As stated throughout this document, one of an organization's most valuable assets is its information. Local, state, and federal laws require that certain types of information (e.g., individual student records) be protected from unauthorized release (see Appendix B for a FERPA Fact Sheet). This facet of information security is often referred to as protecting confidentiality. While confidentiality is sometimes mandated by law, common sense and good practice suggest that even non-confidential information in a system should be protected as well-not necessarily from unauthorized release as much as from unauthorized modification and unacceptable influences on its accessibility.

Q. If an organization maintains physical, software, and user access security, isn't information security addressed by default?
A. Yes and no. Information backups and their storage are surely safer when the building is secure, software is used properly, and unauthorized users are effectively restricted. However, these security features are meaningless if the information that is being backed up and stored wasn't maintained in a sound way in the first place. While there is no doubt that physical, software, and user access security strategies all contribute to protecting information, ignoring those initiatives that are aimed directly at securing information is not a wise plan.

Q. Isn't there software that can protect my information?
A. Yes, a variety of software products can help your organization in its effort to secure its information and system, but only a thorough, well-conceived, and committed effort to develop and implement an overarching security plan will prove effective in the long run.

Q. Doesn't it make sense to just go ahead and encrypt all information?
A. Not necessarily. Encryption and decryption are time consuming. If information is confidential, then additional time for encrypting and decrypting makes sense. But if the files aren't confidential, why would you slow down processing speed for an unnecessary step? And while encryption is a good practice for sensitive information or information that is being transmitted over unsecured lines, it should be noted that it is not a complete security strategy in itself. Encrypting information protects files from breaches in confidentiality, but the risks of unauthorized or accidental modification (including destruction) and/or denial of use are still real.

Perhaps more than any other aspect of system security, protecting information requires specific procedural and behavioral activities. Information security requires that data files be properly created, labeled, stored, and backed up. If you consider the number of files that each employee uses, these tasks clearly constitute a significant undertaking. Policy-makers can positively affect this effort by conducting an accurate risk assessment (including properly identifying sensitive information maintained in the system). They should also provide organizational support to the security manager as he or she implements and monitors security regulations. The security manager must be given the authority and budget necessary for training staff appropriately and subsequently enforcing information security procedures at all levels of the organizational hierarchy.

A final consideration for policy-makers is information retention and disposal. All information has a finite life cycle, and policy-makers should make sure that mechanisms are in place to ensure that information that is no longer of use is disposed of properly.

A countermeasure is a step planned and taken in opposition to another act or potential act.

Information Security Countermeasures

The following countermeasures address information security concerns that could affect your site(s). These strategies are recommended when risk assessment identifies or confirms the need to counter potential breaches in your system's information security.

Countermeasures come in a variety of sizes, shapes, and levels of complexity. This document endeavors to describe a range of strategies that are potentially applicable to life in education organizations. In an effort to maintain this focus, those countermeasures that are unlikely to be applied in education organizations are not included here. If after your risk assessment, for example, your security team determines that your organization requires high-end countermeasures like retinal scanners or voice analyzers, you will need to refer to other security references and perhaps hire a reliable technical consultant.

Transmit Information Securely (including e-mail):

• Use e-mail only for routine office communication: Never send sensitive information as e-mail. If e-mail absolutely must be used, encrypt the file and send it as an attachment rather than in the text of the e-mail message.

• Encrypt everything before it leaves your workstation: Even your password needs to be encrypted before leaving the workstation on its way to the network server-otherwise it could be intercepted as it travels network connections.

• Physically protect your data encryption devices and keys: Store them away from the computer but remember where you put them. Use the same common-sense principles of protection you should be giving your bank card's personal identification number (PIN).

• Inform staff that all messages sent with or over the organization's computers belong to the organization: This is a nice way of saying that everything in the office is subject to monitoring.

• Use dial-up communication only when necessary: Do so only after the line has been satisfactorily evaluated for security. Do not publicly list dial-up communication telephone numbers.

• Confirm that outside networks from which there are dial-ins satisfy your security requirements: Install automatic terminal identification, dial-back, and encryption features (technical schemes that protect transmissions to and from off-site users).

• Verify the receiver's authenticity before sending information anywhere: Ensure that users on the receiving end are who they represent themselves to be by verifying:
  1. Something they should know-a password or encryption key; this is the least expensive measure but also the least secure.

