Home : Public Sector : News

Cambridgeshire council in memory stick blooper

A council is told to shore up its security practices after losing an unencrypted memory stick.

By Tom Brewster, 23 Feb 2011 at 15:57

Cambridgeshire County Council has breached the Data Protection Act after a memory stick containing sensitive data relating to vulnerable adults went missing.

The Information Commissioner’s Office (ICO) was told about the loss in November 2010, when an employee lost an unencrypted memory stick containing personal data of six individuals.

The unencrypted stick had not been approved to store the information that was downloaded onto it.

Furthermore, the breach happened just after the council had carried out an internal campaign to promote its encryption policy.

Data included case notes and minutes of meetings related to the individuals’ support.

“While Cambridgeshire County Council clearly recognise the importance of encrypting devices in order to keep personal data secure, this case shows that organisations need to check their data protection policies are continually followed and fully understood by staff,” said Sally Anne Poole, enforcement group manager at the ICO.

“We are pleased that Cambridgeshire County Council has taken action to improve its existing security measures and has agreed to carry out regular and routine monitoring of its encryption policy to ensure it is being followed.”

The council has escaped a fine, but has pledged to use adequate encryption on portable devices and regularly monitor data protection and IT security policies.

A Cambridgeshire County Council spokesperson apologised for the data loss and confirmed the affected parties had been informed.

"The loss of the memory stick was immediately reported by the member of staff involved, who following a full investigation has been disciplined and given advice on their future professional conduct," the spokesperson said.

Chris McIntosh, chief executive (CEO) of Stonewood, said the council had failed with employee education.

“An organisation can have the best security technology and protocols in the world, but without an educated workforce they’re worthless,” he said.

“There will always be a chance of human error in IT security; the job of the organisation is to make sure that its employees are educated on these risks and that policies are enforced.”

Earlier this week, the ICO rapped the Identity and Passport Service for losing customer data.

Email to a friend

Print this page

< Previous Public Sector : News Next >

1 comments

You need to Login or Register to comment.

RE:

This news once again stands as testament to the fact that current storage security solutions for removable storage are not adequate or do not fit the way that users and organisations need to operate in order to remain efficient and productive.

Countermeasures such as complex endpoint security solutions that only allow specific USB devices or approved removable media to be used are extremely expensive and cumbersome, as well as impacting significantly on PC performance. The draconian approach of locking down all the PCs in the workplace to prevent the use of USB ports for any devices is similarly impractical, limiting productivity and preventing legitimate duplication of data for backup, testing, approved sharing and offline working.

Here, it would have been better to use a combination of strong encryption with remote management and wiping so that end users are afforded an extra level of security and protection in the event they lose a device or have one stolen from them.

Tom Colvin, CTO, Conseal Security

By Conseal_Security on Thursday Feb 24