6.4 protection measures Flashcards
staff responsibilities
t is the staff of an organisation that will spend the most time handling and amending data so the company must have sufficient and effective protection measures in place so that staff are confident in their role and know their responsibilities of information security. Certain staff members may be responsible for types of data within an organisation, such as personal and confidential data. Clearly assigning specific people to roles ensures that they know what their job is and that they are responsible if data is lost.
recovery planning
Before the disaster:
All of the possible risks should be analysed to spot if there are any weaknesses in preparation.
Preventative measures should be taken after the analysis, such as making rooms flood-proof or storing important data at a different location.
Staff training should take place to inform employees what should happen in the event of a disaster.
During the disaster:
The staff response is very important – employees should follow their training and ensure that data is protected and appropriate measures are put in place.
Contingency plans should be implemented while the disaster is taking place, such as uploading recent data to cloud storage or securing backups in a safe room and using alternative equipment until the disaster is over.
After the disaster:
Recovery measures should be followed, such as using backups to repopulate computer systems.
Replacement hardware needs to be purchased for equipment that is corrupted or destroyed.
Software needs to be reinstalled on the new hardware.
Disaster recovery policies should also be updated and improved.
Assessment and Effectiveness
As part of an organisation’s security assessment, they may identify specific cost impacts. These are necessary financial expenditures to ensure the security of data and systems, such as:
Software - e.g. security software such as firewalls may be purchased to protect networked systems.
Hardware - e.g. buying secure storage devices and new computer systems.
Training - e.g. hiring industry experts to train staff on how to keep data secure.
Security - e.g. hiring staff to protect server rooms.
