Topic 6 – Legal Issues with ICT

In the exam you are expected to:

Corporate Security

• Understand the need for a corporate information system security policy and the rôle it would fill within an organisation. Factors could include prevention of misuse, detection, investigation, procedures, staff responsibilities, disciplinary procedures.
• Describe the content of a corporate information system security policy.
• Describe methods of improving awareness of security policy within an organisation, cross-referencing to training and standards.
• Understand that many information systems are subject to audit.
• Understand the impact of audit on data and information control.
• Describe the need for audit and the role of audit
• management/software tools in information systems.
• Understand the function of audit trails and describe applications of use, e.g. ordering systems; student tracking; police vehicle enquiries.

Disaster recovery management

• Describe the various potential threats to information systems, e.g. physical security; document security; personnel security; hardware security; communications security; software security.
• Understand the concept of risk analysis.
• Understand the commercial need to ensure that an information system is protected from threat.
• Describe a range of contingency plans to recover from disasters and relate these to identified threats.
• Describe the criteria used to select a contingency plan appropriate to the scale of an organisation and installation.

Legislation

• Understand that implementation of legislation will impact on procedures within an organisation.
• Describe the methods of enforcing and controlling data protection legislation within an organisation.
• Describe the methods of enforcing and controlling software misuse legislation within an organisation.
• Describe the methods of enforcing and controlling health and safety legislation within an organisation.
• Discuss the implications of the various types of legislation.

In Module 1 we saw that there are three important pieces of legislation that affect the use of computers:

• The Data Protection Act – covers the privacy and security of data held on living recognisable persons;
• The Computer Misuse Act – covers offences such as hacking and the writing of malicious code (e.g. viruses);
• The Health and Safety at Work Act – covers the work environment with rules covering the layout of workstations.

In this topic, we are going to look in more detail about the external pressures on companies that are brought to bear by the need for security and the need to comply with relevant legislation.

If you want to revise this from Module 1, click  HERE

Corporate Security Policy

The accidental or deliberate destruction of data could have a devastating effect on a company.  While paper records were bulky, it was quite difficult to do damage without being noticed.  Paper records are surprisingly fire-proof, and many a company has found in the past that their paper records have survived remarkably intact a major fire.  They may be a bit singed about the edges and/or soggy, but they could be used.

This is not the case with computer records.  They can be altered or even destroyed with just a few keystrokes.  Data has to be kept secure from physical or software threats (data security).  Data integrity (prevention of accidental or unauthorised alteration) is essential to ensure that the data are of good quality.  Security threats are shown in the table:

Just hoping and praying that no such problem should affect a company is not an option.    Computers are complex devices that are remarkably reliable, but even the best hardware can go wrong.  I have experience of this myself.  In my job as a teacher, I use a computer a great deal, and several months ago my computer had a major failure of a hard disk drive.  While the HDD itself was under guarantee and was replaced, all the data were lost.  Fortunately I had most of it backed up in some way or another, so not a great deal was lost in the end.

For a company, such a failure would be crippling, so ICT security must be a strategic issue to be dealt with by the bosses.  A risk analysis might include:

• What is the nature of the stored data?
• How are the data used?
• Who has access to the data?
• How much money would the company lose if the data were lost?

The diagram shows the levels of security and threats that impinge on a company’s ICT system.

Physical Security

It is not unknown for a person posing as an employee or a contractor to walk straight into the room containing a company’s ICT equipment and lift the server.  And walk out with it unchallenged.

The obvious ways of keeping unwanted people away from ICT equipment are physical barriers such as locks, grilles security fences to prevent break-ins.  Automatic fire protection measures are also common.  In earthquake prone areas, the structure of the building is important.

Even genuine employees may have to be restricted.  Employees may carry an ID card, which allows them into certain parts of the company’s building, but not into others.  The card may have a magnetic stripe, or a chip, or a barcode.

Visitors can be issued with a pass that is valid for the day of issue only.  Some passes are treated with a special ink; after a period of time, the word EXPIRED appears.

The visitors are logged into a book, and records are kept of who is in the building and who has left.  Visitors are asked to sign out and surrender their passes once their business is done.  As well as security, there are important Health and Safety implications.  If there were a fire, the log would indicate rapidly if there were a visitor still in the building.

There are various biometric parameters that can be used.  These include fingerprint recognition, and iris recognition.  The fingerprint is scanned with a special scanner, and the door will unlock only on successful recognition.

Authorisation Software

User Ids and Passwords are obvious security measures.  The problem is that people are not very good with their use:

• Use obvious words.  The chairman of a large corporation used CHAIRMAN as his password for many years.
• Write the words down;
• Forget them.

Some companies insist on changing the passwords every month.  Some passwords are random combinations of characters, e.g. 7dX#98Td, which need to be written down, otherwise they would be instantly forgotten.  Passwords in computers are encrypted, and there is no way of decrypting them.

Access rights can be built into the software:

• No access at all
• Read only.
• Read and Append only.
• Full access including deletion.

