Tag Archives: Data Privacy

Data Breach Incidents in Educational Institutions

Posted on by
Reply

paper-vs-digital

Shredding companies in Ireland are employed by educational institutions such as colleges and universities. These institutions are considered easy targets because of their open structure and long information retention periods.

Data Breaches have occurred in educational institutions ranging from lost laptops with sensitive information to targeted cyber-attacks and student identification cards. There are lots of other confidential data that is useful to attackers beyond payment data and student records; such as employee records, patient health information and scientific research data. Paper shredding or document shredding will reduce the risk of data breaches

Negative public exposure regarding a breach will have a negative impact on the reputation of the educational institution as well as the enormous knock on effect it would have regarding peoples data. In order to minimise the risk of any size of a data breach a Risk Reduction Strategy must be established.

Security in Shredding recommend a number of methods to include in a Risk Reduction Strategy;

  1. “Data Security” has to become “second nature” within the colleges and universities from the top down. A Data Security Informational Event should be organised by the educational institutions to inform in a fun way, the students and employees the importance of data protection and data security. You could look upon this as a form of training – Knowledge is key.
  1. Make students and employees aware of the Data Security Policies and Procedures. Use means such as bulletin board, posters, newsletters etc.
  1. Regular risk assessments should be conduct on an on-going basis to identify where the gaps in information security exist and to establish and provide the solutions.
  1. Physical Security of all sensitive data is very important. Secure restricted authorised access for key personnel is an important measure to take to minimise the number of unauthorised access events.
  1. Maintain a “Clean Desk Policy” and place all sensitive paper records that is no-longer required in the lockable secure console that is provided by the contracted Data Destruction Service Provider such as Security in Shredding.
  1. Implement and utilise IT security tools such as firewalls, encryption, anti-virus software etc. It is important to protect both digital data and hard paper data.
  1. Establish and use a Document Management Process for the tracking of documents, generation, storage and destruction of documents.
  1. Use the professional secure recognised services of a registered data processor whom is an established Full Data Management Service Provider, such as Security in Shredding whom provides a complete secure chain of custody for your data needs.

If you would like to find out more about on site paper shredding and or off site paper shredding, contact Security in Shredding’s Data Consultant Team on 067 24848. They are glad to help.

5 Best Practises Regarding Document Management

Posted on by
Reply

paper-vs-digital

Paper shredding is important practice for businesses in Ireland. A confidential shredding specialist will remove unwanted document and destroy them in a secure manner while also help remove clutter from the office.

Offices should avoid having files, documents and detailed paper information scattered on top of filing cabinets and desks. In every organisation regardless in size, it has a responsibility to manage the information it handles in a secure and organized way. It should be a priority or each and every organisation to minimise the risk of a data breach;

Security in Shredding have outlined below the top five best practises for Document Management whom they encourage every business to follow;

  1. Indexing & Filing:

    An organised document management system has an effective and current index system based on the file contents and compliance requirements. The organisation should manages file creation in an efficient manner whereby no duplication or irrelevant copies are filed and records retention periods are clearly labelled on the files or storage boxes. Security in Shredding would recommend implementing an electronic file tracking system to manage where documents are in their life cycle, and show whether documents are active, archived, or ready for disposal.

  2. Secure Storage:

    Sensitive data stored on hard paper data and e-data should be securely stored and protected either in locked cabinets or a locked room. Many organisations produce a substantial volume of paper as a result from employees conducting their duties, making notes, printing of emails, discussion notes, to do lists – the list goes on. It is just as vital that this paper production is securely stored in lockable consoles when the employee has not longer got a requirement for it. Security in Shredding encourage organisations to implement a Shred-all policy whereby all paper produced in the offices that is no longer required is placed in the secure consoles for destruction at a scheduled date.

  1. Limited Access:

    It is vitally important that limited access is maintained with hand-picked specific employees having the secure access to the file sharing system the organisation has in place. Security in Shredding recommend using a system that uses authentication and password protection to control access and track and manage who can view them.

