In today’s highly connected world, data security has become a critical issue. As reliance on cloud-based systems for storing and managing personal data continues to grow, safeguarding this information has never been more essential.
Recognizing this, Australia and many other jurisdictions have enacted data protection legislation, such as the Privacy Act and GDPR, to ensure that organizations fulfill their obligations to protect individuals' personal information within their managed systems.
While software vendors such as ELMO are responsible for ensuring the security of the systems that house this data, you, as the customer, bear responsibility for managing your data within these systems.
What is Personal Information
While there are few different terms used internationally, in simple terms Personal Information refers to information that relates to a person or individual.
Under Australian and New Zealand privacy legislation the concept of Personally Identifiable Information (or PII for short) is used, which in simple terms is personal information that when used alone, or with other relevant data, can be used to identify an individual.
This means that PII may contain direct identifiers (e.g. passport information) that can be used alone to identify a person uniquely, or quasi-identifiers (e.g. post code) that can be combined with other quasi-identifiers (e.g. date of birth) to successfully recognise an individual.
While there may be exceptions, it is a good rule of thumb to treat any information uploaded to, stored in or extracted from ELMO as containing PII.
ELMO has implemented an Information Classification Scheme to cover all types of information, categorising it as either Public, Commercial In Confidence, Proprietary and Client Confidential.
How to protect Personal Information
Secure Authentication Methods
Where possible, consider the use of Single Sign-On (SSO) for user authentication.
Where this is not possible ensure that you have a secure password policy in place and keep passwords secure. ELMO also offers Multi-Factor Authentication for users accessing your site through the built-in sign-in facilities which you can read more about here.
📝 It is also a good idea to consider restricting the use of personal email accounts for authentication (e.g. Hotmail, Gmail, etc.), as compromised personal email accounts could lead to compromised system access (e.g. forgot password)
Secure Transfer and Storage of Data
When sending information from one place to another, we always need to be conscious of how that information is being transferred and stored.
In most cases we can obtain any information required to assist you directly through your system, with the appropriate security already in place, but if we do need you to provide us with information from the system it is important consider the security of this information while it is in transit and at rest.
Quick Tips
Never include personal information, or attachments containing personal information, in an email
Use secure encrypted channels to transfer files, such as a secure file transfer tool (e.g. Dropbox, SFTP, etc.)
Use a password to encrypt the information in data files (e.g. Excel, Zip, etc.) to protect the data at the source, in transit and at the destination
Provide passwords via a secure method and only when necessary.
⚠️ This should not be necessary in most cases. Where it may be required to pass this information to ELMO please reach out to your consultant to discuss before providing any credentials.
Blur out any personal information in screenshots before sending them via email or tickets
Regularly review your computer for files containing PII, such as your download folder, and either delete them if no longer required or store them in a password protected archive (e.g. 7-Zip)
Only grant access to information to the level that is required. e.g. avoid giving full system access to simplify security configurations.
📝 Consider applying security profiles where appropriate for users that only require limited access to the system
Avoid the use of shared accounts for system access (e.g. Admin User).