Data Protection With Workplace Technologies

Digital Data & Paper data equally important to protect

Your confidential document destruction service is more than just paper data destruction. Digital data also has a secure data destruction method. The devices used to view this data must be properly protected to ensure your data is protected.

Mobile technology increases workplace productivity. Smart phones, laptops, i-pads and other devices allow employees to work regardless of location. As good as these mobile devices are they also increase the risk of a potential data breach too.

So how does an organisation maintain the increase in productivity whilst protecting its confidential information?

Embrace it; The use of mobile devices assists the employees in their efficiency and productivity.

Latest Technologies; By keeping your technologies up-to-date you are ensuring that productivity is not being hindered by the use of out-dated technologies.

CYOD Policy. For improved security control, a Choose Your Own Device (CYOD) policy is recommended. This allows employees to choose devices from a list of approved choices, and companies could equip devices with the appropriate security.

Control of the apps. While apps can improve both the efficiency and speed of specific work tasks; Security in Shredding encourages organizations to provide employees with practical and approved enterprise-grade mobile apps for work.

Digitize. In todays world there is a growing number of organisations whom are digitizing information and processes to reduce costs. But all sensitive data still has to be properly disposed of when it is no longer required. Security in Shredding strongly recommend organisations to out-source the destruction of data when it reaches end of life. A certified data destruction service provider will securely destroy sensitive material when it reaches its end of life. Proper certified destruction guarantees that data cannot be recovered.

Cloud computing. While cloud benefits include cost savings, elasticity, and storage on demand, it still poses a great concern. There are a number of tools available to protect data in the cloud such as encryption and cryptographic tools. Click here to read more: https://ow.ly/hiVq30085uP

Train your employees. All the technologies in the world could be at ones finger tips but the users, in this case the employees need to be taught the best practises. All policies should also apply and be treated of equal importance in the office and outside of the office.

If you require any further information regarding any of the points above, you can get in contact with our Data Management Consultants either through the contact us page or simply phoning us on +35367 24848.

7 Questions Dealing With Sensitive/Personal Data

privacy-data-security

We live in a digital information age and how this information in gathered and viewed is through mobile or electronic devices. On site document shredding services will handle your paper data and also digital media to be destroyed securely.

Cyber liability, cyber security and information governance are terms that managers and directors are aware of due to high-profile data security breaches in recent events (“Panama papers”). Mason Hayes & Curran covers the critical questions these companies need to be asking.

In an increasingly interconnected world, with the expansion of the internet and development of the internet of things (IoT), there has been a corresponding increase in the vulnerability of information systems to attack.

The Cyber Security for Directors app with the Institute of Directors in Ireland has released an app to help heads of companies to understand their responsibilities regarding digital data security.

The app details the various types of cyber liability and cyber risks, while drawing together the key areas for directors to consider. It also outlines both proactive and reactive strategies to manage cyber security. The app is available on Android and iOS.

Technology has rapidly changed over the past 20 years and continues to grow. People’s reliance on digital devices both for storage and transmission of data, is making data breaches all the more damaging to organisations. How a mobile device operates both the front end (you) and back end(server) is not that transparent unless you have a good understanding of data transfers.

Knowing how this works is not essential but can make it easer to understand where the pitfalls lie within a device will benefit data security.

Where there is liability, there is a corresponding responsibility for that liability. As the duties of directors come increasingly under the microscope, it is clearly in the interests of directors to ensure that they understand their responsibilities in this area.

Below, we have outlined the key questions that directors should ask in relation to the collection and processing of data

1. Are we being transparent?

Data must be obtained fairly and the company must be transparent about the reason the data is being collected and the purpose for which the data will be used. Data must not then be put to a further incompatible use.

2. Do we have consent?

Consent is usually, but not always, required. If the information is non-sensitive, there can be implied consent. If the information gathered is sensitive (such as relating to an individual’s health, race, sex life, religious beliefs or trade union membership) then there must be explicit consent.

3. How long are we retaining data for?

Personal data can only be stored for as long as is necessary. There should be no retention of data ‘just in case’.

4. Are we collecting unnecessary data?

Data should only be collected if necessary. There are PR risks to any company if data is collected and stored unnecessarily.

