Ohio University

What is sensitive data?

Sensitive data is information that is not accessible by the general public. If this type of data is leaked, the potential for individual or institutional harm increases significantly.
Examples:

• Social Security numbers.
• Patient Information or Medical Records.
  
• Credit card and bank account numbers.
• Medical or educational records.
  
• Grade lists that include personally identifiable information.
  
• Other personal data that can be used to facilitate identity theft. Names, addresses and phone numbers are not sensitive by themselves. However, they do become sensitive when stored in conjunction with items such as date of birth, mother's maiden name, etc. or when they belong to someone who has invoked their FERPA rights.
  

Dealing With Sensitive Data

Evaluate
  Do you actually need personal information from individuals who use your services? Why? If you can't think of a good reason, there is no need to keep the potentially harmful material. If you can do your job without using others' private information, don't ask for it.

Eliminate
  Use unique identifiers other than Social Security Numbers to keep track of individuals. Only collect and keep the information that you will need.
  
Encrypt 
  If you determine that you must keep sensitive data, you need to encrypt it. It is best if you encrypt it both on the drive and when sending it over the network. Doing so ensures that data cannot be read by others.
 

Storing Data

1. No Storage - Not keeping sensitive data at all is the safest method. 

2. Desktop Computer Hard Drive - Storing sensitive data on a personal computer places a great deal of responsibility on you as the computer owner. If you choose to do so, you should:

• Follow safe computing practices.
• Encrypt your data.
• Store passwords separate from your computer.
• Restrict access to your computer.

3. Removable Media - Memory sticks, USB flash drives, CDs, DVDs and other removable media are poor options for storing sensitive data because they are easily lost or stolen. You can keep backups on removable media; however, the data should be encrypted, the media kept under lock and key and the passwords stored separately from the encrypted items.

4. Laptop Computer - Due to their portability and popularity with thieves, laptops are not great devices for storing sensitive data.

• If you must store sensitive data on a laptop, you should:
• • Follow safe computing practices.
  • Encrypt your data.
  • Set a passphrase for log in purposes.
    
  • Store passphrases separate from your computer.
  • Activate and use your computer's security chip (if installed).
  • Never leave your computer unattended while traveling, and do not store it in a vehicle. A laptop that contains sensitive data should never leave your person at any time while you are on the road.

5. Network Server

• Issues to consider if you decide to store your data on a network server:
• • Access should only take place over secure connections (SSH, https, SFTP, etc).
  • Do not allow your computer to remember your usernames and passphrases; type them in each time you wish to log in.
  • Make sure that access to your data is granted only to those individuals who need it.
    
  • Ensure that physical access to the server is restricted.
  • Make sure that your server's administrator understands and follows industry best practices for security and maintenance.

Other Tips

Who is responsible?

If you keep sensitive data on a computer you own or control, you are responsible for making sure that the data is secure. You can do this by following safe computing practices and using encryption. For data that is stored on a server, the server owner/administrator normally is responsible for security practices on that machine. However, individuals who collect and store sensitive data on a server are not absolved of responsibility should a breach occur.