Data security is becoming the common head ache for most business owners and institutions. This has led individuals and organisations to spend heavily on research, about how to curb cyber-attacks like ransom ware. Over the last decade different ransom wares have affected large corporations halting their services and taking their money. Some of these ransom wares include Petya which exploited MS office and SMBv1 vulnerabilities to propagate through the networks. Then there was ‘Skype’ malware that its attack spread through the vulnerabilities of Skype platform. Then there was fireball that affected countries in Asia especially China and India, what fireball did is to hijack browsers and making them inactive and then stole people personal information. Delta Charlie another form of malware happened, this attack was through launching of distributed denial of services on all vulnerable computers. Finally the most listen and dangerous was Wannacry, that software which was believed to have been developed by the US NSA but got on wrong hands. This software gets hold of your computer files, encrypt them and then demand payment in form of bit coins. Wannacry affected National health Services in the United Kingdom where some health care services could not have been offered.
These threats to data security can be concluded that the most used method of propagating these attacks is through websites and internets, therefore a caution of care should be taken by each and every organisation when dealing with internet application. Here are some of best practices that can help prevent ransomware and ensure your data security
- Ransome ware like wannacry exploited software vulnerability and it is advised that you update your software regularly. Software like MS word and windows operating system have their updates online, it is simple and easy to update. Plus, make sure your browsers, antivirus and java are up to date.
- Desist from opening attachments in your emails if they look suspicious or you do not know who exactly sender is. Majority of the virus and malware are distributed through emails. So it is always advisable to handle every attachment with caution.
- Always revise your personal anti-spam settings to ensure that doubtful attachment with funny extension are blocked or deleted immediately. One way of identify a fake attachment is when use a word document or excel file that have an extension like .exe. This means that it is not a genuine file since the extension file of the MS word and MS excel is .docx and .xls or xlsx
- Avoid clicking each and every pop-up, hyperlink on websites or social media. These are the most vulnerable sites that attackers and criminals use to send harmful software.
- Install genuine and bought antiviruses and firewalls and avoid installing trail version software from internet. Majority of them may look like genuine software but in reality they are malwares uploaded by criminals to compromise your data security. Always ensure your firewall is configured correctly and if you do not how consult an IT expert.
- Enhance your browser by installing add-on that that can help blocks unwanted pop-ups.
- Always follow your organisation data handling policy in place, make sure they are updated regularly and have captured all major development in the field.
Internet has become the most commonly used platform in data storage and with all these challenges, an efficient and effective solution has to be developed. Institutions like hospitals patients’ data and medical records are very crucial in their daily operations. So there is a need for hospital management not only back up there data but also do archive them using the appropriate file archiving software. Not to be confused by data back, archiving is different in that, data is classified in different tiers according to their need and importance then stored in secure and safe place or system. By archiving medical records this helps protect the most important and significant data from theft, damage or lost.
One way of ensuring data security is by creating an archiving system that is away from internet (WAN). Hospital IT specialist should create a private intranet(LAN) away from internet that not only ensures data and file sharing within the hospitals but also use file archiving software that give maximum data security. Qualities of a good file archiving software include:
- The software should be able enhance searchability that is it easier to retrieved files when required.
- It should be secure that is the software should be able to prevent data from theft and access by an unauthorised personnel. It should also be able to capture, compress, encrypt and index file data easily.
- The file archiving software should be scalable both horizontally and vertically to enable accommodate more modules as the organisation grow.
- Software should also be able to optimize your files such that it is able to detect duplication of the same file as the organisations continue increasing their operations.
- Flexibility is another quality that should not be ignored in file archiving software; the software should be able to allow for different types of files to be stored. Files like videos, documents, images and scanned documents. It is also important to consider software that is able to save a file with a different file format that will not get obsolete soon after that software that was used to format them is no longer active.
- The software should be economical and easy to use. It should be easy to operate the software and easy to teach new employees. The cost of acquiring, maintaining and operating the software should be manageable.
Although as mentioned earlier to avoid ransom ware and data breach organisation intranet should be kept away from internet it should be noted however, that for critical data and file that need to be shared publicly it is better for the IT management and personnel responsible to securely demilitarize the servers with the best firewalls and algorithms. It is advisable for the personnel to keep checking regularly the software for any intrusion. For best practices of handling data and maintaining its integrity IT personnel should be formulate policies that should be followed. Below are sample policies that should be observed to ensure data security in file archiving software:
- Each and every employee should have a powerful password that combine numeric, alphabets and other characters and it should be changed regularly.
- Every USB storage device used by every employee should be scanned first for viruses and approved by the IT department. Any outside storage devices should not be allowed to be login in the system or allowed in the building all together. Employees should also refrain from going home or using office storage media for personal purposes and if need arise where employee have to carry some files home he or she should carry due diligence to ensure that the storage media was not used in other activities.
- Regular meeting and training of the employees by the IT personnel should be held. Each and every employee should be requested to contribute or participate in discussion on how to improve the data security of the organisation.
- Physical security should be introduced near the archive room like installation of motion sensor and CCTV system. Also the system should be able to detect who is logged on at each specific moment and what files are they accessing.
- Using internet during work hour should be limited and only allowed at specific areas or time of the day set by the management. This must be agreed by all stakeholders so as to ensure employees do not try other back door activities that may end up causing more damage.
- The only data to be entered in the system is the one verified and approved using the set guidelines of the companies. Therefore each and every employee should be provided with a guidebook with well set guidelines to ensure that he or she is up-to date with the procedures.
Even with all this system in place the ultimate determiner is human capital. Integrity and effectiveness of human is something that can be tested in fullness of time. Data security start with human and end with human.