We have our payroll software to be installed on our file server. This contains all the details of current and past employees. The data contained in the payroll software includes tax, bank, National Insurance number, address, DOB, start and end date, etc.
We are in the UK and we want to protect ourselves legally and moral obligation. We want to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
Technical details of the software:
- The databases are located on a Windows 2008 SBS server and the client application is installed on a Windows 7 64bit workstation.
- The databases are not encrypted and are of an old bespoke system. In order to read the database you will need the development suite.
- The application requires a password to enter the system.
What are the necessary steps in securing this system? How can we establish a list of precise requirements (access controls, permissions, auditing, …)? What laws, standards and best practices apply?
Further information from your questions
A breakdown of the security :
- The server is locked in the secure server room preventing unauthorised accessed.
- The database files are not encrypted but will be protected by access control list.
- The fields in the database are not Encrypted
- Transmission across the network is not encrypted
- No private Vlans on the network and no hardware that supports it at present. We will be upgrading shortly
- App developed in the 90’s so I’m guessing no encryption over transmission and probably not securely developed by todays standards.
I want to know if ACL is acceptable taking into account the server is physically locked away, the database/files are not encrypted and all machines are on the same LAN?
Here’s some more information ive collated from the UK:
Action taken against data protection and privacy and electronic comunications: http://www.ico.gov.uk/what_we_cover/taking_action/dp_pecr.aspx Lots of courts proceedings against companies and government departments
Data protection principles: ico.gov.uk/for_organisations/data_protection/the_guide/the_principles.aspx Lots of courts Quote from webpage "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."
What security measures should I take to protect the personal data I hold?: ico.gov.uk/for_organisations/data_protection/security_measures.aspx Quotes "Only allow your staff access to the information they need to do their job and don't let them share passwords. Encrypt any personal information held electronically that would cause damage or distress if it were lost or stolen."