Sensitive data should be always protected whether in transit or at rest. Strong encryption ensures that the data is protected from outside eyes. For data in transit, nothing should be accepted over non-HTTPS connections. For data in storage, it is ideal to reduce the exposure in case of sensitive data by not storing what is not required anymore. Where sensitive data is required to be stored, the data should be encrypted, and the passwords should be used.

4. No storage of data on local computer or personal computer

Storing critical data on a local network comes with its fair share of risks including data loss through theft or accident, unauthorized physical access, and unauthorized virtual access. Some of the procedures to protect data from these risks include backing up your data to the cloud such as Dropbox or Google drive which are cost-effective solutions to automate data backup. Also, the data may be backed up to an alternative physical location regularly. The crucial aspect in both cases should be to test the ability to restore the data regularly. While you may protect the data stored on your local or personal computer using passwords, unfortunately, you may not be able to protect it against someone with physical access to the hard drive of the computer. One way to safeguard against this is to keep only as much information as required on the physical device because what is not available cannot be stolen. Also, implementing a Whole Disk Encryption (WDE) (viz. Bitlocker for Windows and Filevault for MacOS or Symantec for enterprise-wide solution) offers the requisite data protection, should the device fall into wrong hands. Good antivirus and anti-malware are important to safeguard against malware and virus attacks.

5. Certification- Cyber Essentials or ISO 27001

Cyber Essentials certification helps the business to achieve a baseline of cyber-security by identifying 5 fundamental technical security controls that organizations should implement. This should be implemented by all businesses or organizations as it helps defend against most internet-borne threats. It covers data, programs, computer servers and other elements in the IT infrastructure. The Cyber Essentials scheme focuses on 5 controls: secure configuration, boundary firewalls and Internet gateways, access control, patch management and malware protection.

ISO 27001. This is an international standard that provides specifications for the Information Security Management System (ISMS) which provides 114 security controls that encompass people, processes, and technology. These standards help keep the information assets secure, particularly assets such as financial information, intellectual property, employee details and information entrusted to the organisation by third parties. A certification assures the clients that the standards recommendations have been followed.

Both Cyber essentials and ISO 27001 are complementary to the effect that Cyber Essentials identifies that the basic controls are in place whereas ISO 27001 helps stress the fact that there is finesse and maturity to the controls across the business.

6. Shredding of Data on a Regular basis

Data disposal is an area that should not be overlooked because when it comes to data the adage “Out of sight, out of mind” does not apply. Data discarded in a bin is effectively open to anyone. Hence, it’s imperative that certain protocols should be followed while disposing of data. Primarily, data disposal should be done on a regular basis, data not required anymore need not be stored anymore. Data on paper formats should be shredded using a paper shredder. Data stored in electronic format should be destroyed or erased.

7. No Pen Drive etc

Storing data on a pen drive brings with it the convenience of carrying your work and being able to dive into it at a moment’s notice. For the most part, we assume that as long as the pen drive/ USB stick is with us, it’s a great plug and play option. However, one can completely overlook the cross contamination of malicious code that can spread when you plug the pen drive into an outside device that is infected with malware and then use the same pen drive on your device. The pen drive may get stolen or misplaced. Right off the bat, storing sensitive client data on pen drives must be avoided to the extent possible and if at all one has to use a flash drive, the data should be encrypted. Even then, storing sensitive data on movable storage devices comes with a very high risk.

8. Use of Citrix, RDP for employee’s login

The use of Citrix and RDP provides secure access to applications deployed on-premises, in the cloud, or delivered as SaaS. COVID-19 has also forced businesses to view virtualisation and working from home as a deep-seated reality. Citrix gives the users the same look and feel as that of a traditional desktop where users can remotely access the applications they need from wherever they are. It allows for the consolidation of traditional security products like VPN, single sign-on and browser isolation technologies with one solution. Similarly, Remote Desktop Protocol (RDP) allows users to communicate directly with the application remotely

Prev post

Outsourcing of accounting services and its rewards

Next post

Benefits of Remote Staffing for Your Accounting Practice