Chapter 2: Safeguard office e-data and information

2.1 Office data and information receipt

Receipt is the moment when electronic data first enters the office, and what happens at that moment decides whether the data is safe to use. Office e-data arrives in several forms and through several channels, and each form and each channel carries its own risks. An office administrator who knows what is arriving and how it arrived can check it, route it to the right person and store it correctly, which prepares it for the classification and protection described in the later topics of this chapter. Example: in a freight forwarding office, a customer's shipping instructions may arrive as an email with a spreadsheet attached, as an online order form and as a file placed in a shared folder, and the clerk has to treat all three as business records from the first minute.

2.1.1 Types of office e-data

Office e-data is information held in electronic form that an office creates, receives, uses or stores for its work. Two types arrive in almost every office and need careful handling from the moment of receipt: emails and e-forms.

2.1.1.1 Emails

An email is an electronic message sent from one address to one or more others through a mail server. It has a header, which shows the sender, the recipients, the date and the subject, a body that carries the message, and often one or more attachments such as invoices, contracts or images. Business emails are office records: they hold orders, approvals, quotations, instructions and complaints, and they may be needed later as evidence of what was agreed.

Emails need careful handling because they come from outside the organisation and can be forged. The administrator checks the sender's address in full and not only the display name, treats an unexpected attachment or link as suspect even when it appears to come from a known person, and confirms any request to change bank details or to send money through a second channel such as a telephone call. Emails that form part of the office record are saved to the correct project or client folder and not left only in an individual's inbox.

2.1.1.2 E-forms

An e-form is an electronic version of a paper form, completed on a screen and submitted electronically. Typical examples in an office are a leave application, a purchase requisition, a vehicle booking, a visitor pre-registration and a customer feedback form. A good e-form has labelled fields, drop-down lists and checks that stop a wrong entry, such as a date typed in text form, and sends the answers to a person, a workflow or a database.

E-forms reduce errors and are easy to search, but the data they gather is often personal. The office decides who can see the submitted entries, keeps the form on a protected system and records the date and the sender of each submission. A form that is sent to the wrong address, or one that stores entries where anyone can view them, can expose a customer's details.

2.1.2 Channels for receiving data

A channel is the route through which data reaches the office. Each channel has its own weaknesses, so the security measures are chosen to suit it. Offices usually receive data through a mixture of the following channels.

Email communication

Email is a widely used channel for receiving documents, including attachments and links. Because anyone can send an email to the office, it is a common route for phishing messages and infected attachments. The office uses spam filtering, scans attachments before they are opened and encourages encrypted transfer for sensitive documents. Example: a travel agency's bookings desk receives customers' passport copies and forms by email, and every attachment is scanned before it is opened.

Cloud storage and file sharing platforms

Cloud services such as Google Drive and Microsoft OneDrive let outsiders upload files to a shared folder, or send a link to a file, without an email attachment. They are convenient for large files, but each shared folder needs controlled access, expiry of links that are no longer needed, and a record of who uploaded or opened each file.

Direct system integration

Some organisations exchange data directly between their own systems and those of a supplier or a partner. The data is sent automatically, using an application programming interface (API) or the secure file transfer protocol (SFTP), without anyone typing or attaching it. This is fast and has fewer typing errors, but it depends on strong authentication of both systems and on keeping the connection secure.

Physical media uploads

Data sometimes arrives on a flash disk, a memory card or a CD, for instance when a visiting consultant brings a presentation or a client hands over a project file. Such media can carry malware, so the administrator scans them before opening, uses a computer that is not connected to the main network when possible and does not plug an unknown flash disk into an office computer.

Telecommunication channels

Data may also arrive through text messages, mobile applications and messaging services, for example a driver sending a delivery confirmation photograph from a phone. These channels are quick, but a message can be sent from a stolen phone or a cloned number, so important content is verified and then moved into the office's own record system instead of staying on a personal phone.

Checks on data when it is received

Whichever channel is used, the administrator makes the same basic checks before the data is accepted:

• Source: Confirm that the sender is who they claim to be, by checking the address, the digital signature or a call to a known number.
• Format: Check that the file is in a format the office systems can open securely, such as PDF, a spreadsheet or a database file.
• Security scan: Scan files and links for viruses and signs of phishing before opening them.
• Content: Read enough of the data to see whether it holds personal or financial details, so it can be classified and protected correctly.
• Records: Save the data in the right folder with a clear name and note when and how it arrived.

Chapter Summary

This chapter explored the processes involved in receiving office electronic data and information, highlighting the various types such as emails and e-forms, as well as the channels used for their receipt. It examined the classification of office data and information assessments to ensure proper handling. The chapter emphasized the importance of securing digital records through password protection and controlling access to data with verifiable evidence. Maintaining confidentiality was discussed with a focus on identifying data types that require strict confidentiality measures within organizations. The integrity of electronic data was explained, including its significance, foundational principles, common threats like human errors and cyber-attacks, and strategies to mitigate these risks. Ethical considerations in managing confidentiality were also analyzed, differentiating privacy from confidentiality and outlining ethical practices for protecting sensitive information. Finally, the chapter addressed the proper disposal of confidential documents through methods such as emptying recycle bins, clearing browsing histories, changing passwords, signing out of platforms, and securely shredding physical and digital files.