  2. Retention and Destruction Schedule:

    All documents and files should be clearly labelled by what they contain, retention period, and end of life date. When documents reach their end of life they must be securely destroyed. Security in Shredding recommend outsourcing the destruction of all or any sensitive data to a certified professional whom are registered data processors. Also the Data Destruction Service Provider should provide a chain of custody from the time the material is placed in the secure lockable consoles to the secure removal of documents for shredding. The service provider should be able to provide certification for their ability to shred the sensitive confidential data to Shred No. 6 of the EN 15713 European Shredding Standard. A Data Processing Certificate should be issued post every service delivery.

  1. Staff Training:

    It is imperative that all employees are trained and fully understand the importance of Data Protection. Security in Shredding recommend every organisation to employee a Data Compliance Officer to enforce information security policy and ensure all aspects of Data Protection Legislation are adhered to.

If anyone has any queries regarding any of the important points illustrated, please do not hesitate to contact us to speak to our Data Consultants.

Our confidential document shredding services are available throughout Ireland. We regularly operate in the Limerick, Galway, Dublin and Cork areas.

Please visit our site for more information: https://www.securityinshredding.com/

Minutes To Happen & Weeks To Realise; Data Breaches

Posted on by
Reply

Phising Most Common Data Breach

At Security In Shredding we ensure that all data processed by us is confidentially and securely destroyed. Data destruction is vital part of business practice. Data security is paramount to us and the success of a business. Preventative methods to improve your data security comes in many forms. IT security is an area that can overlooked due to newer technologies and people not aware of IT pitfalls.

A report from Siliconrepiblic writes about a common data breach method and is important that people are aware of such an attack. Knowing these potential risks is important is today’s high tech world. The article writes:

“Phising” What Is It ?

A Google search will give you the following definition:

“Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money), often for malicious reasons, by masquerading as a trustworthy entity in an electronic communication.”

Phishing is still the No 1 cause of data breaches and hackers are getting faster at breaking in, but firms are struggling and usually only find out weeks and even months later they have been breached, according to the 2016 Verizon Data Breach Investigations Report.

According to the report, in 93% of cases it took attackers minutes or less to compromise systems.Meanwhile, it took companies weeks or more to discover that an incident had even occurred.Worse, it was typically customers or law enforcement that sounded the alarm and not the organisation’s security measures.

‘A test we ran last year found that 23% of people that opened a message went on to open the attachment. In our latest report that has increased to 30%’
– LAURANCE DINE, VERIZON

According to the report, most reasons for breaches are money-related and cyber-attackers are indiscriminate and motivated by greed rather than revenge or some crusade.

Gone Phishing, Gone Data

Laurance Dine, managing principal in charge of investigative response with Verizon, told Siliconrepublic.com that phishing is still the chief method hackers use to attack organisations.

The report found that, in 2016, some 63% of confirmed data breaches involved leveraging weak, default or stolen passwords. Passwords such as “123456” and or “password” are used more often than you think 39% of breaches originate from victims’ own work areas and 34% from employees’ work vehicles.

Some 70% of data breaches involving insider misuse took months or years to discover.The report also revealed that new technologies like mobile and the internet of things are providing hackers with more ways of breaching an organisation’s systems.The industries most affected by data breaches are the public sector, healthcare and information.

Dine told Siliconrepublic.com that the data information was gathered from more than 67 partners worldwide and involved the analysis of 2,260 confirmed data breaches.

“There is still a serious information deficit when it comes to attacks. Attackers are getting into environments in minutes or days and it could be months and years down the line before anyone is aware of it and they usually hear it from law enforcement.

“Phishing is still the principal method of attack. A test we ran last year found that 23% of people that opened a message went on to open the attachment. In our latest report that has increased to 30%.”

“But if you are after the low-hanging fruit, the No 1 motivation for data breaches is still financial. Any data worth any value is a target.”

