There are 2 main categories to security when using online systems which can be accessed by other people:
Personnel safety and Data Security.
Personnel safety involves ensuring that any information you place on the online system (which can be accessed by others) cannot be used to identify you, so includes things like photos, home addresses and other personnel info. Any info that others can get could be used to aid them in stealing your identity, and as such can lead to financial loss as well as other significant problems for the person who posted the information.
Data Security involves protecting any information about your business and others personnel information. This is to do with the Data Protection Act, which dictates that it is against the law to allow a leak of people’s personnel information, so thus it must have adequate protective measures in place to prevent theft or loss. Basic measures are often implemented via the use of Policies and Procedures. These instruct employees in how to manage any information they acquire, such as where it is to be stored, how often it is to be backed up, deleted and other.
This legislation covers the handling of personal information, and how it must be protected.
Essentially it states that any entities that have legal reason for collecting information about individuals (or other entities, such as businesses) must take reasonable precautions to prevent it being lost, or stolen.
This can vary in the amount of protecting required from simply having a password on a computer, to full blown 24 hour backup of data and high level encryption of data.
With some social network sites there are options for privacy of the user and their posts, which can be used to prevent any attempts to gain information through this method. An example of security settings can be seen on this video for the site you currently see this post from! http://www.youtube.com/watch?v=rU2UU_zpcdU
Basic guidelines for handling this data include:
- The use of Firewalls to help prevent external computer ports being accessed by hackers who would steal any information stored on the system.
- Ensuring that whenever information is transferred an encryption is used to prevent interception by 3rd parties.
- Ensuring that only people who are permitted to use the information are the ones who hold it (I.E. a business cannot provide personnel information to another business, without the permission of the person who it refers too).
- Don't keep information for longer than it is needed, for example a business may not keep contact information for customers after 5 months of inactivity.
- Avoid putting personnel information which can lead to identifying people.
