Everything about Corporate Data Security Policy and Procedures

Due to the development of information technologies and computerisation of the economy, one of the most important issues in the company's activities is ensuring information security.

Information is one of the most valuable and important assets of any company and must be properly protected.

Data security is the preservation and protection of information. It includes systems and equipment designed to use, save and transmit this information. In other words, it is a set of technologies, standards and management methods that are necessary to guarantee information security.

The purpose of information security is to protect data and supporting infrastructure from accidental or intentional interference, which can cause data loss or unauthorised alteration. Information security helps ensure business continuity.

The security of the company's information infrastructure means protection against accidental or intentional actions that may harm data owners or their users. The actions of those responsible for this area should be aimed at creating protection against data leaks, not at combating their consequences. But it is also important to maintain easy access to information for those people who legally use databases.

Hence one has to create a suitable data security policy and procedure for his specific company. This policy must meet the Data Protection Act instructions according to GDPR, a regulation that unifies the protection of personal data of all data subjects in the European Union.

Given the importance of information in today's world, protection against leakage of confidential information to competitors needs to be given increased attention. The possible damage can be much greater than the value of all material assets of a company.

An additional difficulty is that the theft of information may have a negative impact on the company, not immediately after it has been committed, but after a certain period of time. The seemingly unimportant data when disclosed can cause reputational damage to the company and reduce its market value.

Therefore, when developing information security measures, data cannot be divided into types. Everything that is placed in the company's IT infrastructure and stored in archives must not go beyond its limits.

Threats to data security can be divided into the following:

1. Natural (cataclysms independent of humans: fires, hurricanes, floods, lightning strikes, etc.).
2. Artificial threats, which are also divided into:
3. Unintentional (committed by people through negligence or ignorance);
4. Intentional (hacker attacks, illegal actions by competitors, employee retaliation, etc.).

• Internal (sources of threat that are within the system).
• External (sources of threat that are outside the system).

Here are the most dangerous ways to illegally access confidential information:

The negligent attitude of the company's employees towards digital data protection. The culprits may not be criminals who want to steal information, but ordinary employees. They do so due to lack of awareness or carelessness.

Deliberate DDoS attacks on company servers. Distributed-Denial-of-Service involves sending a very large number of network requests from users in the network infected with a special programme. As a result, the resource to which the attack is directed is blocked due to an overload of the communication channel. Prolonged server downtime has a negative impact on user loyalty.

Operation of malicious programmes. Computer viruses are a common threat to the security of the company's IT infrastructure. Damage caused by malicious programmes is estimated in the millions of dollars. The last 3-5 years have seen an increase in the number of malicious programmes and their attacks, as well as in the number of losses incurred by companies.

Another danger is that in addition to users' computers and servers, other elements of the network infrastructure are now being infected. Despite measures to protect internal networks against viruses, their developers are inventing new ways to download code to users' computers. For example, attachments to email, embedding in text files and sending them via Internet messengers.

Actions taken by law enforcement agencies. In the course of criminal investigations and certain types of inspections, representatives of regulatory and law enforcement authorities may seize computer equipment and documents, including those containing confidential information.

To implement data security policy, one has to take technical and organisational measures.

The main groups of tools to ensure data security are:

For this purpose, the company sets limits on the access of certain persons to data storage locations or to the territory. Remotely operated data storage systems are used, and access rights are defined by RFID, after a subject access request or other means of identification. For example, only those persons who have this right written on their card can enter the premises with servers.

These include applications and utilities that each user must be familiar with when working in the network to avoid a data breach. For example, antivirus programmes, filters for email messages.

Basic tools also include systems of logins and passwords for access to the internal network, which must be changed periodically to avoid leakage. For example, one can use a password manager, such as LastPass which manages all your passwords for you. Users only need to create an account with an email address and a secure master password to generate a unique key. It is used to decrypt the safe locally after verification. As a result, even LastPass employees do not have access to the data it contains.

It is not up to the company owning the server to secure its resources against this type of attack. It is, therefore, necessary to use external utilities. They are triggered when the system detects suspicious traffic or a sudden increase in access requests. In this case, a special programme is activated that blocks foreign traffic and saves access for legal users. The resource's operation is not disrupted in this way.

This security measure is not intended to counteract the illegal acquisition of data, but to eliminate the consequences of outside interference. Backup involves copying information to remote storage sites or the cloud. Given the low cost of carriers and cloud providers' services, any company for which the IT infrastructure is important can afford multiple data backups.

This is one of the last echelons of information infrastructure protection for the company. Every owner of the corporate network and servers must have a preconceived action plan aimed at quickly eliminating the consequences of the intervention and restoring the work of computers with servers. The plan is put in place if the network cannot operate in a standard mode or if an outside interference is detected.

The exchange of confidential information between remote users via electronic communication channels should only be carried out using utilities that support end-user encryption. This makes it possible to verify the authenticity of the transmitted data and to exclude decryption by third parties who have intercepted the message.

Measures to ensure data security at the enterprise must be continuously developed and implemented, regardless of the role of IT infrastructure in production processes.

This issue must be addressed in a comprehensive manner and with the involvement of external specialists. Only such an approach will help prevent data leakage, rather than deal with its consequences.

Given the importance of information in today's world, protection against leakage of confidential information to competitors needs to be given increased attention. The possible damage can be much greater than the value of all material assets of a company.

An additional difficulty is that the theft of information may have a negative impact on the company, not immediately after it has been committed, but after a certain period of time. The seemingly unimportant data when disclosed can cause reputational damage to the company and reduce its market value.

Therefore, when developing information security measures, data cannot be divided into types. Everything that is placed in the company's IT infrastructure and stored in archives must not go beyond its limits.