Chapter 3 — Information in organisations

Chapter 3 — Information in organisations

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 What Ashfield holds"]
  N2["3.2 Flows"]
  N3["3.3 Responsibility"]
  N4["3.4 Value and harm"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 What Ashfield holds"]
  N2["3.2 Flows"]
  N3["3.3 Responsibility"]
  N4["3.4 Value and harm"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 What Ashfield holds]
    |
    v
[3.2 Flows]
    |
    v
[3.3 Responsibility]
    |
    v
[3.4 Value and harm]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) identify the information an organisation holds; (2) trace how information flows; (3) recognise who is responsible for it.

3.1 What Ashfield holds

Aisha lists the information Ashfield holds: member identity details, savings and loan records, payment card data, staff records, board minutes and supplier contracts. Some is held in the core banking system, some in email and shared folders and some on paper in branches. Dr. Carrow points out that information on paper and in conversations also needs protection, and that many breaches involve information outside the main systems. She also notes paper application forms stored in branch cabinets, and loan files waiting for scanning in an unlocked tray, as examples of information outside any computer system.

3.2 Flows

Information moves. A new member's identity documents are scanned at a branch, uploaded to the core system and checked by a compliance officer. Loan applications pass from branch staff to lending officers to a credit committee. Aisha draws these flows and notes where information leaves Ashfield, for example to a credit reference agency and a card processor. She learns that each flow is a point where information could be intercepted, altered or lost. She labels each arrow on her diagram with the information it carries and the method used to send it.

3.3 Responsibility

Every type of information needs someone responsible for deciding how it is protected. At Ashfield, the head of lending is responsible for loan records and the compliance officer for identity documents. Aisha finds that nobody is clearly responsible for the shared folders, where staff save copies of reports. Dr. Carrow explains that unowned information tends to accumulate without controls, and that assigning ownership is often the first practical security step. Ashfield's chief executive later assigns the shared folders to the head of operations, who starts by asking teams to delete old copies.

3.4 Value and harm

Aisha estimates the harm if each type of information were exposed, altered or unavailable. Exposure of identity documents could enable fraud against members; altered loan records could hide bad loans; unavailable core banking stops all transactions. She ranks the information by potential harm. She learns that this ranking guides where to spend limited security effort, and that it must be reviewed when the organisation changes. She presents the ranking to her seminar group, who challenge two of her placements. After discussion she moves board minutes higher, because they contain confidential decisions about loan losses and staff.

Worked example

Aisha lists Ashfield's information, draws flows including external ones, finds unowned shared folders and ranks information by potential harm.

Synthetic case. Information types are synthetic.

Errors and limits

Ignoring paper and shared folders leaves much information unprotected.

Exercises

• EX007 — External recipients. Name one external recipient of Ashfield information. Rubric: 3 = credit reference agency;; 2 = one;; 1 = vague;; 0 = none.
• EX008 — Unowned store. Which store had no responsible person? Rubric: 3 = shared folders;; 2 = partly correct;; 1 = other;; 0 = none.
• EX009 — Ranking purpose. What does ranking by harm guide? Rubric: 3 = where to spend security effort;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 03 (chapter 03 of 40)

← Chapter 02 · Course chapter index · Chapter 04 →

Continue to the next authored lesson.