Information Security … A Guide For Business #2 Control Access to Data Sensibly
Ten practical lessons businesses can learn from the FTC’s (business.ftc.gov) 50+ data security settlements. This is part #2.
#2 Control Access to Data Sensibly!
Once you’ve decided you have a legitimate business need to hold on to sensitive data, take reasonable steps to keep it secure. You’ll want to keep it from the prying eyes of outsiders, of course, but what about your own employees? Not everyone on your staff needs unrestricted access to your network and the information stored on it. Put controls in place to make sure employees have access only on a “need to know” basis. For your network, consider steps such as separate user accounts to limit access to the places where personal data is stored or to control who can use particular databases. For paper files, external drives, disks, etc., an access control could be as simple as a locked file cabinet. When thinking about how to control access to sensitive information in your possession, consider these lessons from FTC cases.
Restrict access to sensitive data.
If employees don’t have to use personal information as part of their job, there’s no need for them to have access to it. For example, in Goal Financial, the FTC alleged that the company failed to restrict employee access to personal information stored in paper files and on its network. As a result, a group of employees transferred more than 7,000 consumer files containing sensitive information to third parties without authorization. The company could have prevented that misstep by implementing proper controls and ensuring that only authorized employees with a business need had access to people’s personal information.
Limit administrative access.
Administrative access, which allows a user to make system-wide changes to your system, should be limited to the employees tasked to do that job. In its action against Twitter, for example, the FTC alleged that the company granted almost all of its employees administrative control over Twitter’s system, including the ability to reset user account passwords, view users’ nonpublic tweets, and send tweets on users’ behalf. According to the complaint, by providing administrative access to just about everybody in-house, Twitter increased the risk that a compromise of any of its employees’ credentials could result in a serious breach. How could the company have reduced that risk? By ensuring that employees’ access to the system’s administrative controls was tailored to their job needs.