Triad of Data Security
- Physical - building, equipment, file cabinets
- Paper Files - brief case, copiers, desk tops
- Electronic - email, network file servers
Are you motivated to protect your data assets?
Does it sound like another task or does it sound like a fire drill? As a business owner you ought to have a very good idea of what data is mission critical to your operation. Maybe you may not know everything, but you know where to find it when you need it. Keeping it in a place where ONLY your organization can find it - when you need it - is the objective of business security.
Various forms of information sources include; people, places and things. For example, your brief case, the file cabinets, your office in addition to the file server. Is it backed-up, locked, protected?
Strategic Planning
Information security is more than looking at the computers or hackers outside
of the organization. Today you need to factor a variety of possible leaks or
opportunities for loss of data.
Internal staff may be standing just outside the emergency exit door
grabbing a smoke while using a chair to prop the door open. Do users willingly
provide passwords over the phone rather than in person?
Evaluate your policies and procedures on how you run your business.
You need a plan:
-
Determine your physical vulnerability level right now - look at your office,
think about your car, the filing system. Is propriety business information
easy to access?
Are there locks on the cabinets, windows, and doors?
Can someone easily walk off with a computer, laptop or briefcase? - List situations by priority according to the probability of it happening and how it will impact your operation.
- Evaluate each risk considering how to transfer, mitigate or avoid it. The balance you seek is how much security do you want and at what cost.
- Allocate resources and responsibilities to carry out your plan.
Security Resources
Free Security Evaluation by Microsoft
Microsoft Baseline Security Analyzer V1.2 Updated: July 6, 2004
"In response to direct customer need for a streamlined method of identifying common security
misconfigurations, Microsoft has developed the Microsoft Baseline Security Analyzer (MBSA)."
Symantec's Online Security Check
"Symantec Security Check tests your exposure to a wide range of online threats. It's free and efficient,
and it helps you determine your Internet security needs."
Security Risk Management Guide
Thanks to Microsoft for providing an overview of how to evaluate risk.
"Customers can be overwhelmed when attempting to put in place a plan for security risk management.
This can be because they do not have the in-house expertise, budget resources, or guidelines to outsource.
To assist these customers, the Microsoft has developed The Security Risk Management Guide.
(Microsoft Business and Technololgy Center. October 2004)