Communications Security

Databases can be protected using any of these procedures:

• Callback in which the computer rings a predetermined telephone number when a user logs in;
• Encryption, so that the data is transmitted in a coded form which is decoded by an authorised computer that has the right algorithm, a set of instructions for decoding.
• Handshaking – a process whereby a random number is generated and the user must multiply the first and last digits and add it to the current month.  It can be dodgy if the user is not very good at arithmetic and if the day has a D, an A, or a Y in it, the company secretary is in a bad mood, etc.  Generally it is more secure than a normal password, because each user has a different algorithm. (This should not be confused with the handshaking done by bits of hardware, for example a computer and a printer.)

Audit Controls

Most networks can carry out audit trails, which can track all the events that go on in a network.  These can reveal any abnormal or unauthorised use of terminals on the network.  They can tell the ICT administrator:

• Which users are logged on and for how long;
• How many times the server has been accessed;
• What software has been used;
• Which files have been accessed by which users;
• How many unsuccessful attempts have been made to log in, which might indicate hackers.

Audit trail software can also trace all the processing done on a transaction from start to finish.

All companies must have their accounts audited by accountants and this software can be used to show how each figure is arrived at, from the source files, intermediate files, right through to the final figures.

Personnel Safeguards

The vast majority of breaches in data security are from within the organisation, and this can come from any level from the computer operators to a company director.  They may be motivated by a grudge, financial gain, or by fanatical or irrational behaviour to:

• Plant a virus or logic bomb;
• Steal data or corrupt it;
• Set up false accounts;
• Blackmail the company.

Whatever their motivation, they are in a good position to do it.  This can be countered by motivating employees to be alert to security breaches and making a big issue of them to deter computer crime.

Duties can also be separated so that no one person is responsible for all the steps of a transaction.  This makes it more difficult for a person to perpetrate a theft or fraud.

Setting Up a Security Policy

Security is an important issue in any organisation, and there will inevitably be a conflict between security and accessibility.  A school system is relatively insecure to allow good accessibility by students.  A company system would have very strict security.  Bringing in data on a floppy disk may result in dismissal.

If nobody abides by the security policy, then it’s useless.  Employees must be made aware of the policy and why it’s there.  Procedures must be taught, and the norms of ethical behaviour should be instilled as a matter of routine.

A typical security policy would cover:

·        Awareness and Education – requirements and timetable;

·        Administrative Controls – Formal standards and procedures need to be in place.  Personnel are carefully screened during recruitment.  Duties are separated (it would require collusion to perpetrate a fraud).  Security breaches would be a disciplinary offence.

·        Operational Controls – procedures are needed for backing up data.  Access to data is controlled by use of smart cards, and/or signing in or out procedures.

·        Physical protection of data – Access is restricted to sensitive areas.  There is protection from fire and flood.  Power supplies should be uninterruptible.   There are devices that can do this.

·        Access Control to the system – passwords, different levels of access, encryption of sensitive data.  Audit controls to detect misuse of the system.

The major issue that a good security policy must have is a detailed disaster recovery plan.

Disaster Recovery

A disaster always comes when it is least expected.  It may be from someone spilling a cup of coffee into the computer or a JCB digging through a cable, to a major fire or a massive explosion.   A head-crash or other hard drive failure can obliterate all the vital data.  The picture shows a scratch on a magnetic surface caused by a headcrash.

It has been shown that for most organisations, they are working at 96 % capacity one day after the disaster, but this falls off to 10 % at the 10^th day.  It is reckon that 90 % of businesses who lose data cease trading within two years.  Of these, 43 % go out of business almost immediately.

If the loss puts public safety in jeopardy, legal action from the Health and Safety Executive will follow.  If financial data is put into jeopardy, massive fines can ensue.

Some companies make their business from recovering data from damaged hard drives.  This costs a fortune, but is relatively small compared with the losses that would happen otherwise.

Insurance can only cover the replacement costs for hardware and software, not the consequent losses, so it is not a substitute for disaster planning.  Also the premiums would be based on whether or not the company had a satisfactory disaster recovery plan or not.

The key point is that a company should be able to be up and running in the shortest possible time.  So a security plan would have these elements:

• A list of the most critical functions;
• A list of the hardware, software, data, personnel necessary to support the functions.
• A method of getting access to the necessary resources;
• A method of contacting key personnel;
• Step-by-step plan of action;
• Education and training of those involved;
• Regular drills and reviews.

A disaster recovery plan would be based on back-ups, which can be in any of these forms:

• A company owned back-up facility far away from the main site.  This is called a cold-standby site.
• A reciprocal arrangement with another company running a compatible computer system.
• A subscription on a disaster recovery service.  This can range from supplying office space and equipment to having back-up computers running all the time (a hot stand-by site).

One case occurred where a thief walked into a company’s office, bold as brass, and walked off with the file server.  Fortunately everything was backed up, so little work was lost.  The owner of the company was able to get another file server from a local retailer at very short notice and by the end of the day the company was trading as if nothing had happened.