Read Siliconrepublic full article here: https://www.siliconrepublic.com/enterprise/2016/04/25/verizon-data-breach-report-2016

At Security In Shredding we strive to ensure that all documents and its data is processed securely destroyed on site or off site. Confidential shredding services are available throughout Ireland and we regularly operate in the Dublin, Galway, Limerick, Cork areas. Please visit: https://www.securityinshredding.com/

 

Addressing Incorrect Data Destruction Habits

Posted on by
Reply

Data Protection, Paper Shredding, limeirck paper shredding

Shredding confidential paper in a business must be done and there are legislations in place to protect against data breaches. Failure to enforce these laws or inadequate data protection in place by a business will result in a hefty fine of up €100,000.

Human error is is arguably the biggest cause of data breaches are caused by employees and contractors. Human error is not solely to blame. Even high profile hacking cases involve employees inappropriately clicking on links and allowing the bad guys in. It is quite easy with a little bit of know how you can be easily tricked and baited into clicking a malicious link that will cause a data breach.

When it comes to proper data destruction, or avoiding data breaches due to improper destruction of data and confidential information. It comes down to employees knowing the dangers and pitfalls of potential data breaches within the office. Despite any amount of training, however, there is one lesson too many data controllers have learned the hard way. In order to maximize compliance, proper disposal of information has to be easy for the employee.

Some organisations might require employees to use a shredder in the copy room which is not easy. So much so that it is not even reasonable to think they will consistently do it. Whether because of carelessness, workload issues, pressures outside work, or laziness, compliance failure is inevitable. Nor is it reasonable to give employees the discretion on what is destroyed or options on where information-bearing media should go. Whenever a recycling bin is next to a shred bin, it is easy to find confidential information in the recycling bin. Making this process as easy as possible for our customers is recommended. We clearly have each console labelled so our customers know exactly what we can and can’t take in our locked consoles. We provide staff awareness days to help businesses improve their data security.

Data Protection, Secure Paper Shredding

The same goes for IT asset disposal. Since employees are less likely to toss out computers, it can be less of an issue. However, leaving the decision to the IT department instead of dictating the procedure through security and compliance can cause a problem. With electronic storage devices there is no true way to destroy the data using software. A physical destruction of the device must be done to ensure data destruction.

Educate and Awareness for you and your employees benefits with proper data destruction. Contacting a Secure Confidential document destruction service to incorporate into the business practice will improve your data security and destruction.

For more information on a secure document destruction service in Ireland, then please visit: https://www.securityinshredding.com/ or

please like, share and follow us on Twitter: @Securityinshred

5 Reasons to Hire a Data Destruction Service Provider

Posted on by
Reply

Media Destruction Data Protection

Confidential shredding is available in the Limerick area provided by Security In Shredding. Incorporation a data destruction service into your business practice is beneficial for your data security and data protection. While also being a good recycling practice.

Top 5 reasons why you should hire a Data Destruction company such as Security in Shredding:

  1. Data Security

In order to protect confidential information and reduce the risk of a data breach, Security in Shredding advise to outsource data destruction requirements to a professional, certified service provider. All data containing personal information must be securely destroyed when it reaches its end of life.

“An office shredder simply can’t provide the same security as a professional company. A reliable document destruction company provides a secure chain of custody, from the time the documents are collected, through to shredding using cross-cut shredders, and ends with” a Data Processing Certificate after each service delivery.

  1. Compliance

It is not just simply destroying documents that are no longer needed, but it is both best practise and it is in Data Protection Legislation.

data destruction and collection service

  1. Saves Money

By outsourcing your data destruction requirements you are cutting out the cost of purchasing an in house shredding machine, maintenance costs resulting in saving money. You are also reducing the amount of employee down time spent on the shredding of data resulting in the employee being 100% focused on their own job.

  1. Convenience

A renowned shredding company will provide the client with lockable receptacles and locate them in suitable and convenient locations around the building. These locations will be previously identified with the client to ensure the employees have ease of access to place paper data awaiting destruction.

At a prearranged date and time Security in Shredding will arrive on site and remove and replace the receptacles of paper for destruction with little or no disruption, for shredding.

  1. Additional Services

There are a number of other mediums of confidential data that needs to be destroyed. Out of date PC’s, e-data carriers and storage devices also require destruction when the data on them reaches end of life. Research has shown for example that wiping a hard drive is not a guaranteed method of destroying the e-data contained within but physical destruction is the most reliable method of destruction of data. You have total peace of mind that the data is 100% beyond reconstruction.