5. Are we keeping the data secure?

You must have appropriate security measures to protect any data you are storing. Take into consideration the state of the technology you are using, the cost of implementation and the nature of the data and potential harm if a breach occurs.

6. Are we giving the data to third parties?

Are the third parties controllers or processors? In other words, on whose behalf will they use the data? If they are controllers, you will likely need consent for collection. If they are processors, special written contract terms are required.

7. Is the data leaving Europe?

If collected data remains within the European Economic Area (EEA), transfer issues do not arise. If the data is to be transferred outside the EEA then safeguards are required unless it is an approved country, eg Canada.

Check out www.mhc.ie for more information on Tech law.

Industrial paper shredding and media destruction are performed securely and confidentially by our team at Security In Shredding. For more information on our shredding or destruction services please contact us.

 

5 Data Security Tips To Protect A Company’s Sensitive Data

Secure Paper Shredding Hard Drive Shredding WEEE Destruction

For many small business owners, are aware of the potential data breaches that can occur. Secure document shredding is one method of data security but most people will think “It wont happen to me” and when it does happen it can cost the business upwards of €100,000 fine if data security was inadequate. For a small business, one data breach can destroy their reputation and customer confidence.

Below are 5 tips to implement data protection solutions that all small businesses can do today to protect their customers, their reputation and their people against data breaches:

  1. Implement a Clear-out Shredding Policy

Clear-out Shredding policies ensure all paper documents are shredded before being recycled or disposed. The Clear-out Shredding Policy removes any uncertainty around whether documents are confidential and require shedding. This simple step is one of the easiest ways to avoid human error including mishandling of confidential documents and files. In addition, all shredded paper is recycled, adding an environmental benefit to a security solution for businesses. Overall, it leaves little to be decided around the type of information that should not be deposited in recycling bins and waste paper baskets.

  1. Encrypt all electronic devices

Mobile devices are everywhere. There are more mobile devices than people in circulation. A workplace mobile will be used so employees can access the information they need remotely, which means company information may be exposed to greater security vulnerabilities. Encrypting all electronic devices is an important first step in securing information.

All electronic devices used by employees should be encrypted to protect sensitive data regardless for their own benefit and not just the company or organisation. In the event that electronic devices are lost or stolen, encryption will protect the information stored on the device and mitigate any compromising activity.

End to end encryption” is a term you should look out for especially when transferring data. Software applications can do the same function a number of different ways. Knowing how they operate is recommended.

  1. Maintain Clean-desk policy

A clean-desk policy encourages employees to clear their desk and secure documents in a filing cabinet or storage unit when they are away from their desk or office at the end of the day. This includes documents, files, notes, invoices, and removable digital media like memory sticks. Unattended and untidy work stations pose a greater risk as loose information is an easy target for theft. A clean-desk policy ensures that all confidential data is locked in a secure area.

  1. Protect Printers & Peripheral Devices

Implement a ‘best practices’ standard for printing confidential information. Encourage employees and staff to not leave documents unattended at a shared printing station. To strengthen security around printing stations, consider using passwords for printing jobs. A printer is connected to a network and can be an entry point for hackers to access a network. Any other peripheral device that’s connected to a network may need an added layer of security just in case.

  1. Designate a Security Manager

If your business or organisation does not have one, now is the time to assign someone to do it. While it is important to have senior management and leadership play a vital role in mitigating data breaches, engaging employees from all levels and cross-departments helps strengthen an organization’s focus and commitment on information security.

At Security In Shredding maintaining data security is a vital importance to us. We must comply with data protection laws. For more information on paper shredding and data destruction services, please get in touch with one of our staff for more information.

Summer Holidays? Tips to Maintain Data Security When You Work

data security when on holiday

Who doesn’t enjoy a holiday or time off. Scheduling a paper shredding service before the holiday or time off is recommended. This will help give a piece of mind that you are protecting your data and let you enjoy your holiday.

In today’s world employees pack their work tablets and have their smartphones with them when going on vacation/ holiday.

There are a number of employees who don’t like to fall behind in their work and like to stay connected wherever they travel to. This is possible due to the ever improving technology of wireless internet, smartphones, laptops, and tablets. These technologies have made it increasingly easier to work from home and from the side of the pool!!

But organisations may forget the importance of data security regarding these mobile devices. Many organisations have policies in place where by employees BYOD (bring your own device) and this permits the employee to use one single device for both work and personal purposes.