  2. Something they should have-for example, an electronic keycard or smart card.

• Practice "views" and "table-design" applications: A "view" selects only certain fields within a table of information for display, based on the user's access rights. Other table fields are excluded from the user's view and are thus protected from use. For example, although a school record system may contain a range of information about each student, Food Services staff can view only information related to their work and Special Education staff can view only information related to their work. This type of system maintains information much more securely than traditional paper systems, while at the same time increasing statistical utility and accountability options.

• Use "key identifiers" to link segregated information: If record information is maintained in a segregated manner (e.g., testing files are kept in a different database than special education files) for security purposes, a common file identifier (e.g., a Social Security Number) can be used to match records without unnecessarily divulging the identity of individuals and compromising confidentiality.

• Back up not only information, but also the programs you use to access information: Back up operating system utilities so that you retain access to them even if your hard drive goes down. Also maintain current copies of critical application software and documentation as securely as if they were sensitive data. Caution: Some proprietary software providers may limit an organization's legal right to make copies of programs, but most allow for responsible backup procedures. Check with your software provider.

• Consider using backup software that includes an encryption option when backing up sensitive information: Encryption provides additional security that is well worth the extra effort, since it ensures that even if unauthorized users access your backup files, they still can't break confidentiality without also having access to your encryption key. If you adopt this recommendation, be sure to change your encryption key regularly.

• Verify that your backups are written to the disk or tape accurately: Choose a backup program that has a verification feature.

• Rotate backup tapes: Although backup tapes are usually quite reliable, they tend to lose data over time when under constant use. Retire tapes after two to three months of regular use (i.e., about 60 uses) to a backup activity that requires less regular use (e.g., program backups). Also note that routine tape drive cleaning can result in longer tape life.

• Maintain a log of all backup dates, locations, and responsible personnel: Accountability is an excellent motivator for getting things done properly. Remember to store the logs securely.

• Avoid over-backing up: Too many backup files can confuse users and thereby increase the possibility of exposing sensitive information. Clear hard drives, servers, and other storage media that contain old backup files to save space once you have properly secured (and verified) the last complete and partial backup.

• Test your backup system: This point has been made numerous times throughout the document, but it truly cannot be overemphasized!

• Apply recommended storage principles as found in this document to both original and backup files alike: Backup files require the same levels of security as do the master files (e.g., if the original file is confidential, so is its backup).

• Clearly label disks, tapes, containers, cabinets, and other storage devices: Contents and sensitivity should be prominently marked so that there is less chance of mistaken identity.

• Segregate sensitive information: Never store sensitive information in such a way that it commingles with other data on floppy disks or other removable data storage media.

• Restrict handling of sensitive information to authorized personnel: Information, programs, and other data should be entered into, or exported from, the system only through acceptable channels and by staff with appropriate clearance.

• Write-protect important files: Write-protection limits accidental or malicious modification of files. Note that while write-protection is effective against some viruses, it is by no means adequate virus protection in itself.

• Communicate clearly and immediately about security concerns: Train staff to promptly notify the system administrator/security manager when data are, or are suspected of being, lost or damaged.

• Create a media library if possible: Storing backups and sensitive material in a single location allows for security to be concentrated (and perhaps even intensified). Note, however, that an on-site media library is not a substitute for off-site backup protection.

Dispose of Information in a Timely and Thorough Manner:

• Institute a specific information retention and disposal policy as determined by the organization's needs and legal requirements: All data have a finite life cycle. Consult local, federal, and state regulations for guidance before implementing the following:

• Establish a realistic retention policy.

• Mark files to indicate the contents, their expected life cycle, and appropriate destruction dates.

• Do not simply erase or reformat media, but overwrite it with random binary code. Sophisticated users can still access information even after it has been erased or reformatted, whereas overwriting actually replaces the discarded information.

• Consider degaussing (a technique to erase information on a magnetic media by introducing it to a stronger magnetic field) as an erasure option.

• Burn, shred, or otherwise physically destroy storage media (e.g., paper) that cannot be effectively overwritten or degaussed.

• Clean tapes, disks, and hard drives that have stored sensitive data before reassigning them: Never share disks that have held sensitive data unless they have been properly cleaned. Also remember to clean magnetic storage media before returning it to a vendor for trade-ins or disposal.

Information Security Checklist

While it may be tempting to refer to the following checklist as your security plan, to do so would limit the effectiveness of the recommendations. They are most useful when initiated as part of a larger plan to develop and implement security policy throughout an organization. Other chapters in this document also address ways to customize policy to your organization's specific needs-a concept that should not be ignored if you want to maximize the effectiveness of any given guideline.