How important are the controls in the organization to prevent these types of data breaches or data theft?

Controls are basically the safeguards or the countermeasures deployed with a purpose to detect, avoid and minimize the impact of any security risk, mostly in this particular order.

All the different types of controls which organizations can have to prevent computer thefts.

Now broadly information security controls will come under the following ten categories;

1. Hardware in physical control.
2. Software in logical control.
3. Network control for data and transit.
4. Operating system controls
5. Preventive or detective control
6. Physical or hardware control
7. Software security controls
8. The detection control
9. Mitigation controls
10. Encryption and decryption

Now hardware is an essential component of information asset control of hardware equipment mainly involves the following step: identifying the hardware information asset and recording the hardware right from the procurement stage.

Classifying the hardware on the basis of factors like critical monetary value, keeping an inventory control, monitoring the movement of Hardware, inter-department, intra department and constantly reviewing the controls initiated for their adequacy and effectiveness.

Now this is the basic hardware and physical control which the organization’s need to have. Every organization needs to know that

What is the hardware equipment? 

What are the hardware computer peripherals which are there in their organization? 

So you need to be able to trace that hardware which should be distinctly identifiable and this is one of the most important and critical factors for making sure that you have hardware and physical controls in your organization.

Now barcoding is one of the most effective ways to control this and it should be done on every equipment or the hardware device which you have in your organization which is the first point of entry into the organization.

Now such a system will ensure foolproof maintenance of not just physical entry of hardware equipment but also it will help for financial and accounting purposes.

Now barcode scanners should be made available in every department in the organization and should be used even for the smallest item recorded.

This will definitely have a better result in terms of overall management of the assets of the organization as well.

So nowadays, there are 2D barcodes which are capable of recording more information about the product name, price quality or description.

The earlier barcode readers were very simple and were very cheap as well which recorded very limited information but the new 2D barcodes are capable of securing more information.

Now there are mobile phones that can also read barcodes and scan code and the malls. If you go you will find these types of controls.

Now the form of control which is very popular these days is called RFID Circuit which is also called Radio Frequency Identification.

This can also be used for hardware tracing and monitoring for tracking employees movement inside a huge office complex.

RFID tags are affixed to the equipment or as a part of employee personnel. An employee’s supposed to carry it like a smart card or other cards. It works as an antenna circuit designed with RF signals getting radiated while barcoding is much less than one rupee per equipment.

It is a bit costly but it goes to a different level altogether. You can use an RFID reader to identify an object from 3 to 4 meters depending upon the capacity. So in a way you are securing more information if you are using an RFID circuit.

Now let us talk about software security controls. As we have already spoken about hardware security controls in the organization. We are going to talk about software security controls which may be broadly classified as;

1. User level controls,
2. Application controls,
3. Database controls,
4. Operating system controls etc.

Now as a technology user and as an application user, the user himself has some controls to take care of the information asset like having an updated antivirus, not clicking an untrusted link, not giving information on an HTTP site.

Now these are some of the basic software controls which not only the organization needs to have but also the individuals working in the organization need to be sensitized and trained at least on the basic idea where no skills are very important.

The output control also forms a part of application control in a bank, typically taking one or more copies of a Bank draft is a serious crime.

Now output control plays a crucial role in areas like taking printouts of FDR receipts, security papers like drafts and bankers cheques.

Keeping a proper track record of printouts and preservation of printed logs are all part of output controls on physical security controls.

Now let us talk about the third type of control which is called database control. So we have spoken about Hardware control, software control and now third is data controls.

Now it is normally part of the design stage taking into account different factors such as the security features provided by the database management software, version of the database management software, maintenance of that sort for security and controls that are to be provided by the application, network, bandwidth etc.

On the database level, designing the schema is quite important. A schema is the context of a database and refers to the structure described in formal manner in language as a part of a particular database management system in the organization of data in different tables and components.

Now understanding the schema supported by a particular DBMS is very important to design and decide the security features that may be built as a part of the schema of our DMS itself so that security capabilities of the database are fully exploited.

This is important so when we are talking about database control, it’s all about the designing of the database software which you are using in your organization.

What is Data Definition Language – DDL?

DDL is basically a statement to create or alter an object, that is creation of a table or alteration of a database scheme. This is called a DDL database.

What is Data Manipulation Language – DML? 

DMLis used as a statement to retrieve data, insert data, modify data and delete data and do such manipulation in the data in pursuance of broader powers assigned in the database server.