The upside is while employees remain productive outside of the office 24/7, the downside is that they can access corporate data from anywhere. The negative impact this will have is it increases the risk of data breach incidents and has created a whole new area of information security policies.

Security in Shredding have a few tips to ensure the confidential business information employee’s work on outside of the office remains secure;

  • Implement a Bring Your Own Device Policy and by doing so you are creating a culture in your organisation.
  • Implement a schedule regarding the organisations protection software whereby on set dates throughout the year the software is updated.
  • “Provide employee training and regular refresher training regarding information security best practises outside the office.”
  • Prior to leaving the office for a vacation, ensure to only take documents that are extremely necessary regardless of a hard copy of digital copy.
  • Only under extreme circumstances should you print confidential documents from electronic means outside the office.
  • If one must print off a hard copy, ensure that all documents are securely destroyed. At mentioned earlier scheduling a paper shredding or bag collection may be needed.

You can speak with a member of Security in Shredding’s Data Management Consultants for further information. Our mobile paper shredding service is available for scheduling.

 

What To Keep & What To Shred: Document Retention Policy

Data Retention & data destruction

At Security In Shredding, document shredding is done with confidentiality and security is paramount when carrying out data destruction service. Data breaches occur when people are negligent or not aware of a breach. The most recent high profile story being the “Panama Papers” leak.

The Panama Papers is the latest mega data breach where millions of confidential documents from a Panamanian law firm were leaked, exposing offshore bank accounts – and possibly tax havens – for wealthy clients.

In light of this recent breach “I think we need to change the fundamental design of the way each and every document is created and managed,” –  commented Bill Anderson of cyber security company OptioLabs, in a cnet.com story about the Panama Papers.

While there are many aspects to data security, a sound document retention policy is one of the most important. Knowing what confidential documents to keep and which ones to permanently destroy should be of concern to everyone. Maintaining a clean desk policy will also help minimise the risk of confidential documents getting lost with other data.

This high profile case may sound like it won’t happen to you but the chances are that the data breach occurred by improper use or destruction of a data. All it takes is one wrong move for all your data to be accessed.

Below are some document retention policy guidelines to help keep your information secure.

  • Information Audits: Use audits to identify the types of documents the business produces, and to create an inventory and keep it updated.
  • How Long To Keep Tax Records? There are two parts to data retention: how long documents will be useful to the business, and how long they must be retained based on government and industry requirements. Checking with Revenue.ie on how long to retain your tax returns.
  • Fines – either way: While it’s law to keep certain documents, if you retain a record for too long you might also expose yourself to litigation risks and fines. Like most privacy laws, Data Protection Act compliance stipulates the record must be securely disposed of when the official retention period is over.
  • Emails: Records are paper files, digital documents, and correspondence including emails. According to wired.com, the Panama Papers leak included more than 4.8 million emails (as well as 3 million database files and 2.1 million PDF’s). If emails aren’t part of an important business or legal use or not subject to regulatory compliance, delete them within the appropriate time frame.
  • Controlled Access: Index all documents for easy retrieval. Store in a secure, locked location and/or in a password protected file. Control who can access sensitive documents and logging when this information has being accessed. Storing unwanted documents increases the risk of a Data Breach and adds to clutter.
  • Secure disposal: The only acceptable way to discard paper or digital documents when they are no longer needed is to completely destroy them. Industrial Shredding companies can dispose large quantity of documents, and outsourcing eliminates risk. Partner with a reputable shredding company that has secure chain of custody processes for information destruction. A Certificate of Destruction will document compliance and should be issued after every shred.

At Security In Shredding data security is equally important as confidential data destruction. An on site service or off site service is available throughout Ireland. Please visit our site for more information.

Data Breach Incidents in Educational Institutions

paper-vs-digital

Shredding companies in Ireland are employed by educational institutions such as colleges and universities. These institutions are considered easy targets because of their open structure and long information retention periods.

Data Breaches have occurred in educational institutions ranging from lost laptops with sensitive information to targeted cyber-attacks and student identification cards. There are lots of other confidential data that is useful to attackers beyond payment data and student records; such as employee records, patient health information and scientific research data. Paper shredding or document shredding will reduce the risk of data breaches

Negative public exposure regarding a breach will have a negative impact on the reputation of the educational institution as well as the enormous knock on effect it would have regarding peoples data. In order to minimise the risk of any size of a data breach a Risk Reduction Strategy must be established.

