Private vs. public sector IT security: more dedicated staff, yet less awareness

According to recent data, the private sector lags behind with regards to data protection, while public sector organisations lead the way. David Cowan explains how firms can improve their IT security and avoid losing money, clients and reputation.

 

A recent survey commissioned by the Information Commissioner’s Office (ICO) revealed that there is a remarkable difference between the public and private sector’s approach to Information Security. The data contained in the research carried out by Social and Market Strategic Research (SMSR) showed that, in fact, the public sector was much more aware of the Data Protection Act principles compared to the private sector.

When asked to identify, unprompted, the main principles contained in the ACT, the 7^th Principle ‘Personal information is kept secure’ was mentioned by 60% of public sector organisations, compared to only 48% of private firms. However, a more shocking divide can be found in the awareness of the Information Commissioner’s Office’s existence: 42% of private firms had not heard about it at all, a percentage that actually increased from the previous years – yet this was not the case for public organisations, where only 3% were not aware of the UK’s independent authority set up to uphold information rights in the public interest.

A lack of awareness, however, does not prevent the majority of private sector firms from having more than 10 members of staff dedicated to information security-related duties, compared to an average of 2 in public sector organisations. Quantity is not directly proportional to quality, it seems.

In reality, the public sector has had more reasons to be more data protection-savvy due to handling large volumes of personal and sensitive data. The private sector should start following their example. Regulations have become stricter and ICO fines are tougher, with the authority now able to impose a fine of up to £500,000 for a serious breach. It is important, then, that all firms improve their awareness of information security and that they have an efficient system in place for protecting personal and sensitive information, and to deal with any breach in the most appropriate manner.

Private organisations which deal with sensitive and confidential data – such as banks and law firms – should take these results as a wake-up call and an opportunity to learn from the public sector. They are in fact the most at risk of suffering major consequences in case of a breach of the DPA.

Critically, it is important to understand the steps for improving Information Security. First of all, it is vital that organisations are aware of their information assets and the associated risks. They can do this by conducting an assessment of their Information Security Management System, in particular the controls surrounding the information assets of the organisation. This can then be assessed against the international standard for Information Security ISO 27001, to identify any weak points, possible corrective actions and areas of risk.

Once these have been identified, it is possible to plan remedial work which covers policies, procedures and technology, as well as staff education and awareness, implementing it on a continuous cycle. It is important to note that documents and technology alone are not enough to guarantee an improvement; however, they can minimise information security risks.

Staff commitment, from senior management to the most junior employees, is the key to make all the controls and procedures work. If staff are not made aware of policies and procedures introduced, or are not willing to collaborate, perhaps because they do not understand why they should change the way they have always worked, then no amount of technology can keep an organisation in line with the appropriate standards and regulations.

At the same time, management need to take strong ownership and underline the importance of data protection with a clear Information Security statement; their strategy should include disciplinary actions for whoever does not adhere to the policies. Investing time and effort in prevention will pay off more than insurance, as the latter may reduce some of the damages although not the most important cost – the organisation’s reputation.

It is undeniable that although data security risks can be minimised, they cannot be completely eliminated – there will always be a human or technical error that results in sensitive data being lost, destroyed or disclosed. This, unfortunately, can happen in both the public and private sector, often even when all the appropriate measures are in place. For that, you can only act accordingly to the associated risks, for instance by allowing data to protect itself not only through encryption, but through the implementation of a data classification system that restricts access to unauthorised viewers.

Information Security is not a final destination; instead, it is a never-ending journey where everyone from senior management to service desk engineers commits to an ethos in order to protect personal information from loss, leakage and theft in a manner which is proportional to the identified risks.

 

David Cowan, Head of Consulting Services

This article is published on Infosecurity UK: http://www.infosecurity-magazine.com/view/16319/comment-public-vs-private-sector-information-security/

Is information safe enough at NHS trusts?

It looks like NHS trusts are starting to realise that Information Security is not just a matter of using complex passwords, locking drawers at the end of the day and installing the latest firewall and antivirus solutions. The Information Commissioner has been particularly critical of the NHS in the past due to a high proportion of security breaches as a result of inadequate Information Security controls and staff awareness programmes.

The result has been an NHS wide initiative to ensure all removable media including laptops and USB drives are encrypted. However, this may not be enough. As reported by the BBC recently, a remarkable amount of non-medical personnel at UK trusts have access to patient records including recent medical history – at least 100,000 including porters, hospital domestics and IT staff, a Big Brother Watch survey stated.

It seems like the risk is not only from staff at off-shore service providers collecting and selling British data to make a few extra pounds, as reported on ITV not long ago. It also comes from internal personnel who have the potential to access extremely sensitive data without the appropriate authority or preventative controls.

 This is not surprising: data collected in the BIS Information Security Breaches Survey 2009 illustrated that 60 per cent of all companies suffered a security breach in the previous two years and of these, 50 per cent were perpetrated by staff, often premeditated or malicious but in many cases simply a matter of a stolen laptop or lost removal media device.

There is an obvious need for greater awareness of information security regulations across the entire organisation, and measures must be taken to protect personal and sensitive data. Management in particular need to be involved in order to avoid resentment, complacency and to ensure everyone takes the matter seriously.

In the case of the NHS, information at risk is highly sensitive and breaches can have very serious outcomes. Consequences of Data Protection Act breaches are not confined to costly fines and a few employees being fired – it is the organisation’s reputation that suffers the most.

This risk can be mitigated by conducting an independent gap analysis and security review which would assess compliance with Information Security best practice, i.e. ISO27001, IG Toolkit v7, and certify that information held within an organisation is secure, reducing the risk of incidents and the cost to the business.

Equally important are staff awareness sessions to which not only general staff but executive participation is required, which is vital in creating a culture where Information Security is part of the organisation’s DNA.

 

David Cowan, Head of Infrastructure and Security