November 2008

How Safe Is Your Clients Information?

How do you decide what is at risk, who it may be at risk from and how much risk is there? Your network is obvious but what about your trash can, or those unlocked filing cabinets full of personal client information. What about the cleaning staff? Did you carry out an in depth background security check before hiring them? Unless it’s a blank piece of paper, lock it away or put it in a locked recycle bin as soon as you are done with it: but are those bins shredded on site or are they taken away to be shredded later? If they are taken away, what steps are taken to ensure that all of the papers are shredded without anyone gaining access to them? These are just a handful of questions that you should know the answer to if you are going to keep your clients information safe.

What do you do once you have figured out what the risks may be?

Once you have figured out what information may be at risk you then need to analyze how you can protect it. You should have a written set of procedures that clearly details how you keep client information that you send and receive safe.

Where is the sensitive data stored? How is it sent/received? Who has access?

Confidential information containing social security numbers and credit card details may arrive via regular mail or by courier as well as through email, what happens to this when it arrives? Do you log it in and move it to a back room immediately or is it simply put in a pile at the reception desk were it can easily be removed without anyone's knowledge? What about when you have outgoing mail containing confidential information is it kept in a secure area or again left at the reception desk? Who has access to the rooms that contain sensitive information? Do you have segregation of duties so that no one person is able to access everything? Outsourcing is becoming increasingly cost effective today but will it save you money in the end if your clients information is breached. You should do a thorough background check on any company that you plan to hire, and investigate their information security policies to ensure that they are in line with your own.

Do you really need to keep all of this information?

Decide what you really need to keep. If you are required to keep certain information for an extended period by law, then create a written records retention policy and adhere to it. You should never use social security numbers for referencing customers, and credit card information should not be retained unless absolutely necessary. Review your data gathering forms is it necessary to have all of the information that you are asking for. Check your software to ensure that is not saving credit card information unnecessarily. If your system is set to the original defaults it will make it even easier for someone to take your information.

Lock it up!

Many security breaches happen through lost or stolen documents so you should do everything in your power to protect these. You should train employees to report any suspicious activity, and control access to your offices. A clean desk policy that is strictly enforced will go a long way in keeping prying eyes from viewing sensitive material. However if the documents are placed in an unlocked drawer. it will not be as successful. You should take extra precautions with laptops, as they pose an even bigger risk than regular desktop computers. Consider installing an “auto destroy” function that will automatically destroy all information on the laptop if it is stolen. It may also be a better idea to have files stored on a secure central computer instead of on the laptop, and again restrict access to these.

Destroy It!

Any information that is not required should be destroyed immediately. One-way of destroying paper documents on site is with a shredder machine. One that cross-cuts so that you end up with tiny squares is preferable. Never, ever use these shreds for packaging as they can be reconstructed: yes some people have excessive time on their hands and will do this! When disposing of old computer equipment you should use wipe utility programs, as deleting alone will not get rid of files from the system. Disks and CD’s should be melted to ensure that no data can be recovered.

In addition to taking the above precautions, you should also have a plan of response to a security breach. Who will you contact? Who will be responsible for investigating? What will be the effect on business? These are just a few considerations.

Your number one defense against security breaches is your employees; you can have the most up-to-date, expensive security system ever created, but without cautious employees, it is useless. It is imperative that you provide continual training in security policies, and not just a once a year memo. Security training not only applies to your network defense system but also any other proprietary information.

The Carnegie Mellon University has published a useful tutorial on Informational Assurance in Small Organizations. It has many worksheets and helpful ideas to help you create an information security program www.cert.org/archieve/pdf/tutorial-workbook.pdf.

The FTC have an informative tutorial on their website along with a wealth of other information:
http://www.ftc.gov/bcp/edu/multimedia/interactive/infosecurity/index.html
http://www.ftc.gov/index.shtml

News from the ACFE

Chapter News

New Certified Fraud Examiners

Dinner Meeting News

Our next Dinner Meeting is scheduled for January 13, 2009

How Safe Is Your Clients Information?

President's Message