Difference between DML and DDL:

DDL is basically a statement to create, alter and drop an object in the database and DML is used to retrieve, insert, modify or delete an entry in the database.

Now prevention controls may be preventive or detective; a preventive control is one which prevents an attack from occurring or just prevents the external attacker from meeting the vulnerability and affecting the information acid.

Accounts department of your company deals with the financial
resources and transactions. There are certain legal issues which may arise
instituting criminal as well as civil liabilities including tax matters

Now some of the most effective preventive controls are physical and hardware control such as posting a physical security guard at the entrance, intrusion prevention, barbed wire fencing and unified threat management. This is the physical prevention control which you can have in the organization.

Now software security controls information security policy whether it’s adequate and implementation is done properly running an anti-virus and anti-malware software and all the PCs’ effective password management internet email and other related policies.

Now if you follow these preventive controls they will never be a computer fraud in your organization.

So in most of the bank’s the frauds the one common point of major breach has always been the password policy so the password policy has to be well-defined and the users, the people, your employees have to be sensitized in thought and in fact trained on how to use their passwords.

Now incidents like tailgating and masquerading are some of these access methodologies for gaining illegal entries to information resources. This is important or masquerading is the kind of entry to a critical room where more than one person enters with the same idea or token or card which can be very dangerous for the organization because the other person may have criminal intent.

Now both these are possible in the case of software access when a person leaves the session open after a valid login and the same is utilized by an intruder. It will go to a tailgating session to check.

Such kinds of access and proper intrusion prevention controls are necessary: a sound password policy, internet access policy in UTM boxes with all features of intrusion prevention at every level.

Detection control is also a control that the organization puts in place to check the review of any incident or report that has happened in the organization and put in place the lessons learnt from the incident name and its impact.

Detection is always part of an audit or an inspection or a review mechanism. Hence, detection risk is the risk that an auditor confirms that there are no material errors in practice. Sometimes there could be some errors, some of them with serious impact too. So it is a risk the auditor lets exist.

These audits are very important and every organization should carry out these audits periodically.

Now the first step in detection control is identifying a fault that is detecting the fault followed by isolation of the system detected and then act of recovery immediately after the identification and fault detection there should be isolation of the information assets.

So that it does not spread much and not further percolate down to impact the other information assets down the line, so after the process of isolation of the assets. The next step is towards recovery from the incident or the risk encountered.

Mitigation mitigation controls is something which is referred to as compensating control since it is closely associated with alternate controls and segregation of duties it can be said of greater significance especially in auditing when sometimes an uncollected on an unrecorded statement may escape the attention at first stage and may result in a crucial failure of control and efficiency in the system.

So mitigating control will be very helpful in finding out that omission so many times even the auditors may fail to detect a problem in the system. So this can be done by taking proper mitigation measures such as cyber risk insurance.

Now it is another mitigating control which is in the form of transfer risk, getting relief by transferring the risk from the organization to a third party insurer. So this is another way of mitigating that risk, another way of making that impact less burden on you.

Encryption is the process of storing or conveying or communicating information in such a manner that only the authorized user or the receiver can understand and nobody else.

Now strong cryptography is another variant of cryptography and this can certainly help people to communicate over networks.

Knowing exactly what you need to do to be data protection regulation compliant can be daunting. Our specialist data protection lawyers will work closely with you to understand your business and provide advice tailored to your current commercial situation and future strategic goals.

Our team’s deep data protection knowledge has developed over years of work in this complex and intricate area of law. This means that we can support in-house counsel or data protection officers, either as a “sounding board” or as specialist advisors.

The GDPR is EU legislation and applies throughout the EEA but can also apply to non-EEA organizations too. We therefore advise Pak, UK, EU, US and international businesses about data protection compliance.

If you’re based in Pakistan, we can advise whether you are affected by GDPR or Personal Data Protection Act and, if so, explain the extent of your compliance obligations. We’ve worked with a number of overseas businesses – particularly in the UK – on GDPR issues and can bring that knowledge and experience to your organization.

Our lawyers can help you with all aspects of data protection and GDPR/CCPA compliance. We can take you through the initial steps of compliance by carrying out a GDPR Audit to assess where you currently stand. We can then advise on a compliance strategy and the policies and procedures that you will need to put in place to evidence your compliance.

We also advise businesses on day to day issues such as managing subject access requests (SAR/DSAR) and Data Breaches, and how to enter into data protection compliant contracts.