Section 8.6
8 Legal Issues And Data Security
8.6 Security Of Data
Keeping data secure means protecting data from various hazards.
Deliberate Destruction Of Data
- Disgruntled employees
- Terrorists acts
- Hackers gaining access
Accidental Data Destruction
- Hardware failure
- Program failure
- Operator error
Environmental Hazards
- Fires
- Floods
- Power Surges
- Hurricanes
- Earthqaukes
8.6.1 Backup
There are four main methods of backing-up data.
Periodic Backup
Backups are made regularly and kept in a safe place. This is the least
satisfactory method.
File Generations
Grandfather, and son files can be stored along with their respective
transactions. This method is only used with sequential file processing.
Incremental Dumping
During a user's work session all the updated files are marked. When the user
logs out these files are copied or 'dumped' to another disk.
Transaction Logging
Every updating transaction/operation on a master file is recorded in a separate
transaction log.
8.6.2 Recovery
Recovery procedures are established so that an organisation may be able to
continue operating in the case of hardware of data loss.
Disaster Planning
There is a contigency plan that comes into action when an organisations data is
used.
A separate site with offices, computers and an up-to-date copy of the
organisations data is used.
Bypass Procedures
Bypass procedures are invoked if the central computer in an on-line system
fails. Intelligent terminals with their own backing store can record transactions
temporarily until the main computer is back on-line.
8.6.3 Malicious Damage
Data security is threatened by both hackers from outside and employees within a
company.
Such people may be trying to defraud the company or just be disgruntled.
Steps to Counteract Threats
- Use password protection (may be on encrypted files).
- Immediately remove access rights for employees who leave the
company.
- Vet prospective employees.
- Restrict access to certain rooms or secure areas.
- Educate staff watch out for security breaches.
- Separate staff duties.
- Appoint a security manager.
8.6.4 Password Protection
Usernames and passwords are usually stored in a table. The table is
permanently stored in a file on a disk.
Password tables are often stored with authorisation tables that contain a user's
rights to other files.
Passwords tables should be 'irreversibly' encrypted to prevent their contents
from been read.
8.6.5 Data Encryption
In cryptography a message is converted from plain text to ciphertext.
The encrypted message is sent along a communications link and the receiving
computer decrypts the message.
Transition Cyphers
The characters of a message are rearranged in some way.
Example
"MEET_ME_TONIGHT_AT_8"
could be written, row by row, in a five character wide grid:
MEET_
ME_TO
NIGHT
_AT_8
The grid is then read column by column and sent out as:
"MMN_EEIAE_GTTTH__OT8"
Substitution Ciphers
Each character is replaced by another character.
Example
Decode: "X2MM F4P2"
where A E I O U > 1 2 3 4 5 and consanants > next consanant in alphabet.
gives:
"WELL DONE"
8.6.6 Other Security Measures
Other than passwords, an authorised user can be identified by:
- Iris recognition
- Fingerprint recognition
- Voice recognition
- Face recognition
