Security

Abstract

Data is one of organisations most important assets, therefore steps need to be taken to protect it. Security generally has three aspects to it: physical security, software security and procedures. With physical security the main issue is how to protect the servers and infrastructure from damage or loss. This may range from a catastrophic event affecting the data centre through to someone stealing the actual server. It also includes how to recover operations if there is a major incident. A more recent physical security threat has emerged from the increase in use of mobile devices. Loss and theft of these devices which may contain sensitive information or have the ability to automatically connect to sensitive systems has been a growing problem for some time. Software security is the more important security consideration on a day to day basis. Many databases have internet access to them, although this is usually through another server. It is however where most threats come from. Keeping virus checking and firewall software up to date will prevent most external attacks but internal abuse of user privileges also needs to be considered. The final aspect is the procedures which are in place. These will also have an impact on how physical and software security is implemented and maintained. Questions to ask are what procedures are in place, are they adequate and how are these audited. A major component of this is a risk register which needs to be regularly updated and reviewed.