Threats to Data

<< See the Threats slideshow!

Deliberate threats

Accidental threats

Technical failure threats

Deliberate Threats

Theft involves physical access to equipment. This is much harder to organise than remote theft of data, such as credit card numbers or banking details. Nevertheless, actual theft is not uncommon and should be guarded against. A little care and thought can prevent 99% of the danger of theft.

- locked doors
- bars on windows
- alarms
- good security measures (don't let the public or untrusted people near a computer)
- video surveillance
- security cables or cradles to bolt down or tie computers to furniture
- locks on computer cases so they can't be opened and hard disks removed
- don't store important/secret data on local hard disks - save them to the file server
- use RAID 5

- commercial rivals may want to steal your valuable data or plans.
- political rivals may want to find your country's weak points.
- set up auditing so you know what data is being accessed by whom and when so you can trace who did what.
- glue up USB ports to prevent portable mass-storage devices being plugged in.
- monitor email to detect large data exports.
- also see "Hackers" below. (The only real difference between 'hackers' and 'spies' is motive)

- passwords required to enter or change the PC's BIOS
- passwords required to enter a network
- passwords required to start the operating system
- passwords required to enter major software packages (e.g. payroll)
- encrypted (encoded) data files (using RSA Public Key Encryption software such as Pretty Good Privacy or 'PGP' which is essentially unbreakable). Every time you connect to a "Secure Site" on the internet, you are using RSA encryption.
- local firewalls (software that monitors internet communications and uncovers unauthorised attempts to get information into or from your computer) e.g. Zone Alarm Pro.
- locked floppy disk drives so hackers can't insert disks with hacking tools into servers. Servers are vulnerable to direct running of hacking tools; workstations tend not to be so open to attack. That is why fileservers are jealously protected from people.

A way of attacking a web server is to send it millions of fake requests for information (e.g. a simple 'Ping' which just asks the server to respond). Sending enough such messages will tie up the server, forcing it to reply to so many requests that it cannot perform its usual functions. In extreme cases, a server could be so overloaded that it crashes. This is a Denial of Service (DOS) attack.

One computer, however, usually cannot send enough requests to bring down a server: many computers are required to cooperatively bombard the target to bring it down. How does a hacker find lots of accomplices? Well, usually they can't because they're usually antisocial geeks with no friends. So, they spread a Trojan Horse (see below) that infects other computers which then become 'zombies' that can be ordered by the hacker to attack a particular target simultaneously. This becomes a Distributed Denial of Service (DDOS) attack. If it's a sensitive target, like the government, and the federal police follow the attacks to their source, it's the hapless unwittingly-infected citizen who is arrested; not the hacker, who is safely well removed from the whole affair.

Malware

Accidental Threats to data

Data damage or loss is often caused by idiots who shouldn't have been let loose in the first place. Whether you lose data through deliberate nastiness or complete stupidity, the result is the same.

- train employees properly so they know how to protect data and not make mistakes
- have proper documentation about software and procedures
- only give people access to the data they need to do their job.
- set up transaction tracking so each bit of business is recorded somewhere safe. If the worst happens you can reload all the transactions as if they were happening for the first time.
- set up auditing so you know what data is being accessed by whom and when so you can trace who did what damage.

Have you ever saved something and then not been able to find it? A good filenaming and storage procedure prevents those problems. If everyone on a team knows where to save files and what filenaming scheme to follow there is less time wasting and annoyance.
A simple filename scheme you should use is 'incremental naming'. Save your first document as "essay1.doc". The next time you add to it, save it as "essay2.doc". Every time you revise it, save with a different name. This has many benefits:

• if you realise you've messed everything up you can revert to the previous version
• you have built-in authentication for VCE
• in case of disk failure you have multiple backups. One problem of saving a file with the same name is that it uses the same area of disk as the previous saved file. This make undeletion of old versions very hard, if not impossible. On floppy disk, this constant re-use of the same part of the disk can lead to premature disk failure just where the most important file is.
• when the document is finished you can delete the previous drafts

Fire, flood, earthquake, falling elephants. You can at least do something about the first disaster... it's called a...

Technical Failure causing threats to data

Hardware will fail. It's a fact of life. Hardware with moving parts will fail more often. That's another fact of life. Don't be surprised when it happens: be prepared to recover and move on!

- backup!
- redundant (backup) hardware (e.g. RAID 1 storage where the PC has 2 hard disks and data is simultaneously written to both disks)
- use RAID 5**
- keep computers comfortable: airconditioning (PCs hate heat and humidity), dust and smoke free environment, no dropping or jarring PCs, no liquids near PCs, no plugging/unplugging of components while the PC is running (except for "hotswap" devices).
- Uninterruptible power supplies (UPS) ensure that when the electricity dies or fluctuates dangerously, your PC or fileserver can survive long enough to be shut down cleanly. UPSs also offer filtering to remove power surges and troughs. UPSs often also provide a phone line passthrough to protect your modem and PC from lightning damage.
- A surge filter is cheap insurance to prevent damaging power spikes frying all your electronic components