Data Security Best Practices

Data Encryption:

             

One of my favorite best practices and policies when it comes to data security is encryption at rest and in motion or transit.  Email, which is fast replacing the traditional letter-writing, is a common practice for most people, from insignificant to significant contents being transmitted every minute via email.  As a result, the adversaries who are roaming the Internet snooping for sensitive information to grab at the detriment of the legitimate and innocent Internet users are also posing problematic for every email sender and receiver.  That’s why I am big on data encryption as a practice that ensures peace of mind for email users, especially United States citizens, and highly recommend it as a must adopt best practice for data security and an antidote to combating the ongoing cyber warfare. The urgency and criticality of the use of Encryption/Cryptography and Electronic Data Interchange (EDI) via the Transport Layer Security (TLS) or Secure Sockets Layer (SSL) protocol to protect data in transit can never be overemphasized.

So, to beat the snoopers and maintain peace of mind—use encryption and EDI!

What is Encryption?

Encryption is “the process of encoding a message so that it can be read only by the sender and the intended recipient. Encryption systems often use two keys, a public key, available to anyone, and a private key that allows only the recipient to decode the message” (Dictionary.com).

What is TLS?

Transport Layer Security (TLS) is a protocol that ensures privacy between communicating applications and their users on the Internet. When a server and client communicate, TLS ensures that no third party may eavesdrop or tamper with any message. TLS is the successor to the Secure Sockets Layer (SSL) (TechTarget.com).

Check out the following article, courtesy of Google.  Give it up for Google for encouraging users to share this article with everyone highlighting the importance of data encryption, more so for emails and other types of data transited back and forth every minute by internet users on individual, organizational, and government level.

 _______________________________________________

The following information is by courtesy of Google!

How encryption works 

What it takes to make email safer from snooping. 

Privacy is important to all of us

If you mail a letter to your friend, you’re hoping that she’ll be the only person who reads it. But a lot could happen to that letter on its way from you to her, and there may be prying eyes who try to read it. It's why we send important messages in sealed envelopes rather than on the back of postcards.

Sending and receiving email works in a similar way.

As you go about your day reading, writing, and checking messages, there’s a lot that happens to deliver your emails to their intended recipients. But when you send or receive messages with an email provider who doesn't transmit messages via a secure connection, your emails could be open to snooping. 

Encryption depends on everyone 

Encryption with Transport Layer Security keeps prying eyes away from your messages while they’re in transit. TLS is a protocol that encrypts and delivers mail securely, for both inbound and outbound mail traffic. It helps prevent eavesdropping between mail servers – keeping your messages private while they're moving between email providers.

However, your messages are encrypted only if you and the people you email with both use email providers that support Transport Layer Security. Not every email provider uses TLS, and if you send or receive messages from a provider that doesn't, your message could be read by eavesdroppers.

TLS is being adopted as the standard for secure email. While it's not a perfect solution, if everyone uses it, snooping on email will be more difficult and costly than it is today.

Spread the word about the importance of proper email encryption in transit – more messages encrypted in transit makes the Internet safer for all of us.

Common Data Security Mistakes in Application Development

Recently, I was performing a routine audit of a client’s SDLC for an application in development, in view of routine compliance audit, and in the process of reviewing test cases, I was shocked to find real PII data in the requirement; I mean the whole enchilada…not just name and address, but date of birth, driver’s license, and even SSN.  Apparently, the client had included a screenshot of an employee’s human resources record as part of the BRD, and sent it by email to an offshore developer team.  Rule #1 in data security: Never use real PII data for development or testing purposes.

I wish I could say that such was an isolated incident, but believe it or not, the practice is common, as clients often provide non scrubbed data and artifacts with real PII data during requirements gathering, and unwitting BAs, business owners, and developers simply distribute the same, seemingly without a care in the world. This shows how unaware most people are when it comes to data and information security; often it is the little things that lead to the big things. Likewise, minor security threats often lead to big ones, as a result of negligence that often stem from ignorance or lack of policy guidelines.  Fact is, majority, over 80%, of the data breach and identity theft that occur are perpetrated by employees who have access to sensitive data, whether intentionally or otherwise. Individuals who do not understand how important it is to protect data, their personally identifiable information (PII) or the PII of others, put the security of their sensitive information and those of others at risk.  We have work to do to educate people on the importance of securing data and how to do so. Developers should never have access to real PII data for development and testing purposes.