive with the constant flow of email traffic they have with customers and suppliers. This data is secured on a server or maybe an off site location if your email is managed by an external provider. If the data is on a server in your office this must be secured with full password protection. In some small businesses there is a lot of sensitive data that flows via email, so this will need to be secured. It is possible to secure emails when they are being sent to a recipient but for the vast majority of small businesses this level of security is probably not needed. The biggest risk you face would be members of staff having access to a director or owners PC and reading their email directly. This may happen if you leave your desk for any length of time. If you consider this an issue implement security on your PC so that you can “lock” the PC when you are away from it. That way only someone that knows the password can unlock the PC. Some operating systems will automatically “lock” a workstation after a predetermined period of inactivity – such as not using the mouse or keyboard for 5 minutes. This is a useful feature.
• Offsite data.  Data held outside your office is, potentially, your biggest headache.  It started with the diskette and the laptop and now includes, portable disks, CDs, DVDs and even digital cameras. Taking data off site is a boon for productivity (and necessary for protecting data from loss) but is a security nightmare.  For example, it is very easy for a salesperson to download a contract to their PDA so they can work with it on the move. Alternatively they may use a memory stick to easily transfer documents to their home PC.  But suppose they mislay the device.  What if they left it at one of your major customers? You may also need to consider people taking work laptops home and using them remotely – how can they guarantee the laptop will be secure? A robust IT security policy, backed up by regular reviews, is often the only way to actively manage this type of problem.
• Access from the outside.  It is possible for someone to load software on your PC without you knowing about it and accessing your files. This risk is absolutely minimal for most small businesses if you install and run updated industry standard protective software on your PCs.

A method for assessing security for your business data

If you feel particularly at risk it is possible to carry out an assessment of your business data, using a simple spreadsheet.

We suggest you use a simple system to identify how important it is to your business to protect a given network, device or set of data.  Here’s a scheme you might want to adapt to your needs:

1.        Critically important.  If someone were to gain unauthorised access our business could be in jeopardy.

2.        Business critical.  If someone were to gain unauthorised access we could lose significant business or a substantial amount of money.

3.        Internal exposure.  If someone where to gain unauthorised access they could damage data and systems but we would be able to recover without significant effect on the people we deal with.

4.        Annoyance.  Unauthorised access could cause problems and some embarrassment, but nothing significant.

Prioritising data in this way will help you decide which data security measures you need to implement first, and establish the balance you need to make between security and inconvenience. Make sure that you secure this spreadsheet!

Free security advice

Whether your business has been affected by crime or you are seeking preventative measures against crime, the Business Crime Reduction Centre (BCRC) is here to assist you, contact BCRC by:

Calling: 0114 275 1283
e-mailing: info@bcrc-uk.org
Visiting: http://www.bcrc-uk.org

Commercial suppliers

We do not recommend specific products or suppliers; instead we provide you with a representative sample which covers the range of suppliers/products available. You may choose to look at these suppliers or products but this is entirely at your discretion.