Data Protection Law For Business Owners

Data Protection is a serious issue. In the UK, the Information Commissioner can fine organisations up to £500,000 for repeated breaches of data security caused through broken business practices. Yet data security guidelines are far from prescriptive about what should be done to provide adequate protection for your organisation's confidential data, so what should small business owners do to ensure that they stay on the right side of data protection legislation and protect their own interests?

The UK Data Protection Act

If you hold personal information about individuals, you have a number of legal obligations to protect that data under the Data Protection Act of 1998. For full information on the 1998 Data Protection act, you should visit the web site of the Information commissioner http://www.ico.gov.uk, but the eight principles for data protection can be summarised as follows:

• You must have legitimate grounds for collecting the data.
• You must only process the data in a way that is in the person’s best interests.
• Tell people what you will do with their data when you collect it.
• Only process the data in a way that the person would expect.
• Don’t process the data illegally.
• Only collect the information that is necessary.
• Make sure that the information is accurate and kept up to date.
• Don’t keep the information for any longer than you need to.
• Take appropriate technical and commercial measures to protect the information.
• Do not transfer personal information outside the EEC unless it is to a country that ensures that sufficient protection is undertaken to ensure the rights and freedoms of the person concerned

It’s Not Just About Credit Card Numbers

Whilst protection of personal data is of paramount importance, it is not the only consideration. Your should always consider the “Three R’s” when considering data security, backup and Business Continuity Planning.

• Riches - What is the data that will make you rich? The most valuable information for many small businesses is their intellectual property. How should you protect your company’s “crown jewels” against a data breach or “catastrophic” IT failure.
• Ruin - What is the information that could cost you your business? If you are a law firm and expose data relevant to an ongoing court case by dropping a USB device on public transport, the loss of reputation could cost your firm dearly. The same principle applies to numerous other professions and professional services organisation where the cost of implementing appropriate data security measures is a tiny fraction of the cost of a breach to your business.
• Regulation - What information are you obliged to protect by industry regulation (such as credit card information), and what measures are stipulated for its protection.

For many large organisations, the biggest problem that they have is finding out where all of their valuable data is. For small companies however, there is a greater imperative to ensure that staff are made aware of their duties with respect to confidential information including what they can and can’t do. Technical measures should also be taken to protect confidential information by restricting access to your network, and ensuring that appropriate measures are put in place for data backup and encryption where necessary.

Data Security Best Practices
There is no “magic bullet” when it comes to protecting your company’s data since no two companies are exactly alike. From an IT perspective however, the most important considerations are to:

• Recognise which information is important to you, and find out where it is.
• Ensure that your important data is backed up properly, and these days that probably means using some form of off-site backup
• Protect confidential data on laptops using whole disk encryption software, and on USD / CD etc using file encryption. If a USB drive / laptop is lost or stolen, it is difficult to prove that no personal data has been exposed unless it has been encrypted, so why run the risk? Data Leakage Prevention (DLP) software can also be used to monitor and optionally prevent confidential information being sent outside the organisation using unmanaged communication channels such as Webmail or Dropbox.

The ultimate responsibility still lies with you to educate your employees to handle your company data responsibly so that you can eliminate the unintentional human errors that are the cause of the majority of data security incidents.

If you would like to know more about data backup, data encryption and IT security products and services available from Clearview Data Systems, or about our IT support services, please visit our web site, call us on 01707 255060, or email us at info@clearview.co.uk.

Moving Your Business To The Cloud

Cloud computing is a hot topic for large and small organisations at the moment, but as with any new technology, it can be difficult to see past the hype and potentially confusing marketing messages. The promise of cloud computing is to deliver access to the IT applications that you need to run your business from any PC, tablet device or Smartphone. If that isn’t justification enough, you won’t need to install any expensive servers, pay for disk space and processing that you don't currently need, or employ skilled technicians to manage those systems.

Planning Your Migration To The Cloud

Migrating to cloud computing will be a journey rather than a transformation, and it is likely that most companies will run a hybrid of cloud computing and on-premises systems for a number of years. There are also applications which aren’t a good fit for a cloud computing environment, so don’t try putting square pegs into round holes … just leave them as they are. Some applicatons are a better fit for cloud computing and far easier to migrate, so why not start with applications such as email security and data backup first? In many ways they are better suited to cloud deployment anyway. Once these simpler migrations have been completed, a more considered approach needs to be taken in migrating mainline business applications.

Moving Business Applications To The Cloud

In moving business applications to the cloud you need to decide whether you want to simply take your existing business applications and make them accessible via a web browser (Hosted Desktop), or whether you want to adopt Software-As-A-Service (SAAS) applications such as Google Apps For Business (Email / collaboration), Workbooks.com (Customer Relationship Management), or Xero (Accounts). If you choose the SAAS option, you need to be prepared for a change in business practices and the associated training requirement to ensure that the transition to cloud services does not adversely effect your business.

Whichever approach you choose, we would recommend that you either take some time to research the options available to you or take advice, and always run a pilot to make sure that you are able to prepare your staff for the change in the way that they will be working in future.

