Document Security in the Modern Office: Why Going Paperless isn’t the Final Solution.

Protecting Confidential Information: A Serious Business Issue

The vast majority of office workers don't perceive their workplace as an environment where their actions could directly inflict significant financial or reputational damage upon their employer, their customers or themselves.

The modern office is a world where financial pain is seen as something likely to be inflicted by the failure to control soft costs such as travel expenses, office supplies and client entertainment and hospitality. Reputational risk is often founded on the fear of dissatisfied customers venting their service frustrations in public via the media.

Set in this context it is easy to appreciate why the commercial dangers presented by everyday office activity are rarely considered by facilities managers. A lack of tangibility is usually a big part of this mindset. It's natural to be more concerned by the potential impact of worn computer cables, for example, than the security of the information those cables are transmitting around the business.

Clear and present danger points inevitably attract attention in any environment. It follows that the passage of confidential information through the modern office is one area of risk which is easily neglected.

For most office staff the biggest threat posed by a document is a paper cut, while the accidental mis-mailing of an invoice hardly resonates on the scale of commercial crises. Dig a little deeper however and the scale of the threat posed by failures in managing confidential information, including the manner of its disposal, becomes apparent.

The recent enhancement (April 2010) of the powers of the Information Commissioner's Office (ICO) now allow this non-departmental public body to levy fines upon businesses of up to £500,000 for serious data losses. If this doesn't sweep away any complacency among UK businesses in relation to data protection, a reminder that the average cost in terms of lost orders associated with the reputational damage inflicted by a data breach is estimated at between £10,000 and £20,000 should focus minds further.

These deterrents apply to all businesses, and admittedly do vary in severity according to the nature of the data breach. In today's uncertain market there's even less reason to allow a failure to meet the legal obligation to protect the confidential data of your customers, staff and organisation to become an unwelcome addition to an already toxic cocktail of falling revenue and stretched cashflow. This all comes at a time when multiple independent surveys have drawn direct correlations between macro-economic troubles and rising commercial fraud.

The Modern Office: Data Breach Vulnerabilities

The term 'paperless office' has been bandied around for many years yet. Real life experience tells us that this is something which, in truth, companies very rarely if ever deliver. Even if the paperless objective is achieved, the resultant sense of data security is still a mirage. Confidential information is ever more likely to be stored electronically yet this doesn't by definition make it secure. Any readers recalling the fiasco which followed the 2007 loss of computer discs containing 25 million child benefits recipients' details will doubtless appreciate this point.

Of course, 'electronification' isn't the only fundamental change to have occurred in the office workplace in recent years. The physical make-up of the office environment has changed beyond recognition since the 1970's and 1980's. Gone are the days when most senior managers worked behind lockable (and often locked) doors. Today managers sit with their teams in an open plan environment.

Further, communal 'breakout' areas are created for employees to hold meetings or take a moment to digest complex documents without interruption. These areas are fertile ground for confidential information to be left accidentally unattended. This heightens the risk of its subsequent disposal not being secure as control of this process is being ceded from the outset. Office 'make-up' related issues don't stop there. It's fashionable nowadays for photocopiers to be integrated into the workspace, as opposed to being hidden away at the end of a dingy corridor. Areas immediately surrounding photocopiers are hotbeds of data breach risk.

This is particularly the case when staff discard sub-standard copies of confidential documents in waste paper bins which themselves are not part of a secure disposal process. Such bins could be accessed, for example, by an office cleaner or other outside contractor, and the possibility remains that such parties may seize the opportunity presented to acquire and use for inappropriate purposes the information accessed.

Meanwhile it is often overlooked that digital photocopiers also contain hard drives which retain images of every document copied upon them. As many machines are leased and move from office to office, the danger that confidential information could be retrieved by an outside individual or organisation is a real one. It's therefore crucial to ensure that these drives are wiped clean before the machine is removed from the office, or indeed pulverised when the machine reaches the end of its service life.

Changes in workplace cultural also present data security issues. The rise of home working presents businesses with the challenge of ensuring the secure handling of confidential materials outside the office. When framing policies on home working companies should urge staff to consider the security risks associated with throwing sensitive office documents into their household bins. In our home lives, the majority of us wouldn't even contemplate disposing of bank statements or utility bills along with general refuse. The onus is with managers therefore to ensure employees working from home are equally responsible when disposing of confidential documents relating to the business.

The cultural changes don't stop with home working. The practice of 'hot-desking' has become common in the modern workplace, accompanied by the risk of consultants and contract workers visiting the office on a temporary or occasional basis. In terms of data security, the challenge created here is one of gauging exactly who is in the office at any given point and in turn ensuring the confidential information to which they have access is managed effectively.

The fluidity of the modern workplace thus makes it hard to grasp firmly who is in the office inside and outside business hours. Part of the solution is a data security process which encourages staff to be vigilant in ensuring fellow workers are not accessing confidential information for non-business purposes and keeping a tight rein on electronic files via a strict system of password access.

