Unit 7 Organisational Systems Security M1

M1 Discuss Information Security

Confidentiality
Confidentiality is making sure that private information remains private, especially if it is things like addresses, dates of birth or medical histories of employees or customers. This information must be kept with the employer and can’t be distributed around.
Different employees in a company may have different levels of access to confidential information, and before they start work they should be made to sign a confidentiality agreement to make sure that they don’t share any confidential information.
Making sure that the data is stored in a safe place is also very important, if it’s stored on paper it should be kept in locked filing cabinets in locked rooms for example, and depending on how sensitive the information is it might have security guards as well.
If it is stored digitally then it should have a very complicated password that is changed often as well as a very secure system (very good antivirus etc).

Data integrity and completeness
This is making sure that any information that may be stored by a company is all correct and not missing anything. It is very important to regularly check that all the data stored is correct as if it is incorrect then this can lose money for the company if they have to spend ages sorting it out if one day they realise that all of their data is wrong, compared with doing it a little at a time.
This could even lead to people being hospitalised or even dying if for example a company that keeps medical records gets mixed up and people get the wrong prescriptions, or if the information isn’t complete and doesn’t mention a penicillin allergy for example.
Validation routines and input masking are ways to help make sure that all data is complete at the point that it is entered, for example if data is being entered into a database it will make sure that no letters are input into the ‘telephone number’ field, and that all necessary fields are filled.
A way to check if anything has changed with the data after it has been entered is for example with a dentists, every time you go they give you the option to change your address if you have moved or your mobile phone number if you have a new phone etc. so that it will be correct in their records.

Access to data
It is important to make sure that only people who really need to use certain data have access to it. Employees within an organisation will have different levels of access to data and this is usually determined by what job they do and how high up in the company they are. 
A reason why people may request data that they do not normally get access to is if they are a bank or loans company wanting to check a credit report, this can only be requested when someone applies for credit.
It is important to keep track of who within an organisation has access to what data, for example if data is stolen then the company can see all the people who had access to it which will narrow it down.
it is also important to make sure that who has access to what data is reviewed often to make sure that no one has access to any information that they do not need and this will make sure that the information is more secure.