There are no prizes for moving your IT to the cloud in record time, but the cost benefits and ability to access your line of business applications from any internet connected device make it worth investigating how Cloud Computing will work best for you sooner rather than later.

If you would like to learn more aboutout our IT Support or cloud computing services, download our Cloud Computing White Paper or contact us on 01707 255060 or via email at info@clearview.co.uk .

Clearview Data Systems at Herts B2B Exhibition

Here's a photo from the Hertfordshire B2B exhibition that took place at Knebworth Barns last month.

We will be back at Knebworth barns on 21st November for the Hertsexpo. We look forward to seeing you there.

How should your growing business manage IT?

Small businesses now rely heavily on IT, and the proliferation of Apple and Android tablet devices only serves to increase reliance on technology that many business owners don't fully understand ... But it sure needs to work!

As companies grow it becomes impractical to rely on ad hoc support contracts to keep their systems working reliably. IT Systems need regular maintenance to perform at their best and remain protected against internet malware, so business owners need to take a decision to either employ a full time IT Manager or outsource to a Managed Service Provider.

Why IT Management is difficult for small businesses.
Larger companies can cost justify employing a full time IT team including teams of first line support engineers, experienced systems professionals and an IT manager. The system is proven and works well because junior members of staff have clear opportunities for career progression, senior technicians can roll their sleeves up and get to grips with new technology, and the IT Manager can occupy himself with developing IT strategy to meet the businesses' needs and managing his team. Unfortunately, it’s a different story for SMB’s. Skilled IT staff are thin on the ground and command good salary packages, so you need to make sure that you are going to be able to keep them busy.

IT Managers Need A Challenge
SMB’s are not always attractive employers for good IT professionals as they have fairly simple IT needs. Since most IT Managers are techies at heart, they like to be able to get to grips with the latest technology. Given that most of the tasks required to keep your systems running smoothly are routine in nature (e.g. updating antivirus software and ensuring that required Windows Updates are installed) , a small company is unlikely to be able to offer an IT professional the opportunity to build the infrastructure of their dreams. There is therefore a relatively high rate of turnover amongst IT staff in SMB organisations with IT staff leaving to seek new challenges in larger companies where they can gain experience in the latest technology. 

Losing an IT Manager causes its own problems. Suddenly, the one person who knows the ins and outs of your systems is gone, so it can be a turbulent time while you go through the process of finding a replacement which in itself diverts you from the process of running your business.

Should You Use A Managed IT Service Provider?
The alternative to employing your own staff to run your IT systems is to employ a Managed IT Service Provider (MSP). For a fixed monthly fee, a managed service provider will perform all of the functions that you would expect from an IT Manager, but at a lower cost. What’s more, you don’t need to worry about keeping them occupied, or whether they may leave your company.

Equally important is that an MSP is equipped to carry out the routine system management tasks required to keep your systems running smoothly and to do so as efficiently as possible using automation software. Unlike a break/ fix contract, an MSP gets paid no more money for sending an engineer to site to re-build a PC that has crashed, so they will do everything possible to make sure that they don’t.

Because of this, many larger companies with their own IT Manager (50 - 100 staff) use a Managed Service provider to support an in-house IT Manager. This way, your IT Manager can concentrate on the bigger picture of how you can use IT to make your business more efficient, and leave the routine maintenance tasks to the MSP who can carry out the work more cost effectively than employing additional staff.

What About Cloud Computing?
he move to cloud computing will undoubtedly be an accelerator to the adoption of managed IT services by medium and larger sized organisations. Organisations who run their business applications as cloud services will have no need to employ a full time IT Manager, but PC’s, printers and firewalls still need to be maintained, and an MSP is perfectly positioned to provide these functions efficiently and cost-effectively.

Want To Know More?
If you would like to know more about our IT support or managed IT services, please download our white paper or contact us at info@clearview.co.uk .

Managed IT Services - A 60 second introduction

Small businesses without in-house technical expertise can often find managing their IT a challenge. To start off with, the task of IT management may fall to the person who knows most about computers, but as a company grows it becomes necessary to call in a specialist when problems arise. As the company grows past 5 – 10 employees however, a more structured approach to IT Management is called for to ensure that your data is properly managed. At much the same time it will probably become apparent that there has to be a better way of managing IT than waiting until something breaks before you fix it. It can take up to a day to re-load a PC from scratch due to the number of updates that need to be applied, and onsite engineering charges can easily start to mount up to a point whereby a single call-out can cost in excess of £500.

If you can't justify employing your own IT Manager, your best choice could well be to engage a managed IT Service provider, but although the approach has been around for some time now, and can deliver significant benefits for small businesses, many business owners don’t fully appreciate what is involved in handing over management of their systems to a Managed Services Provider (MSP), or what they get for their money and so they have shied away from it so far.

What does a managed service provider do?

