Information Use
CIS 207
April 10, 2013

Information Use
Company’s safeguard sensitive data like credit cards, social security numbers, or names by storing them in files. Businesses need this information to perform business functions. Identification theft is on the rise and protecting customers and employee’s personal information is paramount for any business to perform. The inability to protect their information could result in the loss of trust from a client or a lawsuit. Successfully protecting personal information is based on five key principles; they are take stock, scale down, lock it, pitch it, and plan ahead (Federal Trade Commission, n.d.). Take stock refers to the inventory of personal information stored and who has access to the information. Ensuring only those people who has a need to know is given access. For example, at the restaurant I own, the cashier handles credit card transactions. This is important because if there were an incident where a customer was over charged or had a complaint; it would be easy to investigate the source of the problem. When taking inventory of the personal information stored, computers, and file cabinets are a great place to start. Flash drives, mobile phones, and website are also places to conduct an inventory. The company must talk to employees who sends personal information and how they send it. Customers, banking institutions, and credit card company’s send sensitive data through a variety of ways. Sensitive information is sent through websites, e-mails, regular mail, and cash registers or point-of-sale (POS) terminals. Some sensitive information kept are credit card and checking account numbers from customers and can be stored in file cabinets, disks and tapes, computer or branch locations. The Fair Credit Reporting Act and Federal Trade Commission Acts require businesses to provide reasonable security of sensitive information (Federal Trade Commission, n.d.).
The second principle in protecting sensitive information is scale down. Scaling down, means to keep only the data required to conduct business transactions. If there is not a need to keep the sensitive data or if the data has served the purpose intended, dispose of it. Relevant data is keep only as long as it is required.
The third principle is to lock it. Securing sensitive information deals with four elements, physical security, electronic security, employee training, and contractor’s security practices. Many times sensitive information is compromised by documents lost or stolen, therefore it is important to keep those items locked. The first element is physical security or locking it. Devices that have sensitive information must be locked in a room or file cabinet.
Access to the room storing the data should be limited and only authorized employees should have keys to the room. Employees should be trained not leave sensitive data lying on their desks when not working on or using them. If the need to leave the area, documents must be locked in a cabinet and the office door should be locked. This makes it difficult for a thief to gain access to the data. The second element is computer security practices are to log off when they are away from computers. The use of security software that protects the computer from hackers and viruses must be used and updated as instructed by IT personnel. Websites such as www.us-cert.gov or www.sans.org gives alerts about new vulnerabilities. IT will often make available vendor-approved patches to correct problems. Sensitive information should always be encrypted when sent to third parties. When sending and receiving credit card information, it should be done using Secure Sockets Layer (SSL). Passwords used for logging into workstations must be at least eight characters, consisting of a mixture of upper and lowercase letter, numbers, and characters. This makes it difficult for hackers and thieves to solve. The passwords should charge every few months and under no circumstances should it be written on paper. Employees should be made aware of callers impersonating IT staff. These calls are fraudulent and no one within the company would ever ask for their password. The third element is employee training. Employees should attend regularly scheduled security training provided by IT staff. They should be trained on how to recognized security threats and procedures for reporting them. Contractors and vendors whom business functions are outsourced should be investigated to ensure that have data security practices in place. The fourth principle is to pitch it. Credit card receipts, credit reports, or any other devices containing sensitive data must be disposed of properly. Throwing items in a dumpster or trash bin is unacceptable. Paper records should always be destroyed by shredding, burning, or pulverizing them before throwing away. Disposing of old computers, use wipe utility programs to overwrite the entire hard drive so files cannot be recovered. Just deleting files is unacceptable because the files can still be recovered (Federal Trade Commission, n.d.). The same procedures apply to employees whom work from home. The last principle is planning ahead in case there is a security breach. If a computer is compromised, disconnect it from the Internet immediately. All incidents should be investigated immediately and inform customers, law enforcement, credit bureaus, of the breach if they are affected by it. Concerning protecting personal information it is important to remember the following principles: take stock of the personal information stored, scale down, lock it, pitch it, and plan ahead.

Reference
Federal Trade Commission. (n.d.). Protecting Personal Information: A Guide for Business. Retrieved from http://ww.ftc.gov