Revising two papers : Argument paper and exploratory paper

Chi wai Lai

Prof'essor Kauflman

English 1

17 May 2014

t4OU,rcfj- tA rtnrrwA dn Ls6W-'-

fnil^^ )'

1t^;

W

Placement pf Restriction\on lToot rrr\)

Information \,

With increasing compromise on security for confldential infbrmation, technology has

been abused such that conf-identiality is not highly considered. In our daily lives and even our

to be an important aspect and thus to curb

should be enhanced so that data and information is

highl;" saf'eguarded. Due to the rising need fbr infonnation people utilize intbrmation technologl,'

and in the process. inlbrmation is shared and the machinery gets int'ected by viruses and worms,

which end up deleting files and documents crucial-to a firm's functions or a person's confidential

information and people have also lost the personal infbnnaTi6h to several cases such as

hacking, malr.vare attacks and neb server attacks. Theretbre in the process of establishing

LAI 1

brmation Technology order to Secure Confidential

work information technology ha3

lack of col-

,k,Pfl ^yttormaym*ef\ ^ ypformayofi-(Kaspersky lab. 23\ Therelore curbing insecurities in I.T is a hurdle since the'u^,-,lA'(V4-' \ 1g;-il,1rllt€ / ^r.- ttt^a|M>Lgruu \-E r*yA,\U^ situation cannot

(Kaspersky lab,

individual level and even in

@tqeytC9," '. The perspective being iaicl in this topical issue is that legal restrictions should be intact tr/rl" U J,r,'l

,ry.yfuN, addressing the need for saf-et1,'of inlbrmation and data:ln*lTel_:.1.:r instance. a lot has been t4ti,0- f \=-I i--- done in orderto achieve conficlentiality of infbrn{qtion. Several tinns ha}e lost criticalion. Several llnns -%.*cid..c'

nolicies upaD

LAI2

procedules to ensure protection of personal data awareness has to be created to all t'(e $ fiYOrrei{

an r them to know the kind of digital threats the1, face.

Restriction should theretore be put in place so that conlldentiality of data and information

is not compromised. Any loss of confidential data r,vill have the ability to be traced since

€* someone will be vested with the duty of ensuring security of infbrmation. Through restrictions

also. it u-ill be easy to save on costs that come together with loss of infbrmation.

individual states, what action have the-v employed in order to ensure that such never occurs

again? It is essential that a firm puts in place policies and regulations that will regulate

procedures of obtaining data that belongs to the firm (I egislative Guides for the Implementation

of the United Nations Convention against Transnational Organized Crinre. l4). Policies and

regulations introduced to any environment should be able to reduce cases of attacks b-v hackers.

mallr,are and worms or an)'other fbrm of attack. 81, doing this it w'ill be possible to mitigate

other consequences such as hacking and u'eb server attacks.

For critical and personal infbmation. audits should be undertaken to identif,v ail personal

data and their locatio,n. Risks associated u.ith storage. handilng and protection of this data should

6lkn, be rnade clear tg the ollner of the intbrmation so that the-v are a,ware of the risks the,v are 1ikel1'ttl

4 ,

{*rPs

A,r. S/Yr,4,['

'

M-eh'L

r lt.)

91a' | ( I.

tace uporr loss of personal i to all data and server rooms

in r,vhich data is stored should be restricted onffi t stafTmen-rbers rvho permission to uork

there. 'I-his can be enhanced b-v use of srvipe cards or pin technolog,v in the rooms and thus it "r'ill

be easier to identil,v people in case of an.v breach to losing critical clata and information. Access

rccords and procedures have to be revieu,ed regularit, be the management in place.

According to Legislativc Guides fbr the Implementation of the Un:ited Nations

As insecurities increase in f-rrms. political sceneb,

(Kaspersk1, lab. 23).

? Tm' dM

'ffi*lrvr NY,^O&)^*nlL

LAI 3

Convention against -fransnational

Organized Crime (34) mitigating loss of critical infbrmation

entails the use of passwords which are only knowrr to the individual or the management.

Therefore passr.vords used to access personal computers and application databases should be

credible enough and should be able to sense password cracking and guessing attacks. If possible.

passwords should include numbers, symbols, upper and lou,er case letters to make it more

complex and only known to the individual. They should also be changed on regular basis to avert

insecurities.

.-' With the govelxments facing the same issue of insecurity and lack of confidentiality. thea {

\ American government has ensured that this issue is reduced through the current implementation t

I

! of the Health Information Privacy Act. This came as a result of the need to secure and make a I, --" i patient's information secure and more private. i L*-t

@eriesof2010statesthatMedicareandmedicalservicesinevery

uritv Standard ion of Electronic

Health Information security rule. This rule was adopted to implement provisions of the

ility and Accountability Act. Compliance of the HIPAA encompasses all

IPAA covered entities fbr instance covered health care providers. These are Medicare

providers u.ho provide medical or other health care services or suppliers who transmit any health

information in electronic lbrm. Another group that has to compl-v rvith HIPAA rules is any'

individLral or group that provides or pavs costs of health care lbr instance health care insurer.

HIPAA Act is meant to protect priracy of an individual's identiflable health infbmation and

thus it enhances integritl, and confldentialit.v of health data (U.S department of-health sern,ices

and human services. 21).

Health Insurance

I,AI4

Why shoulci there be compliance to securit\. nreasures such as I{iPAA fbr health

agencies? The U.S department of health services and human services. (1 1) states that there is

need fbr to adopt confidentiality and integrity when it comes to a patient's health information.

