| 27.21. Privacy and Security: | | 1. Privacy is about keeping certain personal data private and confidential. Sensitive private data like Ethnicity needs even more security to keep it private. Every company must have a Data Protection Officer who manages the Privacy Policy and Data Protection Impact Assessment. | | 2. Security is a technique or method to make data private and confidential. Encryption is the base security method that provides privacy. Every company must have an Information Security Officer who manages the Security Policy. |
| Ownership: | | 1. People own personal data about themselves and control who and how that data may be used by others. A company with a HR payroll does not own all that data - some of the data is personal and is owned by the person that is identified by the data. Any data that directly or indirectly identifies a person is personal data and personal data is always owned by the subject of that data. A company can own any business data that is not about a specific person. | | 2. A person may freely volunteer to share some of their personal data with others in return for a service or other benefit. When data is sacrificed with others it is done so for one specific documented purpose and the data must not be used for any other purpose. When I withhold information its privacy, but when you withhold information its secrecy. |
| Eliza: | | 1. Eliza is your Information Security Officer who manages all aspects of information security (excluding physical and other kinds of security). Eliza has detailed CISSP knowledge and is the only way that encrypted data can be decrypted for an approved person. | | 2. Eliza is your Data Protection Officer who managers data protection in compliance with General Data Protection Directive. Eliza has detailed GDPR knowledge and is the only way that an approved person may sign-in. |
| Replicated Business Data: | | 1. Business Continuity is provided by replicating business data to a large number of security data centers that house the Internet backbone. In the event that one data center is not available for any reason, business services continue to be provided by other data centers. It is not likely that all secure data centers will all become not available at the same time. | | 2. Eliza is the sole decision maker each time a field value is changed by an approved person. The new field value is encrypted according to methods that are only known to Eliza. The field value is checked against the existing field value, if they are the same, "no change" is shown to the approved person. When the field value is different, the original record is stored so the field value can be restored if needed. The new field value is then sent to the primary data store and its primary evidence trail - the evidence trail then sends copies to other data stores in other data centers. | | 3. Backups have been eliminated, all data is replicated to a swarm of places for on-line use. Field values are encrypted before they are sent to the data stores and evidence trails. All data stores are also encrypted with unique master keys. |
| Data Protection: | | 1. Every data breach must be reported to the UK Information Commissioner Office - this is likely to result in a fine. A fine may be avoided where clear evidence exists that every reasonable security precaution that is possible was correctly implemented and adequate training was provided. | | 2. Encrypted personal data that is just a jumble of unreadable codes cannot be the subject of a data breach - the data is meaningless and may not be personal data. | | 3. If a person can access a backup file and read personal data that they should not be able to read because it was not provided for that purpose, then that is a reportable data breach. By eliminating backup files, then a system administrator cannot read personal data that would be a data breach. |
| Espoinage: | | 1. Many countries have a private army of highly qualified engineers who have a full time challenge of silently stealing the secrets of companies. Business data, especially in emails is being copied every day and assembled into big data stores. While each message may only contain a fragment of business information, given time, lots of fragments assemble into a complete picture of how the company does business. | | 2. Criminals are one step behind state sponsored agents in the gathering of data flowing over the public Internet. Criminals collate masses of data and then sell that data is "sales leads" to unwitting companies. Where a sales manager needs to exceed target, they may be willing to buy a copy of a competitors customer database. Where a design manager needs new ideas, they may be willing to buy a copy of a competitors design plans. It will always be cheaper and faster to copy a competitors proven design than do original research and development. | | 3. Email is the primary data leak - people imagine what they say in an email is trivial, but years of such emails can be collated into valuable information. Attachments are a fantastic source of valuable data - massive data sets that are already collated. Backups are simple files with great value - criminals love to get hold of a backup because it is so easy to sell the contents. Short single word passwords are easy to bypass using online tools that can try 20,000 possible