To minimize the ... risks arising from data loss, every company should take specific ... measures to protect their critical business data. These measures fall into two broad ...
To minimize the significant risks arising from data loss, every company should take specific preventative measures to protect their critical business data. These measures fall into two broad categories: physical security and digital security. We will identify seven critical steps to ensure your data is secure, then look at the additional protection required to keep your data available.
Here, we look at physical security and the three key steps a company should take to ensure their data is protected against environmental changes and physical theft.
Step #1: Secure Access
Protect critical computer equipment against physical theft by placing it in a separate physical space which has controlled, recorded access. Limit entrance to only authorized personnel.
Step #2: Environmental Controls
The space which houses critical computer equipment should be climate controlled through proper heating and air conditioning, including fail-over systems in the event of main system failure. Fire suppression and temperature monitoring with an automatic notification system should be implemented.
Step #3: Uninterrupted Power
Ensure that backup power supplies, including surge suppression, are in place to provide power to key computer equipment in the event of a primary power failure or instability in the primary power supply.
Now, we examine digital security and the four key steps a company should take to ensure their data is protected against unauthorized access.
Step #4: Firewalls
A firewall should be placed between the company’s internal computer network and each external network access point to stop unauthorized users from gaining access to the internal network and company data.
Step #5: Anti-Virus Software
Each workstation and server in the company should have anti-virus software installed and periodically updated with current virus definition files. Email servers should scan for viruses embedded in external messages and attachments prior to relaying them to internal email boxes.
Step #6: Restrict User Access
Access to network resources, applications and data files should be restricted exclusively to those employees with a “need to access.” Be sure to review user access rights regularly to reflect changes in employee responsibilities and when an employee leaves the company, his or her login ID and access rights should be immediately removed. In some cases, current employees known to be leaving the company may also need to have their access rights restricted to ensure the safety and confidentiality of company data.
Step #7: Passwords
Ensure all passwords granting access to the company’s computer network, databases and critical files are properly enforced. Passwords should be at least 8 characters in length and combine letters and numbers. Users should change their passwords at least every 90 days. Network administrator passwords should be changed every 30 days.
Protection Beyond Security
The 7 steps outlined above are critical as the first line of defense in protecting your data. However, it is important to be aware that data loss can still occur. Beyond data loss caused by disasters and criminal activity, data can be lost for a variety of more mundane reasons. These include application corruption, hardware failure, accidental deletion and user error. In any of these circumstances, you will need to roll back to a clean, available copy of your data. Continuous, online backup to a secure remote site provides archived and up-to-the-loss copies of data that can be quickly and conveniently recovered. With this added protection, your data is not just secure, but available and supporting your business.
Paul Hrabal is founder and President of U.S. Data Trust. U.S. Data Trust provides online backup and recovery services to growing companies that need to protect and maintain access to their data without the risk and IT overhead of maintaining an internal tape backup system and staff. Paul may be reached at 1-888-DATA-SAFE or pr@usdatatrust.com. Information resources and a confidential data risk survey are available online at http://www.usdatatrust.com .
###