For more information on a data destruction and media destruction service, please visit: https://www.securityinshredding.com/limerick-shredding-services.php for more information. We are also available throughout the country along with Limerick our paper shredding is available in the Dublin, Galway and Cork areas.

Follow us on Twitter @Securityinshred and please like, subscribe and share.

How to incorporate Recycling into Data Management Security

Posted on by
Reply

Improve Office Environment Usage

Many organisations are unfamiliar with how to incorporate methods of recycling in the workplace whilst maintaining Data Security. Shredding companies in Ireland can provide you with a recycling service for your business.

Security in Shredding recommend to have the following;

  • All open and unsecured paper recycling bins in the workplace replaced with Security in Shredding’s lockable office friendly consoles. The benefit of using these consoles is that you know your confidential documents are safe from prying hands and eyes. Your documents cannot be retrieved as the consoles have bevelled slots.
  • Each and every desk should have a specific paper waste bin that is used only for office paper waste. At the end of each employee’s working day, the employee takes the waste paper bin to the lockable console and empties the contents into the console. If an Organisation implements and enforces this process, it will greatly reduce the risk of a possible data breach. As many data breached are as a result of human error, the employer is not relying on the employees to distinguish the confidential paper from the non-confidential paper. This Policy is call a Shred-All Policy.
  • A service provider that employees security-vetted staff to conduct service deliveries. The client has assurance that the personnel whom handle the confidential documents have received extensive security awareness training and have a great understanding of Data Protection Legislation.
  • A service provider whom provides its onsite and offsite shredding services via shredding technologies that are certified to Shred No. 6 of the EN 15713 shredding standard. The benefit of having a Data Destruction Service Provider whom is certified to this shredding standard is that you have total peace of mind and you know that the shredding service is off its highest level.
  • The vast majority of organisations are Data Controllers. Therefore these Data Controllers should most certainly use a Data Processor to processes its confidential data when I reaches its end of life. A Data Processor should issue its client a Data Processing Certificate detailing the quantity of material destroyed, the material type, date of destruction, name and location of the client and the shred number and shredding standard the material was shredded to. The certificate is proof of destruction and allows the client to keep track of data destruction for compliance and other data management purposes.
  • Security in Shredding transport all destroyed paper material to licensed and permitted recycling facilities. The paper material is sent to paper mills. Printing ink is removed and the material is turned into pulp and it is then used to manufacture new paper products. An interesting fact; one tonne of recycled paper saves 17 mature trees and reduces carbon emissions.

By implementing these changes you are contributing to making your organisation greener and whilst increasing the level of data security. For more information on a paper / document shredding service please visit our site for more information.

www.securityinshredding.com 

The New European Data Protection Legislation

Posted on by
Reply

“Cannot be ignored by any business.”

Security In Shredding on site service

At Security In Shredding when shredding confidential documents we must comply by the EU standards. These standards along with the Data Protection Commissioner ensures that our work is done to the highest quality. Security is paramount and failure to comply with these laws can result in a hefty €100,000 fine. These laws also apply to all business that handle sensitive data.

The EU Data Protection Rules that are expected to come into force in 2018 will have an effect on all business and cannot be ignored according to legal experts in the field. The final text was agreed upon in December 2015 after years of negotiations and analysis.

The new regulation is aimed at harmonising the European Data Protection Legislation and reforming the outdated EU directive on Data Protection and replace all inconsistent laws across the European Community.

Even though the digital economy is at the core of this new regulation it is ESSENTIAL to note that physical data is also covered and holds the same fines and penalties which are described below.

One of the most eyebrow raising and awakening points from the new regulation is not only that it gives rise to increased compliance requirements but breaches in compliance are backed with heavy financial penalties which have turned out to be up to 20 million or 4% of annual turnover, whichever is the greater.

The journey to compliance

From the experts here at Security in Shredding; Organisations approach to comply with the GDPR will need to include three key components; These are:

#1) a compliance journey

#2) a transparency framework and

#3) enforcement, sanctions and remedies framework.