A managed service provider can either run every aspect of IT Support for you, or can offload day-to-day administration tasks from your current IT manager, allowing them to concentrate on developing your IT to meet your business needs rather than performing routine maintenance tasks. It really depends on what suits you best. In general terms however, a Managed Service Provider provides you with all the benefits of a specialist IT department without having to pay out the associated full-time salaries, or worry about the HR hassles of managing your own IT team.

How can your IT be managed by a Managed Services Supplier (MSP)?

Remote Management software is installed on your PC's and servers and allows an MSP to monitor your IT systems and report back on potential problems such as low disk space, failed Windows updates, or out-of date security software so that preventative maintenance can be undertaken before a system fails. Many of these routine maintenance tasks can either be automated or undertaken remotely, minimising the cost of delivering support by cutting down on the need to send an engineer to your offices.

What happens when IT systems fail?

A managed services supplier should make provision to be able to recover your systems as swiftly as possible in the event of failure. To minimise system rebuild time, a spare PC should be kept in your offices together with a snapshot of your standard PC build. Onsite / offsite data backups are then take to ensure that systems can always be recovered in the event of a system failure, fire or flood.

What about system security?

Robust security is an essential component of best IT practices that MSP's use to make the job of managing your IT easier. By implementing best IT practices such as restricting who can add new programs to your PC's, and making sure that antivirus and Windows updates are installed, your MSP incurs less cost in managing your system which allows them to keep their service costs down.

Managed IT Services allow you to benefit from the same level of professional IT management as a FTSE 100 company without having to maintain your own full time IT team, or worry about your IT manager going off sick or taking a holiday. You can concentrate on growing your business knowing that your IT is being maintained as efficiently as possible. Please download our Managed Services White Paper or visit our web site if you would like to know more. Alternatively, please contact us on 01707 255060 or by email at info@clearview.co.uk. We will be happy to answer any questions that you may have.

Securing Access To Personal Information

On the BBC's Panorama programme the DWP recently admitted that in the last 12 months, 158 people have been disciplined for unlawful access to personal medical information. Of all information that needs to be kept securely, surely personal medical information must come at the very top of the priority list!

From a personal point of view, it's all very well that they managed to identify and discipline the DWP staff who accessed the information illegally, but I would rather that the appropriate technology had been in place to prevent access in the first place. Yet if government departments fail to protect our data sufficiently, what should companies do to protect access to our personal details? A number of technologies are available to protect unauthorised users from accessing sensitive information in corporate databases:

• Intrusion Prevention – Intrusion prevention technology can prevent you against SQL Injection and Cross Site Scripting attacks. McAfee Database Activity Monitoring and McAfee Intrusion Prevention work at the application layer to identify these attacks and block them.

• Protection against Zero Day Attacks - No database administrator wants to implement emergency patches to their SQL server / Oracle application servers outside their normal patching cycles if they can avoid doing so. McAfee Database Activity Monitoring and Trend Micro DeepSecurity protect you against zero day threats until such time as you are able to apply the manufacturer's patches as part of your normal patching cycle.

• Database Access Monitoring – The first step to securing information on your databases is being able to report on access to personal / confidential information on your databases (e.g. medical information and credit card information) so that you can identify who is accessing this information and consequently which users may have been granted inappropriate access rights. Rules may also be configured to block unauthorised access to sensitive information.

In addition, products such as Safenet Datasecure can be used to overlay best practices for database encryption key management and access control. Key management products protect your organisation’s encryption keys and provide a straightforward means of backing them up securely from a central point.

Technology to implement robust data security is not cheap, but withe the Information Commissioner handing out increasing penalties on those organisations that fail to protect personal information, companies need to seriously consider their risk profile and whether some form of data protection may be a wise investment taking into account the potential cost of breach notification procedures, loss of reputation or worse.

Small Business Security

IT Security is a difficult subject for small businesses. We all know that security is important, but because IT Security isn’t directly responsible for putting money into your bank account, it often slips down the priority list of things to do.

The fact that IT Security is lower down the priority list in small companies makes them a soft target for cybercriminals. They are far easier to target than larger companies, and yet many small companies hold data from larger companies as part of collaborative projects.

Every company, large or small needs to assess their IT Security risk. The choice of how you implement it is of course down to you. You can “Do It Yourself”, choose a service provider, or turn to the growing number of cloud security providers that now exist.

Cloud security offerings are very attractive for small companies. There are no setup or management costs, and you pay only for what you need, allowing you to continue to focus on your business. They take a number of different forms, including hosted web filtering, hosted antivirus, hosted email security, hosted web application firewall, hosted two-factor authentication and even hosted vulnerability assessment to allow you to test your internet facing web servers and networking devices against the latest known attacks.

If you have suffered a breach, you have probably already given consideration to what level of security is appropriate for your company, how to implement the solution and how to manage it. If you haven’t , then now is a good time to be proactive, and review your firewall, endpoint security and data security defences in view of the new technology that has been introduced over the past few years.

Free trials are available for the majority of technology that you want to consider, and we are always happy to offer good advice on the sort of products that you may want to consider to protect your business.