Practical measures for data security

If data protection is about the protection of personal data.Data security or IT security is intended to protect general data. When protecting the totality of all data of an organization, it is therefore necessary to address both the issue of Data protection and data security on a regular basis.

At best, the IT security officer regularly analyses the protection of your organisation's data together with the data protection officer and puts together corresponding practical data security measures for more data protection. Often, data protection officers also have certification as IT security officers.

Concrete measures for the technical protection of non-personal data can look very different. For example, technical and organizational measures (TOMs) specify different types of controls. TOMs also play a role in the General Data Protection Regulation play an important role and are defined in more detail in the text of the law.

How is the topic of data security integrated into the basic data protection regulation?

The specifications for the "security of processing" can be found in Article 5(1)(f) GDPR, in Article 32 GDPR and in the Recital 78 GDPR. However, in Article 32 GDPR few concrete measures have been identified. More detailed information is provided in Article 32 GDPR on the subject only pseudonymisation and encryption. For this reason, the following answers basic questions about technical security measures for more data protection.

What is two-factor authentication?

With two-factor authentication, often also called two-factor authentication, the user proves his identity by combining two different and independent components. Authentication is only successful if both factors are used together. They must always be transmitted through separate transmission channels. Common examples are bank card plus PIN at ATMs, fingerprint plus access code in buildings and passphrase and TAN in online banking. Other examples of factors are security tokens, physical keys, passwords, iris recognition and voice. For security-critical applications, the BSI (Federal Office for Information Security) recommends two-factor authentication.

How can I determine whether an account or computer has been hacked?

There are many signs that your own account or computer has been hacked. Obvious signs are fake warnings from the virus scanner, new toolbars in the browser, random pop-up windows on websites not known to be hacked, and installation processes that start from scratch. It is also suspicious when a password suddenly changes. In most cases, the user has previously been taken in by a phishing e-mail that asks him to renew his password. Even if the mouse pointer jumps uncontrollably across the screen and performs actions, the computer has been compromised.

IT attacks can also lead to tangible economic disadvantages, so that one notices that one has become a victim of cyber criminals. This applies to the case when money is suddenly missing from your bank account, but also to unexpected reminders for unpaid goods purchased in your name.

How do you create strong passwords and keep them safe?

A secure password should be at least eight characters long and contain letters (upper and lower case), numbers and special characters in the middle like /[(%&§$_:?!+#)]. Avoid rows of numbers or letters. Likewise, names and dates of birth of you or your environment should be taboo. Instead, create individual passwords based, for example, on a personal memo. Furthermore, you must handle login data carefully to prevent data theft. Last but not least: Use a new password for each registration. If one password is cracked, other accesses will then remain protected.

Software can also be helpful: Password generators can generate a password online according to your specifications. As a reminder, safe programs are used to store all your passwords, of which active users easily have dozens. Access is granted by a master password.