by Hugh Arthur

Created on: January 30, 2007   Last Updated: April 20, 2011

As a law enforcement professional assigned to a High Tech Crime unit, I'm often tasked with making presentations to chamber meetings and business groups. Contained in this article are some basic tips for keeping your business data secure. It is aimed at small and mid-sized businesses, although I have occasionally been to larger companies where no security plan is in place. These tips are not all-encompassing, but should place you on the road to a more secure business environment regarding your computers and the data they store.

Security Policy

Have a written Security Policy when it comes to your computer systems and data. Make your employees read and sign it. This will simplify your internal enforcement processes. It may also assist law enforcement with any criminal investigation by removing doubts about whether an employee was aware they were engaging in unauthorized behavior.

Your policy should make it clear that computers, network systems, data stored, and data generated using company equipment are the sole property of the business. Be sure to specifically identify items like email; customer lists; proprietary procedures or formulae; and, in-house software (including spreadsheet calculators and such).

The policy should also reinforce that the employee has no expectation of privacy when it comes to their use of the company computer system. Don't forget to include items such as laptops, company cell phones and PDAs when identifying what constitutes the company computer system, and if you decide to allow your employees to use the computer system for some personal matters, the limits should be explicitly defined.

The policy should prohibit objectionable content on the computer system, to help curtail sexual, racial or ethnic harassment. Certain worm viruses will search for such content and send it to customers and other people on email address lists. By effectively limiting this type of content you might also save yourself an embarrassing incident.

The installation of unauthorized software should likewise be prohibited. This prevents unlicensed software from being installed on company property. It can also help stop the inadvertent installation of Spyware, Malware, and other, more intrusive Trojans masquerading as free useful utilities'.

Make it clear in your policy that illegal activity will not be tolerated and that infractions detected on the system will be reported to law enforcement. Maintain and activate log files whenever possible. This will aid law enforcement

• 1
• 2
• 3
• Next Page >>