Technology and Information Security Basics
This domain tests the secure operation of security systems and the handling of personal data, which guards collect constantly.
Security systems
CCTV, access control, intruder alarms, fire detection, intercoms, radios, GPS tracking and visitor management all need stable power with backup, scheduled maintenance, fault logging and testing. A fault you notice but do not log is a fault that will be blamed on you.
CCTV operation
Use must be lawful and proportionate, with signage, monitoring only for the stated purpose, access limited to authorised staff, no zooming into private areas, footage preserved for investigations, and exports logged.
Data protection
- The Data Protection Act, 2019 created the Office of the Data Protection Commissioner.
- Principles: lawful and fair processing, purpose limitation, minimisation, accuracy, storage limitation, security and accountability.
- Data subjects may request access, correction and deletion.
- Breaches are reported to the Commissioner without undue delay, and within 72 hours where feasible.
- The Computer Misuse and Cybercrimes Act, 2018 criminalises unauthorised access to systems.
Personal hygiene
Strong unique passwords, multi-factor authentication, locked screens, no shared logins, no passwords on the post, clean desk, no unknown USB devices, verification of callers before giving information, and immediate reporting of phishing or a lost device.
Worked example
A caller says he is the client's IT manager and needs the gate access PIN to reset a door. Do not give it. Take his number, call back on the directory number, and verify with the supervisor. This is social engineering; when in doubt, refuse and escalate.
Traps
Sharing passwords; keeping CCTV footage indefinitely; photographing incidents on a personal phone; assuming guards have no data protection duties; resetting a system without logging it.