Challenges and Solutions to Applying Politics and Regulations in physical security
Information security issues have been subconsciously divided into two groups. More emphasis has been placed on the more dramatic and technical issues like hacking, use of spyware, Trojans and viruses. Physical security on the other hand has been trivialized despite the ease with which it can be carried out. Physical security entails the protection of programs, data, hardware, networks and personnel from physical events or circumstances that may lead to damage or loss to an organization or person (Rouse, 2005). This events and circumstances may include terrorism, burglary, fire, theft or natural disasters. For example, little technical knowledge is needed for a person to steal an external disk containing any amount of information. This therefore means that physical security should be of equal concern as others in information security.
In 2006, personal data of U.S. military veterans was stolen (Reuters, 2006). This information had been improperly taken home by a data analyst from the residence of a Department of Veterans Affairs. The information entailed the names, social security numbers and the birth details of the veterans. It was unclear how the data was meant to be used but authorities speculated that it could have been meant for identity theft. The culpable employee was placed on administrative leave and a full investigation launched into the matter.
The first issue of determination was whether this instance was a random burglary or whether it was politically motivated. The rules and regulations for the department clearly stated that no data regarding personal information or other sensitive information was meant to be taken away from the business premises unless through secure avenues. This means that information in the department was so important that any unsecured transmission or transportation would result in a breach of the rules and regulations. Private information for veterans contained in those stolen files was security guaranteed. When people surrender such information, the government has an obligation to keep it private and not breach this trust. This action by the employee therefore went against the privacy rights of the veterans not only endangering them but also exposing the department to liability.
The security of sensitive data is of utmost importance. The Department of Veteran Affairs requires that the physical security of electronic and physical restricted data be guaranteed wherever it is. The basic regulations require all workstations to be locked down, all files, areas and portable equipment be secured before being left unattended, papers and all other electronic devices always be in the regulated areas and never taken home or left unattended in a public area, and all printing and storage devices be secured at all times.
All sensitive information no longer required should be shredded or safely deleted. The information regarding veterans should not have been on the computer taken home by the employee. There is a secure database at the place of work from where all pertinent information required can be accessed at all times. There is a strict policy about duplication of materials that increases the chance of unauthorized access by third parties. The employee should have securely deleted personal identity information and all other restricted data before taking the laptop home. The regulations indicate that negligence and disregard of rules and procedures leading to loss of data should be reported to authorities so that they can properly deal with it.
References
Reuters, (2006). U.S. Says Personal Data on Millions of Veterans Stolen. The Washington Post. Retrieved January 14, 2014 from http://www.washingtonpost.com/wp-dyn/content/article/2006/05/22/AR2006052200690.html
Rouse, M. (2005). Physical Security. Retrieved January 14, 2014 from http://searchsecurity.techtarget.com/definition/physical-security
Use the order calculator below and get started! Contact our live support team for any assistance or inquiry.
[order_calculator]