Threats to data
Introduction
In the 21st century, information itself is a highly valuable commodity, and has time has passed and continues to doe so its value will continue to go up as our world becomes more and more reliant on Information Communication Technology. This change can be seen as very good and helpful but at recent times the threat towards our information has become a hindrance, almost a barrier in our everyday lives. In fact you will be very surprised at the length some people will go to get personal information about others. The majority of organisations hold personal information about others either legally or illegally these are also known as data controllers.
Threats to data can come from both inside an organisation as well as outside and a company must invest in protection from both of these sources of threats. Data is too valuable to the company to risk losing it!
There are many threats to data and can come in different forms based on the medium in which the data is stored. Data stored electronically and over an online transaction can be damaged by potential threats
Potential threats to data:
? Data interception
? Unauthorised access to stored data (Internal/external)
? The integrity of information
? Accidental loss or damage
? Physical threats
Data interception
Data interception describes the process in which data can be accessed through the internet by gaining access to something called an ISP, all data that travels through the internet is directed and routed through ISP's, so this is an obvious option for unauthorised collection of data.
Unauthorised access to stored data
Where a company hires people to sort and manage customer data, it is possible employees could have agendas to make money by collecting private customer data such as email addresses or phone numbers to be sold to third parties that require such data.
The integrity of information
If the language or method data is presented, it can be wrongly read therefore wrongly recorded; this can result in a distortion of data. Integrity of data also
describes the validity of information; data could be erroneous or outdated resulting in incorrect information.
Accidental loss of data
This describes the act accidentally deleting data; this can also happen where information has failed to be saved or backed up.
Physical threats
Physical threats can cover a wide range of possible actions. In the event of a flood the medium the data is stored can be water damaged, the same applies to other events like fire or damage caused by dropping or compression.
Threats from Inside an Organisation
Information is valuable and information you have given to a transactional web-site can be of value to a third party for various reasons. For instance other companies could want your address so they could send you junk mail, they may want your telephone number so they can ring you up and try to sell you something or your e-mail address so they can send you spam.
A large organisation will employ many people and it cannot be sure that they are all honest. The data held gives the less honest members of staff an opportunity to make some money on the side and the company will have to protect itself from the inside as well as the outside.
Often overlooked is the threat to data from accidental damage and acts of God. The organisation cannot function without this data so it is important that it is not lost or damaged. Information may be accidentally deleted or simply entered wrongly or there could be a fire or some other natural disaster.
A transactional website organisation needs to take as many steps as it can to counteract these threats not only to protect its business but also to build up confidence so that people will use their site.
Threats from outside the Organisation
Threats from outside the organisation tend to be mainly from hackers. These are people who try to get into someone else's computer.
There are four major types of hackers:
The first type of hacker do it mainly to show people that they can and do not really mean any harm and have no intention of using the information they gain. Unfortunately they may not be as clever as they think and may accidentally do damage.
The second group of hackers try to access machines simply to cause damage. It is a form of vandalism. This could be a serious problem for a transactional website as the server the website is uploaded onto can be badly damaged stopping all ...
This is a preview of the whole essay
There are four major types of hackers:
The first type of hacker do it mainly to show people that they can and do not really mean any harm and have no intention of using the information they gain. Unfortunately they may not be as clever as they think and may accidentally do damage.
The second group of hackers try to access machines simply to cause damage. It is a form of vandalism. This could be a serious problem for a transactional website as the server the website is uploaded onto can be badly damaged stopping all traffic to the site, if the location of customers' data is also damaged by these type of hackers, customers details can be damaged or lost, or just as easily stolen and used for I.D fraud. Overall and adverse situations or damages that can occur happen to customers' data can cause a transactional website, to loose control over the management of every aspect of the business at the controlling end.
The third group of hackers try to get into the machine simply to gain information, even though they have no intention of using the information. They are just being nosey. There are two dangers here, you do not necessarily want strangers knowing this information and if they find out something which they could use in some way, such as getting money, they may be tempted to use it.
The final group are probably the most dangerous group as they hack with the intention of using the information in an illegal way. Probably the most common crime would be identity theft. A transactional website needs enough information to take money legally out of your account. This same information in someone else's hands could be used to take money out of your account without you knowing about it.
If you add to this the possibility of catching viruses and Trojans from e-mails and the likelihood of spy ware getting onto your machines the threats from outside are large and considerable.
Different hackers are colour coded for the purposes they hack. Blue hat hackers hack commercially to test the security of a site or database.
