Protect our payroll data from a legal and moral obligation

Question

We have our payroll software to be installed on our file server. This contains all the details of current and past employees. The data contained in the payroll software includes tax, bank, National Insurance number, address, DOB, start and end date, etc.

We are in the UK and we want to protect ourselves legally and moral obligation. We want to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Technical details of the software:

• The databases are located on a Windows 2008 SBS server and the client application is installed on a Windows 7 64bit workstation.
• The databases are not encrypted and are of an old bespoke system. In order to read the database you will need the development suite.
• The application requires a password to enter the system.

What are the necessary steps in securing this system? How can we establish a list of precise requirements (access controls, permissions, auditing, …)? What laws, standards and best practices apply?

---

Further information from your questions

A breakdown of the security :

• The server is locked in the secure server room preventing unauthorised accessed.
• The database files are not encrypted but will be protected by access control list.
• The fields in the database are not Encrypted
• Transmission across the network is not encrypted
• No private Vlans on the network and no hardware that supports it at present. We will be upgrading shortly
• App developed in the 90’s so I’m guessing no encryption over transmission and probably not securely developed by todays standards.

I want to know if ACL is acceptable taking into account the server is physically locked away, the database/files are not encrypted and all machines are on the same LAN?

Here’s some more information ive collated from the UK:

Action taken against data protection and privacy and electronic comunications: http://www.ico.gov.uk/what_we_cover/taking_action/dp_pecr.aspx Lots of courts proceedings against companies and government departments

Data protection principles: ico.gov.uk/for_organisations/data_protection/the_guide/the_principles.aspx Lots of courts Quote from webpage "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

What security measures should I take to protect the personal data I hold?: ico.gov.uk/for_organisations/data_protection/security_measures.aspx Quotes "Only allow your staff access to the information they need to do their job and don't let them share passwords. Encrypt any personal information held electronically that would cause damage or distress if it were lost or stolen."

Answer 1

You should take the usual precautions to secure any important server.

1) Properly configure a firewall to have a deny by default policy and only whitelist approved traffic.

2) Proper ACL keeping in mind the principle of the least privileged.

3) Properly authenticating the application that accesses the server - this might mean a good highly random password with enough entropy, authenticating against an AAA server or even certificates depending on the scale of your setup.

3) Encrypt the database - do not count on an old legacy system making it difficult for a malicious attacker to read your database.

4) Log all activities - proper accounting makes it much easier to track unintended changes to the system.

Depending on the type of information you hold, you might need to meet certain compliance schemes. I do not have much idea about this point though, you might want to check with a local audit company for more information.