The compliance journey requires Organisations to classify the personal data in their possession; complete risk assessments; apply privacy protections into all existing and new business operations; employ and empower dedicated data protection officers; monitor and audit compliance; and document everything they do with data and everything they do to achieve legal compliance. All data stored electronically and physically will have to be managed appropriately. Waste paper will have to be destroyed through certified data processors and not enter general waste streams.

The new transparency framework will mean that Organisations need to redevelop how they engage with external people including all external vendors that process material for them, service such as paper shredding, external invoicing, digital data destruction and marketing will all have to review how they process information and give clear and full information on what is happening to personal data.

The new enforcement, sanctions and remedies framework will give appointed data protection officers high authority to make decisions for the protection of personal data and achieve compliance for their Organisation.

Please visit our site for more information on shredding confidential paper.

Join in on the conversation on Twitter @securityinshred

 

 

Common Mistakes Businesses Do When Maintaining Security Of Sensitive Data

Posted on by
Reply

Answer;              

Not properly classifying the sensitive information, managing it accordingly and in turn protecting it against current threats.

 

Secure Paper Shredding Hard Drive Shredding WEEE Destruction

 

As you read this from your mobile, tablet and or computer you are viewing data digitally. Paper shredding in Ireland and industrial paper shredding services offer data protection services for said devices. Knowing technology pitfalls is a massive part to data protection while also knowing how and when to share your digital information must also be considered.

There are three critical points to the proper protection of sensitive data.

  1. Data Classification

In line with European Standards; Companies must understand what data needs to be protected and create a Data Classification Policy. This policy in turn will classify data based on sensitivity. At a minimum three levels of data classification are needed.

    • Restricted: This information requires very high protection, Unauthorised dissemination would have serious terminal consequences for the company and infringe trade confidentiality obligations, contracts or laws. It is essential that the confidentiality of personal data is maintained. Otherwise there is a risk to the health and safety or personal freedom of the affected persons.

All data that reaches its end of life should be destroyed to a minimum of Shred No.6 of EN 15713 to ensure destruction beyond reconstruction.

    • Confidential or Private: This is moderately sensitive data that would cause a moderate risk to the company and could infringe legal obligations or laws if compromised. Access is internal to the company or department that owns the data. There would otherwise be a considerable risk to the social standing and financial situation of the affected persons.

All data that reaches its end of life should be destroyed to a minimum of Shred No.4 of EN 15713.

    • Public: This is non-sensitive data that would cause little or no risk to the company if accessed. Access is loosely, or not, controlled.

All data that reaches its end of life should be destroyed to a minimum of Shred No.3 of EN 15713.

 

  1. Encryption – All Organisations should have an encryption strategy in place to ensure all staff are aware and capable of utilising it correctly. The essential element to a good encryption strategy is to use strong encryption and detailed key management.

 

  1. Cloud Misuse – Essentially cloud storage translates to storing your data on someone else’s computer. When it is uploaded, the control over it is no longer only yours. Encryption should always be implemented prior to uploading to the Cloud. It is always advisable to read through the cloud providers policies with regard to handling data.

 

The most important thing for business is to be aware of the technology pitfalls. Secure document destruction in Ireland and its data protection laws are different to other countries. While the laws may be different country to country, the method of data breaches are usually the same. The more you know the better you can protect yourself and business from data breaches.

For more information on a secure document shredding service in the Dublin, Cork, Limerick or Galway area please visit: www.securityinshredding.com

Feel free to join in on the conversation @securityinshred

Top 5 Workplace Security Tips

Posted on by
Reply

secure data, workplace security

Workplace Security does not just mean a simple office shredder. Data Protection comes in many forms and is worth knowing these methods.

Data Protection is an important part of business practice. Paper shredders are often used to shred confidential documents. Your standard office shredder does not provide adequate security when shredding. An Industrial paper shredding service will provide a secure document destruction method for your business to use.