Security in Shredding recommend a number of methods to include in a Risk Reduction Strategy;

  1. Data Security” has to become “second nature” within the colleges and universities from the top down. A Data Security Informational Event should be organised by the educational institutions to inform in a fun way, the students and employees the importance of data protection and data security. You could look upon this as a form of training – Knowledge is key.
  1. Make students and employees aware of the Data Security Policies and Procedures. Use means such as bulletin board, posters, newsletters etc.
  1. Regular risk assessments should be conduct on an on-going basis to identify where the gaps in information security exist and to establish and provide the solutions.
  1. Physical Security of all sensitive data is very important. Secure restricted authorised access for key personnel is an important measure to take to minimise the number of unauthorised access events.
  1. Maintain a “Clean Desk Policy” and place all sensitive paper records that is no-longer required in the lockable secure console that is provided by the contracted Data Destruction Service Provider such as Security in Shredding.
  1. Implement and utilise IT security tools such as firewalls, encryption, anti-virus software etc. It is important to protect both digital data and hard paper data.
  1. Establish and use a Document Management Process for the tracking of documents, generation, storage and destruction of documents.
  1. Use the professional secure recognised services of a registered data processor whom is an established Full Data Management Service Provider, such as Security in Shredding whom provides a complete secure chain of custody for your data needs.

If you would like to find out more about on site paper shredding and or off site paper shredding, contact Security in Shredding’s Data Consultant Team on 067 24848. They are glad to help.

Minutes To Happen & Weeks To Realise; Data Breaches

Phising Most Common Data Breach

At Security In Shredding we ensure that all data processed by us is confidentially and securely destroyed. Data destruction is vital part of business practice. Data security is paramount to us and the success of a business. Preventative methods to improve your data security comes in many forms. IT security is an area that can overlooked due to newer technologies and people not aware of IT pitfalls.

A report from Siliconrepiblic writes about a common data breach method and is important that people are aware of such an attack. Knowing these potential risks is important is today’s high tech world. The article writes:

“Phising” What Is It ?

A Google search will give you the following definition:

“Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money), often for malicious reasons, by masquerading as a trustworthy entity in an electronic communication.”

Phishing is still the No 1 cause of data breaches and hackers are getting faster at breaking in, but firms are struggling and usually only find out weeks and even months later they have been breached, according to the 2016 Verizon Data Breach Investigations Report.

According to the report, in 93% of cases it took attackers minutes or less to compromise systems.Meanwhile, it took companies weeks or more to discover that an incident had even occurred.Worse, it was typically customers or law enforcement that sounded the alarm and not the organisation’s security measures.

‘A test we ran last year found that 23% of people that opened a message went on to open the attachment. In our latest report that has increased to 30%’
– LAURANCE DINE, VERIZON

According to the report, most reasons for breaches are money-related and cyber-attackers are indiscriminate and motivated by greed rather than revenge or some crusade.

Gone Phishing, Gone Data

Laurance Dine, managing principal in charge of investigative response with Verizon, told Siliconrepublic.com that phishing is still the chief method hackers use to attack organisations.

The report found that, in 2016, some 63% of confirmed data breaches involved leveraging weak, default or stolen passwords. Passwords such as “123456” and or “password” are used more often than you think 39% of breaches originate from victims’ own work areas and 34% from employees’ work vehicles.

Some 70% of data breaches involving insider misuse took months or years to discover.The report also revealed that new technologies like mobile and the internet of things are providing hackers with more ways of breaching an organisation’s systems.The industries most affected by data breaches are the public sector, healthcare and information.

Dine told Siliconrepublic.com that the data information was gathered from more than 67 partners worldwide and involved the analysis of 2,260 confirmed data breaches.

“There is still a serious information deficit when it comes to attacks. Attackers are getting into environments in minutes or days and it could be months and years down the line before anyone is aware of it and they usually hear it from law enforcement.

“Phishing is still the principal method of attack. A test we ran last year found that 23% of people that opened a message went on to open the attachment. In our latest report that has increased to 30%.”

“But if you are after the low-hanging fruit, the No 1 motivation for data breaches is still financial. Any data worth any value is a target.”

