Data security means protecting data, such as a database, from destructive forces and from unwanted actions of unauthorized users. Data security also protects data from corruption. Data security is the main priority for organizations of every size and genre.

Physical security, network security and security of computer systems and files all need to be considered to ensure security of data and prevent unauthorised access, changes to data, disclosure or destruction of data.

Physical data security
Physical data security requires controlling access to rooms and buildings where data, computers or media are held; logging the removal of, and access to, media or hardcopy material in store rooms; transporting sensitive data only under exceptional circumstances, even for repair purposes, e.g. giving a failed hard drive containing sensitive data to a computer manufacturer may cause a breach of security.

Network security
Network security requires not storing confidential data, such as those containing personal information, on servers or computers connected to an external network, particularly servers that host internet services; firewall protection and security-related upgrades and patches to operating systems to avoid viruses and malicious code.

Security of Personal Data
Personal Data means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller. Where the safeguarding of personal data is involved, data security is based on national legislation, e.g., the Data Protection Act 2018
(🔗 http://www.legislation.gov.uk/ukpga/2018/12/contents/enacted ).
Personal data may also exist in non-digital format, for example as patient records, signed consent forms, or interview cover sheets containing names, addresses and signatures. These should be protected in the same secure way as digital files and stored separately from data, whether in digital or non-digital format.

The Data Protection Act 2018 requires that everyone responsible for using personal data has to follow strict rules called ‘data protection principles’. They must make sure the information is:

used fairly, lawfully and transparently

used for specified, explicit purposes

used in a way that is adequate, relevant and limited to only what is necessary

accurate and, where necessary, kept up to date

kept for no longer than is necessary

handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage

Data that contain personal information should be treated with higher levels of security than data which do not. Personal data security can be made easier by:

anonymising or aggregating data

separating data content according to security needs

removing personal information, such as names and addresses, from data files and storing them separately

encrypting data containing personal information before they are stored – encryption is certainly needed before transmission of such data.

How confidential data or data containing personal information are stored may need to be addressed during informed consent procedures. This ensures that the persons to whom the personal data belong are informed and give their consent as to how the data are stored or transmitted. Organisations handling personal data need to register with the Information Commissioner.

When you are deleting data, remember:

DELETING FILES AND REFORMATTING A HARD DRIVE WILL NOT PREVENT THE POSSIBLE RECOVERY OF DATA THAT HAVE PREVIOUSLY BEEN ON THAT HARD DRIVE.

The CIA triad of information security a simple but widely-applicable security model. It is an information security benchmark model used to evaluate the information security of an organization. The CIA triad of information security implements security using three key areas related to information systems including confidentiality, integrity and availability.

Confidentiality
Confidentiality provides the ability to hide information from those people unauthorised to view it. It is perhaps the most obvious aspect of the CIA triad when it comes to security; but correspondingly, it is also the one which is attacked most often.
Cryptography and Encryption methods are an example of an attempt to ensure confidentiality of data transferred from one computer to another.

Integrity
Integrity describes the ability to ensure that data is an accurate and unchanged representation of the original secure information.
One type of security attack is to intercept some important data and make changes to it before sending it on to the intended receiver.

Availability
Availability is important to ensure that the information concerned is readily accessible to the authorised viewer at all times.
Some types of security attack attempt to deny access to the appropriate user, either for the sake of inconveniencing them, or because there is some secondary effect. For example, by breaking the web site for a particular search engine, a rival may become more popular.

Data governance (DG) refers to the overall management of the availability, usability, integrity, and security of the data employed in an enterprise. A sound data governance program includes:

a governing body or council,

a defined set of procedures,

a defined set of procedures,

Data governance combines the disciplines of data quality, data management, data policy management, business process management and risk management into a methodology that ensures important data assets are formally managed throughout an enterprise. It brings together cross-functional teams to make interdependent rules or to resolve issues or to provide services to data stakeholders.

These cross-functional teams – Data Stewards and/or Data Governors – generally come from the Business side of operations. They set policy that IT and Data groups will follow as they:

establish their architectures,

implement their own best practices,

and address requirements.

Data Governance can be considered the overall process of making this work.

Data Stewardship

Data Stewardship is concerned with taking care of data assets that do not belong to the stewards themselves. Data Stewards represent the concerns of others. Some may represent the needs of the entire organization. Others may be tasked with representing a smaller constituency, e.g., a business unit, department, or even a set of data themselves.

In some organizations, Data Stewards are senior representatives of stakeholder groups. As members of a Data Stewardship Council, they convene to make decisions about the treatment of data assets. In some other organizations Data Stewards operate independently, ensuring that the rules and controls are applied to data appropriately.

An accountability-focused definition of Data Stewardship is:

“the set of activities that ensure data-related work is performed according to policies and practices as established through governance.”

Access Management

Access Management is a discipline that focuses on ensuring that only approved roles are able to create, read, update, or delete data – and only using appropriate and controlled methods.

Data Governance programs often focus on supporting Access Management by aligning the requirements and constraints posed by Governance, Risk Management, Compliance, Security, and Privacy efforts.

Assurance

Assurance includes activities designed to reach a measure of confidence. Assurance is different from audit, which is more concerned with compliance to formal standards or requirements.

Control

Control is a means of managing a risk or ensuring that an objective is achieved. Controls can be preventative, detective, or corrective and can be fully automated, procedural, or technology-assisted human-initiated activities. They can include actions, devices, procedures, techniques, or other measures.

Change Control

Change Control includes a formal process used to ensure that a process, product, service, or technology component is modified only in accordance with agreed-upon rules. Many organizations have formal Change Control Boards that review and approve proposed modifications to technology infrastructures, systems, and applications.

Data Governance programs often strive to extend the scope of change control to include additions, modifications, or deletions to data models and values for reference/master data.