Tony Dyhouse

Last November, St Albans City Council and two NHS care trusts were victims of embarrassing data thefts as the result of someone walking out the door with their computers.

These incidents highlight a worrying trend: CIOs are focusing on technical security and forgetting about the basics. Implementing sophisticated data protection technology is fine, but not if you ignore the fundamentals of physical and online security. It’s like investing in fingerprint identification for your front door and leaving your back door unlocked.

These thefts raise the same old concerns: why wasn’t the data encrypted? Why was it stored on an internal drive and not a securely held server? And why wasn’t there adequate physical security in the building? The answer to all these is that people aren’t taking information security seriously enough.

Public organisations are trusted with a huge amount of sensitive data and they have a corresponding duty to handle it responsibly. But this goes beyond data theft. If data is being held on a hard drive and not a central server, how can we be sure it is being properly updated and backed up?

The solutions are not difficult. In fact, many are already in place and working well. The Information Commissioner’s Office (ICO) lays down guidelines for all public sector organisations, and healthcare security is covered, albeit non-bindingly, by the Connecting for Health Information Governance Toolkit.

The problem is that, in too many cases, these procedures are not being followed. St Albans Council even admitted that there wouldn’t have been a problem, had their security policy been followed.

If the problem is to be solved, the CIO must take full responsibility for implementing mandatory security practices. This has to include: proper data handling training for relevant staff; ensuring employees understand the impact of mishandling data; and implementing personnel procedures to make sure employees do not compromise the system. These measures must be backed up by adequate sanctions for any unreasonable failures.

Tony Dyhouse is director, cyber security programme at the Knowledge Transfer Network

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!