Scribd
Upload
28 views

Module 7

Uploaded by

kishan.aditya2021
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
28 views

Module 7

Uploaded by

kishan.aditya2021
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 19

 Data is any type of stored digital information

 Every company needs places to store institutional


knowledge and data.

 Frequently that data contains proprietary information


 Personally Identifiable Data
 Employee HR Data
 Financial Data

 The security and confidentiality of this data is of critical


importance.
 Data needs to be available at all necessary times

 Data needs to be available to only the appropriate users

 Need to be able to track who has access to and who has


accessed what data
 Security is about the protection of assets.
 Prevention: measures taken to protect your assets from
being damaged.
 Detection: measures taken to allow you to detect when
an asset has been damaged, how it was damaged and
who damaged it.
 Reaction: measures that allow you to recover your
assets.
Security Policy
A security policy is a comprehensive document that
defines a companies’ methods for prevention,
detection, reaction, classification, accountability of
data security practices and enforcement methods.
 It generally follows industry best practices as
defined by ISO 17799,27001-02, PCI, ITIL, SAS-70,
HIPPA , SOX or a mix of them.
 The security policy is the key document in effective security
practices.

 Once it has been defined it must be implemented and modified


and include any exceptions that may need to be in place for
business continuity.

 All users need to be trained on these best practices with


continuing education at regular intervals.
 Data needs to be classified in the security policy according to
its sensitivity.
 Once this has taken place, the most sensitive data has extra
measures in place to safeguard and ensure its integrity and
availability.
 All access to this sensitive data must be logged.
 Secure data is usually isolated from other stored data.
 Controlling physical access to the data center or area where
the data is stored.

 Active or Open Directory is a centralized authentication


management system that is available to companies to control
and log access to any data on the system.

 Encryption of the sensitive data is critical before transmission


across public networks
 The use of firewalls on all publicly facing WAN connections.
 Deploying VLANs’ and ACLs’ to isolate sensitive departments
from the rest of the network.
 Shutting down unused switch ports.

 If wireless is deployed, use authentication servers to verify and


log the identity of those logging on.

 Anti-Virus and malicious software protection on all systems.


 There are four key issues in the security of databases just as with
all security systems

 Availability
 Authenticity
 Integrity
 Confidentiality
 Data needs to be available at all necessary times

 Data needs to be available to only the appropriate


users

 Need to be able to track who has access to and who has


accessed what data
 Need to ensure that the data has been edited by an authorized
source
 Need to confirm that users accessing the system are who they
say they are

 Need to verify that all report requests are from authorized users

 Need to verify that any outbound data is going to the expected


receiver
 Need to verify that any external data has the correct
formatting and other metadata
 Need to verify that all input data is accurate and verifiable
 Need to ensure that data is following the correct work
flow rules for your institution/corporation
 Need to be able to report on all data changes and who
authored them to ensure compliance with corporate rules
and privacy laws.
 Need to ensure that confidential data is only
available to correct people
 Need to ensure that entire database is security from
external and internal system breaches
 Need to provide for reporting on who has accessed what
data and what they have done with it
 Mission critical and Legal sensitive data must be highly
security at the potential risk of lost business and
litigation

You might also like