e-skills UK Guide

Assigning data access rights

How to protect your data

This guide is designed to help you protect your data from unauthorised access and inadvertent corruption. Stopping people accessing your data is the best way of protecting it - prevention being better than cure.

There are some straight forward steps you can take to protect your data, none of which need you to be an expert in IT.

Please note: If you are supplying services to some companies or government agencies it may be a requirement of your contract that you can adequately protect and manage your systems, irrespective of the size of your business. In this case it is strongly suggested that you get the help of an experienced IT professional able to secure your data. For details on obtaining help visit this Choosing an IT consultancy supplier.

Understanding the threat

You need to understand what data you have and what needs to be protected. In reality many small businesses probably have a few spreadsheets and documents that need to be actively protected. Most of your other documents might still be private but not require such a high level of protection.

 Key documents and data that will need protecting will probably be:

• Salary details
• Customer lists
• Bank details and online banking logons
• Passwords
• Intellectual property. If you produce files and documents which are then sold such as designs, schematics and plans these will need to be actively secured

Part of understanding the threat also needs you to think through who is likely to want to access or obtain this data. For most small businesses the risk of targeted theft or damage is low. Most damage would be as a result of mistakes such as accidental deletion or people not thinking through what they are doing.

If you feel that you may be at high risk of data loss it may be a worthwhile exercise to create a spreadsheet of your important files and understand the scope/nature of the problem. Make sure this spreadsheet is secured though! For many businesses this is an unnecessary task.

Granting access to your data

Access controls will usually need you to provide a user name or user id and password before you can get to the data.  The computer system will validate that the user is entitled to have access to the data and they are who they say they are by providing a valid password. 

There are different levels of protection you may decide to implement: 

• Computer-level protection.  This prevents people from accessing a computer (including servers, PCs and laptops) unless they have a valid user id and password.  This level of security is effective against both external and internal attacks although people with physical access to a computer can by-pass this protection. You should consider this to be the minimum level of access control on all your computers. Locking a computer in a secure room is often the best way of protecting your data from casual access.
• Folder-level protection.  You can allow/deny access to data based on the folder the data is stored in.  For example, you might have a folder called ‘Business plans’ that is available to just one or two people.  This protection is effective for collections of documents because you do not need to define security for each new document.  You can also specify that new folders and files have the same security as the parent folders that hold them. This is normally a feature of the computer operating system, such as Microsoft Windows.
• File-level protection.  You can allow/deny access to individual files.  This is not used often because it takes more time and effort than folder-level protection, but it might be useful if you have just one or two files in a database folder that need to be protected. 

There are three basic access restrictions that you can create for folders and files: 

• No access – people cannot open the folder or file unless they have a valid id and password
• Read-only access – people can see the file and can open it but can’t change anything.  That might be useful for documents that you don’t want people to change such as health and safety regulations.
• All access (often called read/write access) – people can see, use and update the files.

All versions of Microsoft Windows and most other computer operating systems allow you to share folders across a network.  It is easy to use these systems to create shared folders available to anyone connecting to your network. We discuss this in more detail in the Guide that covers Sharing data

Free security advice

Whether your business has been affected by crime or you are seeking preventative measures against crime, the Business Crime Reduction Centre (BCRC) is here to assist you, contact BCRC by:

Calling: 0114 275 1283
e-mailing: info@bcrc-uk.org
Visiting: http://www.bcrc-uk.org

Commercial suppliers

We do not recommend specific products or suppliers; instead we provide you with a representative sample which covers the range of suppliers/products available. You may choose to look at these suppliers or products but this is entirely at your discretion.