New technologies are evolving in the health care industr-v and there is need to do all'ay

with paper w.ork processes which compromise on privacy of patient's infbrmation and data.

Therefore. in order to provide more efl-icient access to critical health intbrmation, covered

entities are using r.l,eb based applications to give ph-vsicians. nurses and health administrative

employees more access to electronic health information. Providers are also utilizing clinical

applications such as Computerized Physician Order Entry (CPOE) systems, Electronic Heaith

Records (llHR), radiology, pharmacy and laboratory systems. Health plans as provided in the

FIIPAA Act involve provicling access to claims and care management and also member self-

service applications. All these components are meant to enhance mobility and efliciency in

medical provision since phy'sicians can check patient records and tests liom any place.

For the case of companies and other government agencies w.hich require strict

confldentiality of infbnnation, network designs and network security controls should be made in

a way that security of the system is not compromised. The layout of the design if not rvell

arranged can leaci to attacks by malware and hacking. Personnei should be put in charge of the

netu,ork system to ensure that int-ormation is secured and that the network is also in good

capacity to manage transf-ers of data and intbrmation. To mitigate losses that could be brought b1'

the nature of the network design. at each step. securit,v fiameworks should applied so that no

situation is compromised. Technical personnel w'ho are experts in the field shor-rld advice the

f-ims on the best netu,ork designs so that the kind of netr'vork adoptec'l becomes compatible rvith

security poiicies and activities of-the firm.

\ \

LAI 5

Data authentication is necessary as it reduces chances of data rnodification lr,hich is

caused by malr,vare. This process is helpfui in enhancing integrit,v of infbnnation. It is advisable

fbr the company therefore to enhance security of data by applying data authentication as it will

make undetected modification of data impossible (Kaspersky lab, 19). In all processes the

compan,Y should be supporlive in budgeting tbr security controls and monitoring the situation.

In enhancing confidentialit.v and security of organizational and personal data and

information external service providers rvho attend to duties at lvork place should be subject to

strict measures. These could be contractors and consultants and who should not be given liberty

to access personal data unless provisions under the Data Protection Acts are compiled upon.

Within departn,ents of the organization there should be an up to data acceptable usage policv that

reiates to intbrmation communication technoiogy such as n-robile phones" fax. internet and

remote access. This policy should be understood and agreed upon by each user of such

technologv in the organization (Challenges and Best Practices in Cybercrime Investigation, 18).

In event of disposing files both electronic and paper. elTlcient procedures should be

fbllowed so that personal data is not conrpromised. Disposal of computer equipment should also

be ascertained such that their destruction and disposal becomes efllcient in disposing personal

confldential data. Therefore. ernplo,vees in an organization should be aware of the Data Privacv-

Act which is comprehensive in ensuring adequate disposal of firm's critical data or personal

data. For organizations that deai u,ith financial information high ler.els o1'secrecy and

confldentiality should be keenly'implemented (Challenges and Best Practices in Cybercrime

Investigation, 28).

Ner,r, staf t should be taken through induction processes to lamiliarize them with eff-rcient

organizational culture and be coached on how'the organization highly,prioritizes on saf-eguarding

LAI 6

critical personal infbruation. Organizationai structures should be etfective in addressing its

inrerest in safbguarding emplo-vee information. Access to personal t-rles and inlbrmation should

be the responsibility of the infbrmation technology personnel rvho have sw'om to ensure

confidentiality.

Legislative Guides for the hnplementation of the United Nations Convention against

Transnational Organized Crime (14) provides that in any organization that utilizes technology to

caffy out its activities should ensure that callers to the olfice and other visitors are tlot given

permission to look into personal and sensitive information whether in paper or in electronic

tbrm. Contldentiality thus has to be taken seriously and the staff should be on the tbrefront to

advocate fbr privacy of their personal infbnnation. All computers and internet sites should be

lock u,henever they are not in use. StatT should not be allor,ved to sat-e infbrmation on local disks

but there should be a sat'e allocation in the netr,vork drive that ensures securitl. of personal and

organizational critical data.

' ,.t,

is true that in the current technology and the digitalization era we are. personal data and

infbrmation critical to an organization has been compromised. The solution is in changing our

perspective of technologv and placing regulations on access of information in order to ensure

confidentiality and saf-ety.. In cases u.hich involve crime and majorl-v c,vbercrime, individuals

should note that it is punishable by law and harsh coutl penalties.

worrdGa

the health safbt,v and well-being of America, (2011).

LAI 7

,., VV ()t Krtltl4tU

I I

U.S departrhent oihealth services and human services " Health iffirmcttion privctcy ", Improving

the health safbt,v and well-being of America, (2011). Retrieved from r,vwr,v.hhs.gov o

"()hallenges ctnd Best Practices in Cybercrime Investigation". (2008), retrieved from:

'r',^ rv rn atei,er,j p/en gi : ^h r,r,l f/PT'lF-rm sin o?Cr,l 1 5-p 1 07 1 1 2,1d1'

Kaspersky lab " Globctl corporate IT sectu'ity risk.s " , (2013)" Retrieved tiom

uus . k usp)$ I ! a !1. ce1ll

"Legislatitte Guides.for lhe Implementotion of the L,nitecl l{crtions Con'-ention aguinst

Transnationul Organized (..rirne " (2004) pa-ire 217. retrieved fiom:

Trr-r119/o20r,ersi