This is an old revision of the document!
Table of Contents
Securing your computer
A barrister was given a (very small) monetary penalty notice by the Information Commissioner’s Office, because of the way in which she handled client personal data on her computer.
She stored personal data, on her shared home computer, with no encryption, on a generic account, and it was accidentally uploaded to a cloud server.
Don't share user accounts on your computer
If you share a computer with someone, have your own, unique user account: you log in with this, and they log in with theirs.
This should hopefully make your life easier, in terms of having things set up the way you like them automatically when you log in, but it should also keep your documents and files separate from any other users: other users should not be able to access or edit or upload your data.
There’s a note of caution with this, and that’s if another user has an administrator account, they may well still be able to do so — so be very careful who has an administrative account on your machine.
If the option is open to you financially, it is safer to have physically separate machines.
Use a strong password
Create a strong, but memorable, password for your account.
Here's some guidance on passwords.
Encryption
Full disk encryption v file level encryption
Backups
Ensure that you are in control of where your data are residing. Not backing up to a cloud service without you realising it.
Don't trust anyone else's USB sticks
If you decide to allow staff to store information on USB sticks - and there may be perfectly good reason for doing so — ensure that they are encrypted.
Free USB sticks at conferences
Strongly suggest forbidding any USB sticks given away at events. Nothing found on the ground or in the carpark or “left over” in a meeting room.
Yes, it might suck to feel that you could be a good Samaritan and return someone’s vital information or backup of family photographs, but you have absolutely no idea as to what is on that memory stick, and there’s a chance, perhaps even a strong chance, that it might be an attack.
USB sticks might seem like good giveaway items at conferences, but a really bad idea: encourages poor security practice.
But it’s from my friend…
Even if it is coming from your friend, or a trusted colleague, do you know what security they have on their computer? Do you know what state their anti-virus protection is in?
Get them to transfer you the file some other way, and take precautions when opening it.