Ten old laptops in a skip
A college clears a store room. Ten old laptops go in a skip outside. Nobody wiped them.
A passer-by takes one home. On it are student names, addresses and marks.
One small job, left undone, became a breach. Today you meet eight ways it can happen and the fix for each.
By the end of this lesson
Note
I can match each privacy threat to a way of preventing it.
Key words
| Word | What it means |
|---|---|
| Privacy breach | private information is seen by people who should not see it |
| Unmanaged device | a device the organisation does not control or check |
| Standard operating procedure (SOP) | written steps that say how to do a job the same way each time |
| Insider threat | harm caused by a person who already has access |
| Segregation of duties | splitting a job so no one person can do all of it |
| Personal data | any information about a living person |
| Patch | a fix from the maker for a flaw in software |
| Third party | another company that handles your data for you |
| Due diligence | checking a supplier is safe before you use it |
| Secure wipe | erasing a device so the data cannot be got back |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Threats that start with people and devices
Social engineering. Tricks aimed at staff. The fix is awareness: tell staff about the latest scams.
Unmanaged devices. A personal phone or a spare laptop that nobody checks. The fix is a company policy that bans them from work.
Staff without secure devices. Give staff devices that the company has set up safely.
Untrained staff and insiders
Untrained staff make mistakes. The fixes are training and SOPs: written steps that make a job the same each time.
Insider threats come from people with access. Give each person only the access they need. Watch for unusual activity. Use segregation of duties, so one person cannot do a whole risky job alone, such as both asking for and approving a payment.
The first five threats and their fixes
| Threat | Fix |
|---|---|
| Social engineering | Raise awareness of recent cyber issues |
| Unmanaged devices | A policy that stops their use |
| No secure device for staff | Give staff secure devices |
| Untrained staff | Training and SOPs |
| Insider threats | Access controls, watching unusual activity, segregation of duties |
The cells students fill in are left blank in this preview.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.