Preventative measures
In order to effectively remove threat to customer data, there must be a thorough analysis of all possible threats, no matter how big or small
A transactional website should perform a risk assessment. This will help them understand what exactly threatens their operation. Usually this consists of specialists identifying what the actual risks are and the probable outcome if a worst case scenario were to occur.
Methods to protect customers' data.
Physical Protection
There are two major issues when talking about physical protection, protection against damage to the data itself and also restriction of access to the data.
Many things can happen to data from accidentally deleting it to a hacker signing on to your machine and deliberately deleting or changing something. Add to this the possibility of machine failure or fire then there must be a way of reloading data if the worst happens. Regular backups should be taken and preferably stored in another area in case something like a fire not only destroyed the machines but the backups as well. A backup is a copy of the data held on some form of removable media such as an external hard drive.
Many businesses with transactional websites use professional website designers and programmers to produce and host their sites. In these cases, sites are fully backed up onto another server, often in a different location, so that if there is a problem, there is minimal disruption to the business.
On its own a backup can only restore the data to the point where the backup was taken and any transaction since that time could be lost. Another method must be used to keep track of transactions which occur after the last backup. Perhaps printing paper copies of each transaction would help but these would probably be the first things destroyed in a fire or a flood. This is why sensitive items like external backups and documents within a business or company is kept on the top floors if possible, this would meant that in the event of a flood or fire there will be less of a chance these events can effect the data.
The section aspect of physical protection is restriction of access to data. For example if you are holding sensitive data it makes sense to restrict the access to it to
those people who need it to do their job. This not only reduces the number of opportunities for someone to use the data illegally but reduces the number of suspects should the worse happen. It makes sense therefore to restrict the access to the machines holding the data to those people who need it to do their jobs. This would mean a secured area with access provided by a lock. The sophistication of the key would depend really of the perceived value of the information held. Full biometric locks involving retina scans or DNA analysis may be a little over the top for a transactional website whose restricted area would probably be protected by a key pad with a regularly changed code. However, fingerprint locks are now relatively cheap and are becoming more common.
User ID's and Access rights
Most computers, especially networked computers, provide you with the ability to use access rights. The basic idea of access rights is to only allow access to data to those people who need it. Different people would therefore be allowed to access different bits of data depending on their job. In order to do this then each person must be
identified by the computer system. This is done by assigning a user ID to each person and using this to say which bits of data they can have access to. No one is allowed to sign on to a computer system unless they provide a valid user ID. Of course as long as they provide a valid user ID the computer doesn't actually know that it is that person signing on so most systems require you to provide a secret password as well.
Encryption
Data is stored on a computer using a series of zeroes and ones called binary. These are organised into groups and codes, for example ASCII, are used to store numbers and letters. These codes are well known so if a hacker gets to look at your data then it is fairly easy to find out what it says. If encryption is applied then the data stored is scrambled by an algorithm (a series of instructions and calculations) so that what is stored looks like gibberish. If a hacker then gets at your data he would find it difficult, under these circumstances, to translate it. When the data is retrieved a reverse algorithm is used to make it make sense again. Most encryption algorithms are based on a key, a secret number which must be supplied along with the algorithm. This means a hacker would not only need to know the algorithm but also the key before he could translate the data. The key is a series of zeroes and ones known as bits. The more bits you have for your key the more difficult it is to know which one you are using.
Secure Electronic Transfer (SET)
When you browse a transactional web site you are not at that time providing any sensitive data. It is only when you go to buy something that you really need the protection. Good sites will direct you into their secure socket layer (SSL) where your data is protected by Secure Electronic Transfer protocol (SET). You will know this because a lock will appear on your status bar. This protocol was developed by Visa and MasterCard with the help of some major computer companies including IBM. SET is a set of rules by which transactions are governed and the rules of this
protocol include two encryption methods being applied to transmitted data. SET also includes the use of digital certificates. This is issued by a certification authority and effectively tells you that you are dealing with who you think you are. When you supply your credit card number to a secure site using the site actually only sees an encrypted form of it which is decrypted when sent with details of your purchase to the Credit Card Company. This not only protects this data from hackers but also provides protection against fraud within the company.
Firewalls
A firewall is a software utility which sits between your computer network and the internet monitoring what comes in and what goes out. It filters out any traffic which it doesn't like. Generally it will allow access from sources it knows but if it doesn't recognise a source, like a hacker, it will ask whether to want to block it or not. This will apply to traffic going out of your system as well so it provides some protection against spy ware. Well known firewalls like Norton are extremely good at identifying unfriendly access and provide a great deal of protection. It will recognise dangerous threats but it sometimes depends on you to set what is friendly and what is unfriendly. It is possible to allow access to something dangerous because you don't know what it is. To be on the safe side if you don't know what it is block it.