Along with paper shredding, there are many other forms of security you and your business can incorporate into everyday practice. We live in an age where data breaches are becoming more and more common which makes protecting this data ever more important. Digital data is now an area of protection and is often overlooked. These over sights is what cyber criminals will prey on and thus a Data Breach will occur causing severe damage to your business reputation.

 

Tip 1: Outsource your secure and confidential document destruction requirements to a certified professional Data Processor whom is reputable and reliable.

Tip 2: Enquire with your current data destruction provider about their e-media services. Hard drives and other types of media should either be shredded or crushed to ensure all the electronic data is securely destroyed and beyond reconstruction. If your service provider does not provide same, contact a member of our team whom are more than happy to help with your enquiry.

Tip 3: Choose a Service Provider that uses secure certified document destruction technologies, lockable consoles and/or locked 240 Litre wheelie bins, issue Data Processing Certificates and operate with a secure chain of custody.

Tip 4: Appoint a Data Compliance Officer in your Organisation whom is responsible for ensuring compliance regarding the correct management of both paper data and digital data within an organisation.

Tip 5: Conduct regular staff refresher training days regarding the importance of information security and the processes associated with same. Have training material prepared and on hand for induction training when new employees begin.

 

For more information on paper shredding and confidential document destruction in Ireland please visit: www.securityinshredding.com

Reasons why having a “Clear Desk” Policy is beneficial for businesses today

Posted on by
Reply

confidential shredding, clean desk policy

A clear space, a clear mind. Paper shredding is a good habit to help clean up and also protect your data. Confidential document shredding service will help you clear out unwanted paper and documents that may have built up over the years.

(Shred your waste paper data)

It is the time of year for new beginnings, new healthy practices and in the business arena new accounting years. Even though we advocate best healthy practice we will now take a look at kick-starting some best practices for housekeeping within your place of work.

When looking around in your offices; are you looking at paper documents stacked in areas to be “Got to at some stage”, as we have begun new healthy habits in our personal lives it is also a great decision to look at implementing a clean desk policy also known as “waste paper procedure” within your offices.

Similar to a clean eating policy where you maintain clean and healthy macronutrients entering your body, a clean desk policy will direct your employees in maintaining a clean desk at all times during their working day.

We are all aware of the benefits of having a clean working area, “a tidy space equates to a tidy mind” however, a clean desk policy will also empower your Organisation to protect data in line with Data Protection Legislation.

Simple guidelines to protect your working data, whether the data is sensitive commercial data and/or personal sensitive data is to;

  1. Passwords and encryption upon electronic data carrier
  2. Have lockable cabinets within your office areas
  • Other suitable secure storage if/when required
  1. Once any of the data has been used and is no longer required you should insert it into secure consoles (Cabinets) awaiting destruction.

A well detailed and structured “Waste paper Procedure/Clean Desk Policy” really is of serious benefit to any Organisation and protects you in many ways such as;

  1. Saved money and resources
    Using a clean desk policy and having a certified vendor saves money upon downtime for staff in destroying old data
  2. Protect your Organisations Data and improve upon internal data flows

Detailing to staff that data digitalisation is the new company policy you will save money upon printing costs, increase efficiencies in data transfers and maintain business competitive with new data storage technologies.

  1. Data Protection law compliance
    It is essential for business to comply with the relevant Data Protection Laws in their jurisdictions, this includes not leaving it resting upon desks for casual bystanders to see the details; the Organisation in turn is protected from receiving for non-compliance fines and penalties
  2. Reduced data breach risk
    When private and sensitive information is protected from unauthorised view, there is less likelihood of information theft, fraud or a security breach, the costs of which can run into the £millions – in fines, reputation damage, and lost business
  3. Create a stronger reliability within your firm
    Ensuring that sensitive information is not left on desks will provide management with peace of mind that possible insider fraud is reduced to a minimum risk.
  4. Create a positive working environment
    As previously covered, a clean and tidy work space results in a clean and tidy mind enabling employees to be happy and consistent with their work duties and create an overall positive atmosphere within your workplace.

For more information, handy tips and beneficial help; Join the conversation on information security with Security in Shredding on Twitter @SecurityInShred.