Information Storage Risk Reduction Landing Page

This page is under construction
The information provided below may not be complete or fully tested. Take care when following draft instructions.

On this page:

Overview
How To
Obtain and Use Data Loss Prevention Software - Spirion (formerly Identity Finder)
Destroy Information You Don't Need Anymore
Minimize the Collection of High Risk Information
Anonymize High Risk Information
Encrypting High Risk Information
Have Questions or Still Need Help?

Overview

Collecting, processing, sharing, and storing high risk information is a necessity for many functions. With this come the risk of unintended exposure particularly through unauthorized access and data loss. There are, however, many ways to reduce your risks when handling moderate and high risk data and they include:

Collect/store only the information required- this is especially important for any high risk or regulated information( i.e. PII, Research)
Being aware of regulations for sharing information that falls under financial (PCI-DSS), health care (HIPPA) or export controls (EAR/ITAR)
Install loss prevention software, such as Spirion, so you can track the high risk information you have
Securely destroy high risk information when you no longer need it - this includes any paper or digital copies
Anonymize high risk information where possible by assigning references or codes instead of referring to high risk information directly
Encrypt electronic high risk information in transit and at rest; securely store paper documents containing high risk information in locked containers in non-public areas
For more information on how to classify and secure your data, see Information Protection @ MIT.

How To

Obtain and Use Data Loss Prevention Software - Spirion (formerly Identity Finder)

What is Spirion (formerly Identity Finder)?
Why should I use Spirion (formerly Identity Finder) or any data inventory software?
Obtain Spirion
Using Spirion (formerly Identity Finder) on Macs
Using Spirion (formerly Identity Finder) on Windows
Tips for using Spirion (formerly Identity Finder) at MIT
Spirion - formerly Identity Finder - Frequently Asked Questions FAQ
[What kinds of files will Spirion (formerly Identity Finder) scan?]
What kinds of data will Spirion (formerly Identity Finder) find?
A scan has found some sensitive data. What now?

Destroy Information You Don't Need Anymore

Use secure shredding services and disk wiping tools to ensure legacy documents and electronic devices that may contain high risk information can't be read by unauthorized individuals. Old information often still contains details from which someone could derive or glean information about current personnel or operations and rendering the information unrecoverable and/or unreadable prevents dumpster divers and others who may want to access the information from doing so via those means.
Information Retention and Deletion Landing Page

Minimize the Collection of High Risk Information

Collect only the information that is required to accomplish your goal. For instance, if you need to collect contact information, requesting name, address, phone number and e-mail makes sense. Asking for date of birth, salary information etc. is outside of the scope of what is needed to contact an individual by any means. Additionally, if the intent is to establish only electronic communication, collecting name and e-mail are sufficient.

Anonymize High Risk Information

Anonymizing high risk information involves collecting, processing, and/or storing it such that no one piece of data can be traced back to the person. This may consist of dividing it up and obfuscating its meaning so that no one piece of information should provide enough detail such that the person to which it refers can be discoverable. For instance, if you have a list of patients in a study, and there is a list of first and last names, address, date of birth, ailment, prescriptions/medications, etc. assign each piece of data a randomly generated identifier. First name =004T, Last name = 718S, and so on. Then store the key and the individual pieces of information separately and securely.
Care should particularly be taken to anonymize large collections of bulk data, for instance spreadsheets, databases, and other files.
Anonymization and Encryption can be used together to further protect information.

Encrypting High Risk Information

Encrypting high risk information will make the informaiton unreadable to anyone without the means to decrypt it.
Encrypting protected information while it is stored and unencrypting only when it is needed and only by those with limited access provides an extra measure of protection.
Encrypt databases by ensuring high risk information within is protected in its stored and retrieved state. TBA more about database encryption.
Encrypt at any point information is at rest or intransit
- Encrypt individual files using commercial software such as BitLocker;
- Encrypt entire hard drive
- Encrypt storage of any size from large Storage Area Networks to USB devices
- Encrypt databases - SQL server 2012, SQL Server Compact 4.0 with database passwords - https://technet.microsoft.com/en-us/library/gg592949(v=sql.110).aspx
- Encrypt E-mails - PGP - https://www.comparitech.com/blog/vpn-privacy/how-to-encrypt-email/#gref
- Encrypt web communications- Latest version of TLS