Data Security – SS2 Data Processing Lesson Note (Second Term)

Data security is the practice of keeping data protected from corruption and unauthorised access. Its focus is to ensure privacy while protecting personal or corporate data. It means putting in place the different forms of information security controls to protect databases against compromise of their confidentiality, integrity and availability.

Behavioural objectives

By the end of the lesson, students should be able to:

• define data security;
• describe the types of security control used on data;
• state why data security is important;
• list the major threats to data security;
• explain backups and application security as integrity controls.

How do you assess risk and secure data?

Risk assessment

A risk assessment helps you identify the risks you face and what could happen if valuable data is lost through theft, malware infection or a system crash.

Securing data

Since data can be compromised in many ways, the best security against misuse or theft combines technical measures, physical security and a well-educated staff. You should build clearly defined policies into your infrastructure and present them clearly to the staff.

What are the types of security control on data?

1. Access control: This is the selective restriction of access to a place or other resource. The act of accessing may mean consuming, entering or using. Permission to access a resource is called authorisation.
2. Auditing: Database auditing involves observing a database to be aware of the actions of database users. Database administrators and consultants often set up auditing for security purposes, for example, to ensure that those without permission to access information do not access it.
3. Authentication: This is the validation control that allows you to log into a system, an email account, a blog account and so on. Once logged in, you have various privileges until logging out. Some systems will cancel a session if your machine has been idle for a certain amount of time, so you must prove authentication again to re-enter. You can log in using multiple factors, such as a password, a smart card or even a fingerprint.
4. Encryption: This security mechanism uses mathematical schemes and algorithms to scramble data into unreadable text. It can only be decoded or decrypted by the party that possesses the associated key.
5. Backup: This is the process of making copies and archiving computer data so that it can be used to restore the original in the event of data loss.
6. Password: This is a sequence of secret characters used to enable access to a file, program, computer system or other resource.

Why is data security important?

1. Data security is critical for most businesses and even home computer users. Client information, payment information, personal files and bank account details can be hard to replace and potentially dangerous if they fall into the wrong hands.
2. Data lost due to disasters such as a flood or fire is damaging, but losing it to hackers or a malware infection can have much greater consequences.

What are the major threats to data security?

1. Accidents caused by human error or software or hardware error.
2. Hackers stealing vital information, which makes fraud easy to carry out.
3. Loss of data integrity.
4. Improper access to personal or confidential data.
5. Loss of data availability through sabotage, a virus or a worm.

What are integrity controls?

Backups

A backup is the process of copying and archiving computer data so that it can be used to restore the original after a data loss event. Backups have two distinct purposes. The primary purpose is to recover data after its loss, whether by data deletion or corruption.

The secondary purpose is to recover data from an earlier time, according to a user-defined data retention policy. This policy is typically configured within a backup application and states how long copies of data are required. Backup is one of the disaster recovery plans.

Application security

Application security is the use of software, hardware and procedural methods to protect applications from external threats.

Evaluation

1. Define data security.
2. Explain authentication and give two factors that can be used to log in.
3. What is encryption, and who can decrypt encrypted data?
4. List four major threats to data security.
5. State the two purposes of backups.

Assignment

Write short notes on access control, auditing and passwords. Then state two reasons why data security is important to a business.