7 Ways to Better Meet FCA and ICO/DPA Technology Guidelines

Where ever there is a failure of leadership to assert control and set high standards for a business and its employees, there is often the potential for significant problems.

Many fines are issued by the ICO for failing to take reasonable steps to prevent hacking. Hackers often exploit ‘vulnerabilities’ (that’s IT code for holes in security) to gain unauthorised access to networks, systems and data.

Simple to plug security gaps

One of the most fundamental principles of IT security is to plug gaps by maintaining up-to-date software versions. This is done by regular updating or ‘patching’ with updaters downloaded or automatically pushed out by software vendors. Many of the firms that have been fined could have escaped financial penalty by simply taking the reasonable step of ensuring systems were kept up-to-date.

Employees are only human, and even in the most secure environments, people are often responsible for breaches, either through deliberate action or failing to observe security policies and procedures.

Keep on top of documentation

RFI

External firms may submit a Request for Information (RFI) before commencing trading with your company. This will almost certainly include questions on software, versioning and IT security. Likewise, your business should consider issuing an RFI to any new partner before doing business. Also consider formalising documentation for existing partners if an RFI has not previously been part of the partner engagement process.

Demonstrating a responsible approach

Maintaining up-to-date documentation means you have the right information to hand whenever it is requested from your business. It reassures senior management everything has been given reasonable thought and appropriate systems are in place. Documentation can easily be passed to the FCA if required, to demonstrate a responsible approach.

Data backup, disaster recovery (DR) and business continuity (BC) planning are closely inter-related. Like many areas of IT there is no absolutely right or wrong way. There is a ‘menu’ of different elements that may be mixed and matched together to form the right solution to meet the specific needs of a business.

The core question is: How long can you afford the business to be offline? Once you establish this maximum tolerance to a loss of IT services, you work backwards from there. Some points to consider are:

Avoid backup tapes

A credible backup tape regime requires tapes to be physically taken offsite, inviting the potential for loss. There are a number of examples of companies losing them and getting fined. Tapes and autoloaders are also expensive and prone to failure because they are mechanical. Online backup is more reliable and secure.

Data retention

Backup is central to the data retention strategy. Creating a reliable archive of legacy data is essential for compliance with FCA data retention rules. Ideally, legacy data needs to be kept accessible but out of the way and this could guide the design any hierarchical storage system for filing and retrieval.

Identify single points of failure

Typical single points of failure include power, network and servers. Search for anything where there is just one of. At the top level, the whole of an office or site is a single point of failure. To mitigate the loss of an entire site, it’s often easier to replicate all of your data to another site. Then comes the question – How far away is far enough?

Data replication

The potential for disasters – both natural and man-made - is a key consideration when determining the distance to the replication site. Many businesses in the UK conclude that a distance of 50 miles is appropriate. For even better risk reduction consider replicating in more than one place. Remember to include telephone systems.

Document disaster recovery plans

Whatever the specific process for disaster recovery it’s vital to document the disaster plan.

Key DR plan information includes:

• Who instigates the plan?
• Where is the recovery site?
• How are employees notified?
• How long before the business returns to operational status? (Sometimes referred to as the Recovery Time Objective, RTO)

Consider assessing your systems against ISO27001, the management system for IT security, by checking credentials, external audit or penetration testing.

External IT partner

If you have an external IT partner ensure you check its credentials. It should be appropriately accredited and should adhere closely to industry best practice for information security.

Internal IT team

If you have an internal IT team consider getting a second opinion by engaging an appropriately accredited company to audit your network. An internal IT team may only have in depth experience in your environment. Employing an external team to check the systems often gives an insight into your own network you may otherwise not be able to obtain.

Penetration testing

Consider penetration testing or pen testing. This is the process of ‘stress’ testing your systems to see if a ‘tiger team’ of computer security professionals acting as hackers is able to break through to gain access to your network, servers and data.

Review physical security