Alistair Thomas

Worcs, UK

Concerned citizen

The best collection of commonb sense I've seen on this subject for some time. Yes, responsibility starts at the top and deals with purpose. Why have the data? How to use it? Who's trusted? How to secure its use for the intended purpose etc.

The infrastructure/system then has to deny misuse.

Why does sensitive data have to be downloaded/copied from "source" in a connected world? (accepting distributed data, backup, resilience etc)? Laptops should be terminals with no ability to store anything but approved and non sensitive productions based on the data. Sensitive reports get the same severe and need-to-see only treatment as the data itself.

You can limit people's level of access. You could monitor who has accessed the data, and if you extended usage to include approved project codes, you could even store details of what purposes the data was accessed for. Sure this level of security will be slow, possibly even erratic remotely, but better safe than sorry. When did convenience become a key driver where security is concerned?