World backup day highlights the ongoing importance of protecting data and keeping IT systems and hardware secure. Losing your personal hard drive could be an inconvenience at best, but depending on the type and amount of data you lose, this could also be financially or emotionally expensive. Now think about what those impacts would be if it was happening to your business, or to your employer.
Data Breaches
Data protection and resilience can be achieved through taking the necessary steps towards a comprehensive disaster strategy, which will include plans to recover from data breaches. The Information Commissioner’s Office defines a data breach as “a security incident that has affected the confidentiality, integrity or availability of personal data“. The accidental or deliberate loss, destruction, corruption, or disclosure will affect the data and could have a significant negative effect on individuals or organisations.
Cyber Incidents
The government’s technical authority for cyber incidents, The National Cyber Security Centre (NCSC), provides advice and support for the public and private sector in how to avoid computer security threats. It also recommends 10 Steps to Cyber Security to help organisations proactively manage risk and be able to recover from incidents when they happen. Incidents which involve data loss or unavailability can cause a major disruption to business operations, continual business disruption, and/or a failure to comply with legal and regulatory requirements. Within their incident management ‘step’, the NCSC advocate investment in effective information security policies and processes to help improve resilience, support business continuity, improve customer and stakeholder confidence and reduce any financial impact.
Risk Management
Organisations in any sector can take simple steps to establish or strengthen existing risk management controls. There are free resources available which provide guidance, as well as certification schemes when your organisation is required to provide assurance to customers and other stakeholders. While the Cyber Essentials Scheme does not include a technical requirement, it still recommends backing up data and testing that the back-ups work. Risk management steps include:
1. Knowing your data
Before you can plan adequately for incidents, it’s vital to understand what data and other information assets are critical to your business or service delivery and define appropriate levels of protection. A retention schedule should be agreed, including any archive requirements for the permanent retention of data.
2. Establishing a data recovery capability
Implement a systematic approach to the backup of data and information assets. Ensure resilience and redundancy is built into the backup media e.g. stored in physically secure locations on-site and off-site.
3. Testing incident management plans
Security incident management plans should include specific provisions for disaster recovery and business continuity. These plans should be regularly tested for effectiveness and continuously improved based on the outcomes.
Protecting against data loss
Other internationally recognised information security and management standards go further and account for wide-ranging and topic-specific policies, which flow from top level security objectives and an information security policy. Topics include the protection of personally identifiable data, protection from malware, and backups. The ISO/IEC 27001 standard includes the information security aspects of business continuity management in adverse situations. Aligning to such standards can protect against loss when data incidents occur. For example:
Define and document
Once storage, retention and protection requirements are defined, they should be documented in a backup policy, with supporting procedures to ensure appropriate copies of information are managed. For example, software and system images should be taken and tested regularly in accordance with the agreed backup policy.
Plan
Develop a plan that is consistent with the documentation you have established, this should include personnel responsibilities, storage location, restoration procedures, the extent and frequency of backups, and a testing regime. As well as a clear backup strategy, the planning stage should also consider whether the organisation’s information processing facilities (including backup facilities) have sufficient redundancy in the event of hardware failure, or another event which disrupts business-as-usual operations.
The continuity of all types of data and information is essential to businesses and organisations, regardless of the sector. However, it’s important to note the explicit legal responsibilities, when it comes to the processing of personal and special category data.
GDPR
The Information Commissioner’s Office (ICO) remind data custodians that a key principle of the UK General Data Protection Regulation (GDPR), is that personal data must be processed by means of appropriate technical and organisational measures – this is the ‘security principle’. Article 32(1) and Recital 83 of the UK GDPR state that, after considering the nature, scope context and purposes of processing, appropriate measures must ensure and enable:
- The ‘confidentiality, integrity and availability’ of your systems and services and the personal data you process within them.
- The restoration, access, and availability to personal data in a timely manner in the event of a physical or technical incident.
Organisations also need to ensure that they have appropriate processes in place to test the effectiveness of such measures and undertake any required improvements. The UK GDPR does not define what a ‘timely manner’ should be. This therefore depends on:
- Who you are
- What systems you have; and
- The risk that may be posed to individuals if the personal data you process is unavailable for a period of time
Remember, remember…
The key point is that this has been considered during any information risk assessment and when selecting what security measures to implement. Ensuring that appropriate backup and restoration processes are in place allows your organisation to provide assurance in the event that systems suffer a physical or technical incident.
Information security continuity should be embedded in the organisation’s business continuity management systems. It may be more practical and effective if these arrangements are aligned with normal business continuity or disaster recovery. Regardless of how an organisation chooses to structure its data protection, the security and availability continuity controls should always be systematically and thoroughly planned, implemented, verified, reviewed and evaluated.