Data Privacy and Security

>> Listen to this Article or Add to Podcast

We've all heard the stories over the last year about companies and government departments losing sensitive personal data because they didn't secure either it or the device it was stored on. The loss of data has many negative affects with a loss of confidence in the organisation responsible possibly the least damaging.

I capture and store data on a daily basis so I can effectively do my job. I comply with the requirements of the Data Protection Act but the purposes for which I use the data I collect exempts me from notifications.

I take my responsibilities seriously and outlined below is a brief summary of how I secure the data in my control.

Desktop Computers & Servers
Each device is password protected using complex alpha-numeric passwords. Anti virus, anti adware, anti spyware and firewall software is installed on every desktop computer. The latest available service packs and all security patches are automatically installed. Manual checking of updates and software versions takes place on a regular basis to ensure none are missed.

Laptop Computers
Same as above with additional secure partitions encrypted with a FIPS-approved cryptographic algorithm using AES with 14 rounds and a 256-bit key (AES-256). These secure partitions are used to secure data on the hard drive in case the devices are lost or stolen. Back-to-base data transmission and database connectivity is via encrypted VPN tunnel.

Network Security
All nodes reside on a private, local area network. Wide area data transmission between nodes takes place on a secure virtual private network (VPN).

VPNs ensure message security between clients and servers by verifying peers’ identities and encrypting and authenticating data using the industry standard AES encryption algorithm with 256 bit key to protect all bulk data traffic in server to client and peer to peer traffic.

USB Flash Drives

• High Security - IronKey Personal. The world's most secure flash drive. Used for transporting the most secure and sensitive data. View a demo video here and a data sheet here.
  
• Medium Security - SanDisk Cruzer 8GB. The entire device is software encrypted with a FIPS-approved cryptographic algorithm using AES with 14 rounds and a 256-bit key (AES-256). Used for transporting low to medium sensitivity data.
• Low Security - SanDisk Cruzer 2GB & 4GB. Standard, out of the box, password protected configuration. Used for transporting none sensitive data.

Email Security
Microsoft Outlook on all devices is installed with a personal, fully S/MIME compliant secure email certificate allowing me to encrypt and digitally sign email and attachments keeping them secure and confidential. If you'd like to send me sensitive information or would prefer to receive secure emails from me then let me know; I will need your public key.

Secure Payments
I accept payment by credit or debit card online via the following merchants; Google Checkout, Nochex or PayPal. I do not process payments or store any credit or debit card details myself, nor do I have access to them. All card transactions are handled entirely by the merchants on their own web sites using their own systems. Anybody wishing to pay by card will be provided with a personal link after which they will conduct the payment routine themselves on the merchant's web site.

If you would like further information then please get in touch.