Virus & Spy ware protection
Virus protection software is a utility which you can use to scan all your files and programs looking for known viruses. Virus checkers can be scheduled to run automatically such as once a week and can be set to automatically check removable media and incoming e-mails. It has a database of known viruses which tells it how to recognise them and once it finds them it can either delete or repair the files concerned if it can. If it cannot it will put the file into quarantine where the virus can do no harm. Running without a virus checker is unthinkable because the effects of viruses can be devastating but they do have their drawbacks and limitations. Viruses are being written all the time and your virus
checker will only find those it knows about. As each virus is discovered the database is updated by the provider. The user therefore has to update regularly which he can do over the internet automatically at a cost. Even then you might be unlucky enough to catch a brand new one.
There is similar software to recognise and delete spy ware which works in much the same manor. A transactional web site would need both of these to protect itself.
Example of a firewall detecting a virus and notifying the user
Legislation
The law provides protection from threats to data
The Data Protection Act 1998 this piece of legislation is used primarily to protect an individual's right to privacy. Within the DPA are eight principles that must transactional websites must adhere to. Personal information must be:
. Fairly and lawfully processed.
For the processing of personal data to be fair, transactional site must collect their information directly from customers and always ensure that these individuals are aware of any other information needed to ensure fairness, taking into account the specific circumstances of the processing. This will include informing individuals of any disclosure of information about them to third parties, even including disclosure to any companies that are related business partners of transactional websites.
2. Processed for specified purposes
Unless it is obvious, transactional website must give information to individuals about the purposes for which they intend to process the personal data before they collect any data from them.
3. Adequate, relevant and not excessive.
Where information is to be used or disclosed for direct marketing purposes, transactional website should be provide individuals with the opportunity to prevent this. This will give their customers more choice in deciding what is or what isn't excessive use.
4. Accurate and, where necessary, kept up to date.
All users must be able to access the information held about them quickly and be able to change any detail successfully. Transactional website grants their customers the ability to do this securely in the 'customer's account' section of their website.
5. Kept for no longer than necessary.
Transactional websites must not hold on to any personal information about former customers if they no longer make use of their website. These records should be deleted.
6. Processed in line with the rights of the individual.
Each individual customer of transactional website has the right to privacy, and all data has to be processed with this principle in mind.
7. Kept secure.
Transactional website's "Consumer Terms of Sale" clearly states the following under 'Data Protection': "The Supplier will take all reasonable precautions to keep the details of your order and payment secure but unless the Supplier is negligent, the Supplier will not be liable for unauthorised access to information supplied by you."
8. Not transferred to countries outside the European Economic Area unless there is adequate protection for the information.
It should also be borne in mind that there may be more than one data controller involved in the collection of personal data transactional website's website, particularly where banner advertising is placed by a third party, or where a third party provides a secure payment mechanism. In such cases all data controllers should be identified and transactional website must make sure that all of them are located within the EEA.
The Computer Misuse Act
This became law in 1990 to combat the growing problem of hackers. There are three levels of offence which are.
) Unauthorised access to computer material
This is the lowest level offence and covers finding or guessing someone's password and gaining access to their files just to look at the data it contains. Even if no damage is done this is considered an offence and can carry the penalty of up to 6 months in prison or a fine or both.
2) Unauthorised access with intent to commit or facilitate commission of further offences
This builds on the previous offence in that the information gained by the unauthorised access to someone else's data is used to commit a further offence. Maybe using their details to access a service you would not normally be available to you. The penalty for this is up to 5 years imprisonment or a fine.
3) Unauthorised modification of computer material
This part of the act covers viruses and the deleting or altering of files with intent to impair the operation of the computer. Accidental deletion or corruption of files is not covered by this part of the act and again the penalty is five years imprisonment or a fine.
The effectiveness of this act is questionable. If a hacker is prosecuted under the act then that may be one less hacker and it may be that it provides a warning to others. Unfortunately there are lots of hackers and a hacker can only be prosecuted after they have done the damage which is of little comfort to the victim. Also to prosecute a hacker you have to find them and although the source can often be traced via an IP address it can be difficult to pinpoint if the path is complicated. Also hackers could use internet cafes to do their damage making them more difficult to trace or they could be in a foreign country which doesn't cooperate with our police.
The act is useful in that it makes misuse of computers illegal but there are many hackers and virus writers but few prosecutions.
Source:
www.HMSO.gov.uk