Read Siliconrepublic full article here: https://www.siliconrepublic.com/enterprise/2016/04/25/verizon-data-breach-report-2016

At Security In Shredding we strive to ensure that all documents and its data is processed securely destroyed on site or off site. Confidential shredding services are available throughout Ireland and we regularly operate in the Dublin, Galway, Limerick, Cork areas. Please visit: https://www.securityinshredding.com/

 

10 Threats Against Data Security For Small Business

privacy-data-security

Bigger companies incorporate off site data destruction practices, small businesses often don’t have the financial resources to house large scale IT departments, purchase the latest and greatest technology or invest into data security.

Many a cash-strapped small business finds itself operating its critical systems on computers that are old, slow and often times insecure. This leaves them susceptible to a wide array of security pitfalls and privacy threats, including data leaks and identity theft.

Fortunately, beefing up your security doesn’t necessarily mean draining your bank account. There are many inexpensive options to improve the security of your small business and protect your information.

Geoffrey Arone, serial entrepreneur and co-founder of SafetyWeb, gave his take on 10 very real threats facing small businesses and how they can be addressed in ways that are free or inexpensive.

1. Data Breach Resulting From Poor Networking Choices
Enterprise-level networking choices that are found in large IT departments around the world carry costs that price small or medium businesses out of the market. SMBs that have networks often use networking devices targeted at home users. Some may forgo the use of routers at all, plugging directly into the internet.

Business owners can block most threats by using a quality router, like a NETGEAR or Buffalo brand router, and making sure to change the router password from the default to something more secure.

2. Data Breach Resulting From Improper Shredding Practices
Trivial as it may seem, dumpster diving identity thieves target businesses that throw out paperwork without shredding it. Your small office shredders will NOT suffice for a secure document destruction, but a industrial paper shredding company is a wise investment if private or sensitive information is printed and shredded daily.

3. Identity Theft Resulting From Public Databases
Individuals, especially business owners, often publish lots of information about themselves in public databases. Businesses are registered with governments, telephone numbers are in the phone book, and many individuals have social media profiles with their address and date of birth. Many identity thieves can use information obtained across various public forums to construct a complete identity.

4. Identity Theft Resulting From Using A Personal Name Instead Of Filing An OA
Sole-proprietors that have not registered a business name to receive “operating as” designation are at a far higher risk of identity theft due to their personal name, rather than their business name, being published publicly.

5. Tax Records Theft Around Tax Time
Businesses should ensure that tax returns are dropped off at the post office and refunds are collected promptly from the mailbox. Identity thieves often steal tax returns from an outbox or mailbox.

6. Bank Fraud Due To Gap In Protection Or Monitoring
Business owners know that it is vital to balance their accounts every month to ensure that checks are not being written out of business funds by embezzlers, but many businesses rarely, if ever, check what kind of credit accounts have been opened under the business name. Monitoring services like myID.com can alert business owners when new credit accounts are opened fraudulently.

7. Poor E-mailing Standards
Many businesses treat e-mails as confidential communications, but this is far from the case. They are available to a number of people other than the recipient. It’s more appropriate to treat e-mails as postcards, rather than sealed letters.

8. Failing To Choose A Secure Password
In fact, many security experts are recommending the use of a pass phrase, rather than a pass word. Pass phrases are several words long, at least three, and are far more secure than passwords. A pass phrase like “Friday blue jeans” can be typed far quicker than a complicated password, and it doesn’t need to be written down on a post-it. The length of a password increases security.

9. Not Securing New Computers Or Hard Drives
Businesses that had their IT system professionally installed may opt to upgrade a computer or two by themselves. This is strongly discouraged on a business network, as new computers must be professionally secured or else they pose a serious threat and an entry point for hackers.

10. Social Engineering
Social engineers are individuals that call and claim they are from another organization. They may even claim to be with a firm that a business owner does business with. If someone you do not know calls on the phone, be sure that it is the person you think it is before revealing passwords or confidential information.

For more information on a paper shredding or confidential document shredding service in the Cork, Limerick, Galway and Dublin area, please visit: https://www.securityinshredding.com/

Like, Subscribe and Follow us on Twitter: @Securityinshred

Addressing Incorrect Data Destruction Habits

Data Protection, Paper Shredding, limeirck paper shredding

Shredding confidential paper in a business must be done and there are legislations in place to protect against data breaches. Failure to enforce these laws or inadequate data protection in place by a business will result in a hefty fine of up €100,000.

