Data security is essential for protecting digital information within organizations, focusing on the confidentiality, integrity, and availability of sensitive data. A comprehensive security policy outlines prevention, detection, and response protocols while incorporating best practices from recognized standards. Additionally, addressing common security myths and implementing multifaceted security strategies is crucial for safeguarding against threats from both external and internal sources.

1. Data Security
Presented By
Abdul Basit
Ubaid Ur Rehman

2. Data
 Data is any type of stored digital information
 Every company needs places to store institutional knowledge and data.
 Frequently that data contains proprietary information
 Personally Identifiable Data
 Employee HR Data
 Financial Data
 The security and confidentiality of this data is of critical importance.

3. Data Security
 Data security means protecting digital data, such as those in a database, from
destructive forces and from the unwanted actions of unauthorized users, such as
a cyberattack or a data breach.

4. Availability
 Data needs to be available at all necessary times
 Data needs to be available to only the appropriate users
 Need to be able to track who has access to and who has accessed what data

5. Security
 Security is about the protection of assets.
 Prevention: measures taken to protect your assets from being damaged.
 Detection: measures taken to allow you to detect when an asset has been
damaged, how it was damaged and who damaged it.
 Reaction: measures that allow you to recover your assets.

6. Security Policy
 A security policy is a comprehensive document that defines a companies’ methods
for prevention, detection, reaction, classification, accountability of data security
practices and enforcement methods.
 It generally follows industry best practices as defined by ISO 17799,27001-02, PCI,
ITIL, SAS-70, HIPPA , SOX or a mix of them.

7.  The security policy is the key document in effective security practices.
 Once it has been defined it must be implemented and modified and include any
exceptions that may need to be in place for business continuity.
 All users need to be trained on these best practices with continuing education at
regular intervals.

8. Tools To Secure Data
 Data needs to be classified in the security policy according to its sensitivity.
 Once this has taken place, the most sensitive data has extra measures in place to
safeguard and ensure its integrity and availability.
 All access to this sensitive data must be logged.
 Secure data is usually isolated from other stored data.

9.  Controlling physical access to the data center or area where the data is stored.
 Active or Open Directory is a centralized authentication management system that is
available to companies to control and log access to any data on the system.
 Encryption of the sensitive data is critical before transmission across public
networks

10.  The use of firewalls on all publicly facing WAN connections.
 Deploying VLANs’ and ACLs’ to isolate sensitive departments from the rest of the
network.
 Shutting down unused switch ports.
 If wireless is deployed, use authentication servers to verify and log the identity of
those logging on.
 Anti-Virus and malicious software protection on all systems.

11. Security Overview
 There are four key issues in the security of databases just as with all security
systems
 Availability
 Authenticity
 Integrity
 Confidentiality

12. Availability
 Data needs to be available at all necessary times
 Data needs to be available to only the appropriate users
 Need to be able to track who has access to and who has accessed what data

13. Authenticity
 Need to ensure that the data has been edited by an authorized source
 Need to confirm that users accessing the system are who they say they are
 Need to verify that all report requests are from authorized users
 Need to verify that any outbound data is going to the expected receiver

14. Integrity
 Need to verify that any external data has the correct formatting and other
metadata
 Need to verify that all input data is accurate and verifiable
 Need to ensure that data is following the correct work flow rules for your
institution/corporation
 Need to be able to report on all data changes and who authored them to ensure
compliance with corporate rules and privacy laws.

15. Confidentiality
 Need to ensure that confidential data is only available to correct people
 Need to ensure that entire database is security from external and internal system
breaches
 Need to provide for reporting on who has accessed what data and what they have
done with it
 Mission critical and Legal sensitive data must be highly security at the potential risk
of lost business and litigation

16. Top Security Myths
 The field of data security is rife with mistaken beliefs which cause people to design
ineffective security solutions. Here are some of the most prevalent security myths:
 Myth: Hackers cause most security breaches.
 In fact, 80% of data loss is to caused by insiders.
 Myth: Encryption makes your data secure.
 In fact, encryption is only one approach to securing data. Security also requires access control,
data integrity, system availability, and auditing.
 Myth: Firewalls make your data secure.
 In fact, 40% of Internet break-ins occur in spite of a firewall being in place.
 To design a security solution that truly protects your data, you must understand
the security requirements relevant to your site, and the scope of current threats to
your data.

17. Many Dimensions Of System Security

18. Description
 You must protect databases and the servers on which they reside; you must
administer and protect the rights of internal database users; and you must
guarantee the confidentiality of ecommerce customers as they access your
database. With the Internet continually growing, the threat to data traveling over
the network increases exponentially.
 To protect all the elements of complex computing systems, you must address
security issues in many dimensions, as outlined in Table

19. Security Issues
Physical Your computers must be physically inaccessible to unauthorized
users. This means that you must keep them in a secure physical
environment.
Personnel The people responsible for system administration and data
security at your site must be reliable. You may need to perform
background checks on DBAs before making hiring decisions.
Procedural The procedures used in the operation of your system must
assure reliable data. For example, one person might be
responsible for database backups.
Technical Storage, access, manipulation, and transmission of data must be
safeguarded by technology that enforces your particular
information control policies.

20.  Think carefully about the specific security risks to your data, and make sure the
solutions you adopt actually fit the problems. In some instances, a technical
solution may be inappropriate. For example, employees must occasionally leave
their desks. A technical solution cannot solve this physical problem: the work
environment must be secure.