Even a non-commercial computer user such as a teacher should have a disaster back-up plan.  My own consists of having all my data for my job as a teacher on my computer at home, which has a RAID (redundant array of inexpensive disks), and on my laptop computer which I use at work.  In my office I also have my old PC that I had at home, on which I put all my work data.  Data transfer between the computers is via a flash memory.  It’s not perfect, but should the worst happen, I still have my most important data.

http://www.lyonware.co.uk/Disaster-Recovery-Software/Disaster-Recovery-Software.htm

Selecting a Contingency Plan

Extra provision can be costly, but it needs to be compared with the cost of a disaster.   These factors need to be taken into account:

• The scale of the organisation and its ICT systems;
• The nature of the operation.  An on-line system needs to be up in a few hours; an invoicing system based on batch processing will not be harmed by a couple of days’ delay, provided no data were lost.
• If a company has several networks, the job done by the damaged system could be done on another network without having to have a cold or hot standby site.
• How likely it is that a disaster would happen.  Companies in an active earthquake zone are more likely to need the services of a disaster recovery agency than a company in a European small town.

Implementing Legislation

The Data Protection Acts of 1984 and 1988 are there to protect the privacy of individuals on whom data are held:

• Data and information must be secure;
• Private, personal and other data must be accurate;
• Data must not be misused.

Organisation working with data held on people must have a data protection policy.  A typical one might focus on Customer Service and Organisational Culture:

• Customer Service:

1. Policy must be available to all customers, either on the invoices, or at least on request.
2. Customers must be told why their data are to be collected and to what purpose that data are going to be used.  No more data than necessary are to be collected.
3. Data should be collected form the customer in person to ensure that they are accurate.
4. No data must be used for any other purpose than the purpose they were collected for, without the customer’s consent.  This includes passing the data on to a third party.
5. Consent must be obtained by the provision of at least a clear opt out tick box on the data entry form.
6. Customers must be allowed easy access to any files containing their own information.
7. Errors must be corrected at once.
8. Customers’ concerns must be listened to and acted on.

• Organisational Culture

1. The policy must be communicated clearly to all staff, whether as a part of the company’s handbook, on the notice board, part of induction, or on the intranet.
2. Awareness of privacy issues must be fostered amongst all staff.
3. Staff must be aware that any breaches of the DPA render them not only liable to disciplinary action, but also to legal action under the DPA, for which they will be personally liable.
4. The effect on privacy issues must be considered before any new system is developed.
5. All reasonable steps must be taken to ensure all data stored and used is accurate and up-to-date.
6. A schedule must be kept of how long data is held before they are destroyed.
7. There must be a security policy to ensure that all data are kept secure from accidental or malicious damage, and access by unauthorised persons.
8. The security policy must be the responsibility of a senior manager;
9. All staff must be aware of their own responsibilities, for example, keeping passwords secure, maintaining all disks securely, performing regular back-ups, etc.
10. Periodic checks should be made to ensure the policy is being followed by all staff.

Software Copyright

Under the Copyright Designs and Patents Act 1988, it is illegal to copy software and run pirated software.  Advice is given to companies by the Business Software Alliance that recommends:

• 
  Prepare an inventory of all software used.  This can be done using audit software.  Any illegal software discovered should be deleted at once.

• Sufficient licences should be purchased to cover needs and metering software will restrict the number of users to the number of licences.

• The company’s commitment to legal use of software must be shown by having appropriate procedures.

Such procedures might contain:

• The appointment of a software manager to ensure that all software analysis and management are carried out efficiently;
• All machines are audited regularly;
• Ensure that all staff are aware of the need to use software legally.  Illegal use of software will result in dismissal.
• Software requirements and purchases are made through one channel only.
• Software suppliers need to be checked, and any new software entering the company.
• Staff must sign an agreement in which they declare they understand the company’s policy.

As well as depriving legitimate software companies and individuals their intellectual copyright, pirate software is often of an inferior quality and may be deliberately, or otherwise, riddled with viruses.  As well as the risk of fines or imprisonment, the use of pirate software can lead to critical failures, the introduction of viruses.

Health and Safety

“Prevention is better than cure” is an old saw, but very true with the use of computers.  Health complaints can arise from bad equipment, bad environment, bad working practices, and so on.  The way people interact with computers can have an affect on physical and mental health, including problems like:

• RSI;
• Back ache;
• Eyestrain.

Employers should avoid incentive scheme that increase data entry rates which can induce RSI.

Under the Health and Safety at Work Act, employers have an obligation to provide a safe working environment, and employees have an obligation to cooperate with the employer to ensure that all working practices are safe.  Employees are obliged also to bring any problem to the employer’s attention and cooperate in the correction of such problems.  Good employers will involve staff with the choice of furniture, equipment and software, as well as the arrangement of the office.  This gives employees a sense of ownership of their workspace.

Employers must provide workstations that comply with the HSA and must appoint a competent employee recognised as such by the HSE (or an independent professional ergonomist) to consider factors like:

• Lighting
• Heating
• Cooling
• Workstation layout;
• Equipment;
• Software.

Also good practice includes taking regular breaks.  These might be breaks of 30 seconds every five to ten minutes, or ten minute breaks every hour or so.  Good coffee facilities are also useful.  All these make the working environment so much better, leading to a happy and productive workforce.

Home                    ICT A2                    Module 4