Human error is is arguably the biggest cause of data breaches are caused by employees and contractors. Human error is not solely to blame. Even high profile hacking cases involve employees inappropriately clicking on links and allowing the bad guys in. It is quite easy with a little bit of know how you can be easily tricked and baited into clicking a malicious link that will cause a data breach.

When it comes to proper data destruction, or avoiding data breaches due to improper destruction of data and confidential information. It comes down to employees knowing the dangers and pitfalls of potential data breaches within the office. Despite any amount of training, however, there is one lesson too many data controllers have learned the hard way. In order to maximize compliance, proper disposal of information has to be easy for the employee.

Some organisations might require employees to use a shredder in the copy room which is not easy. So much so that it is not even reasonable to think they will consistently do it. Whether because of carelessness, workload issues, pressures outside work, or laziness, compliance failure is inevitable. Nor is it reasonable to give employees the discretion on what is destroyed or options on where information-bearing media should go. Whenever a recycling bin is next to a shred bin, it is easy to find confidential information in the recycling bin. Making this process as easy as possible for our customers is recommended. We clearly have each console labelled so our customers know exactly what we can and can’t take in our locked consoles. We provide staff awareness days to help businesses improve their data security.

Data Protection, Secure Paper Shredding

The same goes for IT asset disposal. Since employees are less likely to toss out computers, it can be less of an issue. However, leaving the decision to the IT department instead of dictating the procedure through security and compliance can cause a problem. With electronic storage devices there is no true way to destroy the data using software. A physical destruction of the device must be done to ensure data destruction.

Educate and Awareness for you and your employees benefits with proper data destruction. Contacting a Secure Confidential document destruction service to incorporate into the business practice will improve your data security and destruction.

For more information on a secure document destruction service in Ireland, then please visit: https://www.securityinshredding.com/ or

please like, share and follow us on Twitter: @Securityinshred

The New European Data Protection Legislation

“Cannot be ignored by any business.”

Security In Shredding on site service

At Security In Shredding when shredding confidential documents we must comply by the EU standards. These standards along with the Data Protection Commissioner ensures that our work is done to the highest quality. Security is paramount and failure to comply with these laws can result in a hefty €100,000 fine. These laws also apply to all business that handle sensitive data.

The EU Data Protection Rules that are expected to come into force in 2018 will have an effect on all business and cannot be ignored according to legal experts in the field. The final text was agreed upon in December 2015 after years of negotiations and analysis.

The new regulation is aimed at harmonising the European Data Protection Legislation and reforming the outdated EU directive on Data Protection and replace all inconsistent laws across the European Community.

Even though the digital economy is at the core of this new regulation it is ESSENTIAL to note that physical data is also covered and holds the same fines and penalties which are described below.

One of the most eyebrow raising and awakening points from the new regulation is not only that it gives rise to increased compliance requirements but breaches in compliance are backed with heavy financial penalties which have turned out to be up to 20 million or 4% of annual turnover, whichever is the greater.

The journey to compliance

From the experts here at Security in Shredding; Organisations approach to comply with the GDPR will need to include three key components; These are:

#1) a compliance journey

#2) a transparency framework and

#3) enforcement, sanctions and remedies framework.

The compliance journey requires Organisations to classify the personal data in their possession; complete risk assessments; apply privacy protections into all existing and new business operations; employ and empower dedicated data protection officers; monitor and audit compliance; and document everything they do with data and everything they do to achieve legal compliance. All data stored electronically and physically will have to be managed appropriately. Waste paper will have to be destroyed through certified data processors and not enter general waste streams.

The new transparency framework will mean that Organisations need to redevelop how they engage with external people including all external vendors that process material for them, service such as paper shredding, external invoicing, digital data destruction and marketing will all have to review how they process information and give clear and full information on what is happening to personal data.

The new enforcement, sanctions and remedies framework will give appointed data protection officers high authority to make decisions for the protection of personal data and achieve compliance for their Organisation.

Please visit our site for more information on shredding confidential paper.

Join in on the conversation on Twitter @securityinshred