It seems to a person, and it probably is so, that once important data was stored more securely than it is today. Because until about 20 years ago, to steal some important data for the state or a company, we had to have some ‘insider’ who would enable us to do so or thoroughly study the blueprints of the buildings where the information was archived. Thus, a lot of physical effort had to be invested in the project of data theft, and today, as we increasingly digitize data, it seems that their availability to unauthorized persons has increased. Of course, this is somewhat of an exaggeration, but it is undeniable that we need a higher level of security today more than ever.
Formal and Hybrid
Marin Curavić, head of business processes at ASEE & IT Sistemi, says that the organization of document storage in physical or digital form is based on regulatory frameworks that differ for legal entities depending on whether they are companies or institutions in private or state ownership. It is, he explains, about formal frameworks, and a good practice of the legislator is, he adds, that it has left the freedom of execution of technical solutions that will satisfy the formalities. In addition, he states, storage is also defined by legal protection in relations with third parties, as well as the optimization of business process execution.
—
—Filip Olujić, CEO of Databox, also reminds that there are data and documentation that every taxpayer is obliged to keep, with prescribed retention periods. These are tax, customs, labor law, and similar regulations, and how they will be stored is decided by each organization independently, considering that the digital transformation of data is quite rapid and new offerings come up frequently. Furthermore, cloud computing services are becoming increasingly available, so organizations store their accounting data and documents physically, while digitally storing everything else using sharing, secure storage, and secure archiving services for documents.
– The perception of colocating computer equipment at one’s own premises and in a commercial data center is slowly but surely changing. Colocating computer equipment in one’s own space will, in most cases, not be as accessible and secure as in a data center, where security is the highest priority – explains Olujić.
However, Curavić adds, despite the trend of paperless business, even the technology giants who advocate it cannot avoid a hybrid management approach, that is, the simultaneous need to work with both physical and digital documentation. To find the best solutions, a holistic approach in the design and implementation of solutions is necessary, taking into account the connection of digital with physical and long-term management that should ensure long-term or unlimited access to documents. Care must be taken regarding all aspects of authorized access and protection against unauthorized access.
– When we talk about a holistic approach, this implies a combination of appropriate software, hardware, and physical mechanisms. In the digitization of business processes or optimization of processes with physical documentation, it is always crucial to conduct a quality analysis of business processes and their value for the business – notes Curavić.
Systematic Deletion and Destruction
And what do we do when we need (or perhaps want) to destroy data? How is this done? First of all, there are legal deadlines by which we must keep documentation, so it is certainly not wise to destroy it before the deadline, regardless of the reasons. However, after the retention period expires, it becomes a nuisance, especially when we talk about physical documentation.
—
—However, the reason for destroying physical documentation can also be its digitization, and Curavić says that depending on the data content, destruction is carried out at the appropriate level of control, i.e., appropriate physical and digital mechanisms of implementation are ensured where control is needed.
– Solutions aligned with global standards such as ISO 15489 and MoReq modular requirements for records systems, EU directives, and relevant local laws and subordinate frameworks enable business entities to carry out the selection and destruction of data systematically with appropriate records of the implementation of activities and accompanying reports that are submitted to the responsible institutions as needed – explains Curavić.
Olujić, on the other hand, reminds us of another important thing. Namely, deleting data is not the same as destroying the storage medium because if we delete some data or document, the overwritten medium can be reused. With destruction and demagnetization, it is a different matter, and demagnetization is most commonly used in Databox. This refers to the destruction of data from magnetic media, which, he adds, is the most reliable method.
– By applying the demagnetization process, hard drives for data storage become unusable, so the next step is their physical destruction with a shredder. Physical destruction alone is not enough without demagnetization because when a hard drive is physically damaged, theoretically, we can still read data from pieces of the magnetic plate – explains Olujić.
Physical to Digital
The largest data storage in our country is in the Croatian State Archive. In that institution, they say that public documentary and archival materials are handled in accordance with the Archives Act and related implementing regulations, and there are also rules for handling digital materials, as previous interlocutors have told us.
In the Croatian State Archive, they emphasize what is specifically important when it comes to converting physical documentation into digital form. They point out that all essential properties, components, effects, and usability of the original material must be preserved (preservation of the integrity of the material) and that the conversion of the material is carried out in a way that provides reasonable assurance that unauthorized and undocumented additions, changes, or removals of the properties of the material or individual data have not been made.
—
On average, one black-and-white document stored in the cloud takes up 50 KB of electronic archive, and in 1 GB of electronic archive, there are as many as 20,000 pages. For comparison, a classic business filing cabinet holds about ten thousand documents.
—
In addition, the process of conversion to digital form must be carried out in accordance with established rules and appropriately documented to ensure and verify the correctness and quality of the conversion. When converting to digital form, regulations governing copyright must be respected, as well as other regulations governing the conditions and procedures for converting certain types of documentary material.
Today, everything is digitized, and it is much easier than before to organize an archive, but also to search for a document in it. Because the advantage of a digitized archive is in many ways. For example, we can find it on the computer in a few seconds using a keyword, while reviewing a physical archive takes us minutes, and sometimes, if we haven’t organized it properly, even days. And then we find the document, as it happens, when we no longer need it.
—
Tax, customs, labor law data and documentation must be kept by every taxpayer according to prescribed deadlines.
—
There are more advantages. For example, the portal Moj-eRačun states that on average, one black-and-white document stored in the cloud takes up 50 KB of electronic archive, and in 1 GB, there are as many as 20 thousand pages, while a classic business filing cabinet holds about ten thousand documents, and each such cabinet occupies about one square meter of space. With proper storage, recovery of the digital archive is possible in a few moments because the data is stored on multiple servers, while physical archiving is subject to human (unintentional destruction or loss, fire) or natural disaster impacts.
However, the downside is that a capable hacker can access digitized documentation without needing to be physically present in the facility. But a person cannot create a perfect system; they can only improve it.