The second noteworthy cultural change is one of growing environmental awareness. Amidst the drive to be environmentally friendly, companies often include confidential documents among those earmarked for recycling. This can often result in them being left unattended outside office premises for any opportunist thief to access.

There is no room for confusion on this point, recycling is not the same thing as secure document destruction. Differences between the two are plentiful, but the point to bear in mind is the operating principles of recycling companies and secure document destruction providers. The former is driven by the value of the weight of material garnered for recycling.

This dictates that the loss of any paper during the recycling process, for instance blowing from a truck into the road, is not a serious consideration for a recycler. Losing just one confidential document in this manner could spark a potentially serious data breach.

Contrastingly, ensuring that all information is disposed of securely is integral to the business model and service provided by a secure document destructor. For companies of this ilk, recycling takes place only once documents have been shredded beyond repair. As such, it becomes possible for companies to be green and ensure they stay secure. This situation also reinforces the validity of my view that secure document destruction should always been seen by facilities managers as a security issue, not just another component of the waste management programme, which is often the case.

Our illustration brings into focus the typical data security dangers present in the modern workplace. Central to managing this risk is ensuring that all staff are made aware of their responsibilities when it comes to ensuring confidential information is securely stored and disposed of.

Best practice also demands that workers are made fully aware of the processes in place within the business to ensure data security levels are maintained and are given regular updates on procedural changes as they occur. Clarity needs to surround information which is and isn't to be treated as confidential by staff with workers being encouraged to ask for guidance where they are unsure.

• Recycling Bin: Leaving confidential documents in non-secure locations such as a recycling bin means they could be accessed by anyone at anytime, or worse still stolen while awaiting collection from outside your premises.
• Overflowing confidential shredding bin: Make sure you have enough confidential shredding bins and that your secure document destruction provider visits regularly enough to prevent overflows. Leaving sensitive documents lying on top of these consoles is self-defeating.
• Office strip shredder machine: This is one good reason to outsource document destruction. Many businesses are reluctant to free up staff time to shred documents, preferring them to focus on fee generation. An employee can take 5 hours to shred 25 kgs of paper; industrial shredders can do the same work in minutes.
• Waste paper baskets: Perhaps the most dangerous point of all. Make sure all employees are clear about precisely which kinds of information should never be deposited in a waste paper basket.
• Visiting contract workers: Ask yourself whether you really know who is working in your office? Do you know for a fact that all visitors have been subjected to CRB checks, either by your or their employer? Don't be afraid to ask these questions.
• Unattended digital storage devices: Ensure that USB sticks and CD-ROMs containing confidential data are tracked at all times and never left for any passing member of staff to simply pick up.
• Discarded photocopies and printer paper: A blurred version of a confidential document may not be suitable to send to a client, but it could be perfect for a fraudster looking to access data. Photocopiers also contain hard drives which store images of documents copied upon them. These should be wiped clean before the machine reaches the end of its service life in the office.
• Office in-trays: Many companies now enforce 'clear desk' policies to ensure sensitive documents are not left unattended by workers.
• Broken security door: Make sure entry to areas where confidential data is stored is strictly controlled. In a world where multiple building occupancy could even leave your business with competitors located on the floor above or below you, this is all the more important.
• Unused hard drives: Confidential electronic data should be treated in the same way as paper-based information. If you need to dispose of hard drives, ask your document destruction provider to pulverise them for you so information stored on them cannot be retrieved.

Focus: Getting the Process Right

We've already touched on the critical differences between recycling and document destruction but this is isn't the only factor needing to be borne in mind when framing a secure process for data destruction in the workplace.

Auditing your existing process is a sensible starting point, as is posing the question in your own mind of whether you would be content for your own information to be processed through the system.

It is also essential that whoever you choose to supply your document destruction services provides you with a Certificate of Destruction immediately after your materials are shredded. This is an essential document an organisation needs to absolve itself from legal responsibilities associated with secure data handling.

A reputable document destruction provider will not only audit your existing process but welcome scrutinisation of its own approach. Documented proof that all company representatives who will visit your premises and handle confidential information have satisfactorily passed CRB checks should be available, as should detail of whether your material will be shredded on-site (at your premises) or off-site (at their premises).

Generally speaking on-site destruction followed by instant issuance of a Certificate of Destruction is preferable, but should you wish to pursue the off-site option, auditing the third party provider should be something that organisation welcomes as an opportunity to demonstrate its own security standards. Finally, it's astute to ensure that the chosen partner has the capacity to destroy hard drives, thus cutting off at the pass the associated dangers detailed above.

Ultimately any security process is only as strong as its weakest link. Office environments are fluid, abstract places and only by keeping to the discipline imposed by a well-managed and regularly reviewed document destruction process can this challenge be managed effectively.