words every hour - negligible cost to the criminal. Start at 6pm to login as an Executive and by 6am, 240,000 possible passwords will have been automatically tried. Start at Friday evening and by Monday morning, 1.5 million possible passwords will have been automatically tried. Silently, by the end of the month, the Executives password will have been guessed and data copied to be sold to others. Where a company has 100 employees, then 100 attacks can be automated every evening until one lucky guess will be right. | | 4. Password protected documents give a false appearance of security. In many cases, the internal contents of the file can be examined using special tools that take no notice of the password. In other cases, an automated tool can be set to try every possible word and simple variation from dictionary. Automated guessing rates of 80,000 passwords per hour have been seen - its just a matter of time before the data is made readable. |
| | | Security: | | Many levels of security are provided to include:- | | 1. Communicated data using the public Internet is encrypted using HTTPS methods. | | 2. Stored data using database management is encrypted using public-private key methods. | | 3. Field values are encrypted using millions of methods that ensure that a data breach cannot happen. | | 4. Evidence trails are encrypted so a criminal cannot read personal information inside log files. | | 5. Backup files have been eliminated so that cannot become a personal data breach. |
| Cyber Insurance: | | 1. The simple security steps deployed above mean that a data breach cannot happen and so cyber insurance risks are reduced towards zero. Where the reputation of a company could be destroyed by a personal data breach, then these security methods are classified as mandatory by shareholders. |
| Privacy: | | 1. Privacy begins with a very powerful multi-factor authentication service that can identify approved people and can stop criminal behaviour. Privacy begins with Eliza monitoring every sign-in procedure and building a behaviour profile for all the good people. Each approved person is granted both data and functional access rights - what data they can view and what functions they can use. Privacy rights are fine tuned by dual access right combinations that makes it practical to detect criminal behaviour. | | 2. Dual interlocking read-only evidence trails are maintained by Eliza so people can see what they have done and every field that is changed can be identified with a unique person, date, time and original data value. The history of every field value change enables a mistake to be simply reversed to the original field value. | | 3. Privacy is created by making certain that only approved people can access personal data and every time any data is accessed, a full and detailed evidence trail is created. The time honoured reason as "the computer made the change" has been eliminated with open and transparent evidence trails. |
| Personal Data: | | Personal data is encrypted using many methods that include:- | | 1. Key encryption such as MD5, SHA, DES, AES and many variations of published methods. | | 2. Tokenization with field values replaced by a unique token that cannot be reversed. Data such as Gender is tokenized because key encryption results could be guess at by simple statistical analysis. | | 3. Fragmentation of a field into parts that are separately encrypted using different methods. This means that if one part is decrypted the other parts remain encrypted and secret. | | 4. Scrambling of an encrypted result makes it hard for a criminal to guess where to begin. |
| System Administrators: | | 1. Administrators and their families must be protected from a criminal threat to hand over their password or hand over copies of data. Administrators are advised to fully comply with any criminals wishes to reduce the threat. They should give up their password in the certain knowledge that Eliza will prevent the criminal from using that password because many other factors are involved. Administrators are not granted rights to view personal business data as part of the application service. They can provide copies of any data to the criminal wants in the certain knowledge that all personal data is encrypted and valueless to the criminal. Administrators have access to the many millions of personal field level encryption keys, but have no idea of which key works with which record. At least three administrators working together have access to communication and data store keys, but this by itself is not a data breach. |
| Block Chain: | | 1. Block chain is a security method used by Bit Coins to enable data to be moved rather than copied. In computer terms, it is very hard to move data from one owner to another without the original owner still keeping an identical copy. With money, it is very easy to move coins from one owner to another without the original owner being able to keep the coins. | | 2. Block chain will have a disruptive impact on banks as very expensive settlement systems are eliminated for very cheap block chain money transfer. Block chain will change how things are bought and sold, house deeds will be block chain transfered between owners. Car ownership documents will be block chain transfered in seconds between owners without any expensive central clearing house. |
|