Information handling policy
(Created page with " ===Risks addressed by policy=== All IT resources (including data, not just equipment) must be appropriately secured from the following risks * Actual or potential breach conf...") |
|||
| Line 14: | Line 14: | ||
Strong passwords – encryption only as strong as access to the relevant user’s account. Another attack risk is keyloggers; thus | Strong passwords – encryption only as strong as access to the relevant user’s account. Another attack risk is keyloggers; thus | ||
* strong account passwords are needed for ALL accounts, especially administrative accounts. | * strong account passwords are needed for ALL accounts, especially administrative accounts. | ||
| − | * regular [[ | + | * regular [[Information handling policy#Malware Sweeps|malware sweeps]] for keyloggers are mandatory. |
| − | ==== | + | ====Policy statements==== |
All individuals who have been allocated network and/or system access are required to | All individuals who have been allocated network and/or system access are required to | ||
| − | * ensure the integrity and confidentiality of their | + | * ensure the integrity and confidentiality of their passwords, passphrases & PINs |
| + | * use ''strong'' passwords and passphrases according to [[Distributor:Password procedures|password procedure]] | ||
* prevent access to unauthorized users when leaving systems unattended, including use of password protected screensavers where appropriate | * prevent access to unauthorized users when leaving systems unattended, including use of password protected screensavers where appropriate | ||
| − | * comply with all security mechanisms, such as log-on controls | + | * comply with all security mechanisms, such as firewall restrictions, log-on/log-off controls and record-keeping |
| − | === | + | ===Use of encrypted disks=== |
| − | + | ====Risks addressed==== | |
| + | User-switching from another admin account allows access to all unencrypted data, as would a successful attack on the login account, and/or direct disk access such as of a lost, stolen, or improperly disposed of hard-disk. Thus use of encrypted disks provide a second layer of defence against these risks. Whole-disk encryption defends access data leakage via swapfiles, temporary files etc | ||
| + | |||
| + | ====Policy statements==== | ||
| + | * Whole-disk encryption must enabled on all PCs and other devices capable of supporting it | ||
| + | * [[TrueCrypt encrypted file container|Strong-encrypted disks]] must be used for ''all'' data, whether sensitive company or patient data or non-sensitive data. | ||
| + | |||
| + | |||
| + | ===Use of encrypted transfers=== | ||
| − | |||
===Backups & Syncs=== | ===Backups & Syncs=== | ||
| − | Weekly overall backups, more regular sync of shared folders | + | Weekly overall backups, and more regular sync of shared folders, as per [[Syncing procedure]] |
===Physical Controls=== | ===Physical Controls=== | ||
| Line 50: | Line 58: | ||
Weekly Spyware | Weekly Spyware | ||
Fortnightly AV | Fortnightly AV | ||
| − | * Any file that is downloaded must be scanned for viruses before it is run or accessed. | + | * Any file that is downloaded or from other external source must be scanned for viruses before it is run or accessed. |
| − | + | * All PCs connected to the Company network must have the Company’s approved Anti-Virus and Anti-Spyware software installed and activated. | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
Revision as of 09:34, 23 May 2012
Contents |
Risks addressed by policy
All IT resources (including data, not just equipment) must be appropriately secured from the following risks
- Actual or potential breach confidentiality from eavesdropping or misdirection (eg plaintext email or courier services or scope of access)
- Loss or breach of confidentiality from intentional attack (eg hacking, break-in)
- Loss or breach of confidentiality from theft or loss (eg stolen laptop, mislaid USB stick)
- Loss through software or hardware failure (eg hard-disk failure)
- Loss or breach of confidentiality through malware (eg virus, key-loggers)
The above risks are removed or minimised by following best practice in information security. To ensure there are no gaps all the below best practice is mandatory policy. The Company’s procedures document in detail the procedures to follow in order to implement the policy defined herein.
Passwords and Passphrases
Risks addressed
Strong passwords – encryption only as strong as access to the relevant user’s account. Another attack risk is keyloggers; thus
- strong account passwords are needed for ALL accounts, especially administrative accounts.
- regular malware sweeps for keyloggers are mandatory.
Policy statements
All individuals who have been allocated network and/or system access are required to
- ensure the integrity and confidentiality of their passwords, passphrases & PINs
- use strong passwords and passphrases according to password procedure
- prevent access to unauthorized users when leaving systems unattended, including use of password protected screensavers where appropriate
- comply with all security mechanisms, such as firewall restrictions, log-on/log-off controls and record-keeping
Use of encrypted disks
Risks addressed
User-switching from another admin account allows access to all unencrypted data, as would a successful attack on the login account, and/or direct disk access such as of a lost, stolen, or improperly disposed of hard-disk. Thus use of encrypted disks provide a second layer of defence against these risks. Whole-disk encryption defends access data leakage via swapfiles, temporary files etc
Policy statements
- Whole-disk encryption must enabled on all PCs and other devices capable of supporting it
- Strong-encrypted disks must be used for all data, whether sensitive company or patient data or non-sensitive data.
Use of encrypted transfers
Backups & Syncs
Weekly overall backups, and more regular sync of shared folders, as per Syncing procedure
Physical Controls
Laptops must be kept secured and out of view when not in use. In particular they must not be left in view of windows in cars or homes.
Access to Company premises is only allowed for the purposes of company business, and is controlled via physical doorway keys and alarm codes. When leaving company premises, all access points (doors and windows) must be locked shut, and the alarm must be armed.
Within company premises, any notes, jottings, letters, or telephone messages must be either shredded immediately after use, or if required to be filed need to be scanned into secure storage and then shredded.
Staff must also ensure they are not subject to eavesdropping while performing company business, especially if either patient information or company confidential information is being discussed.
Scope of Access
Scope of both security access and data access appropriate to job function
Mobile Computing
Prohibit USB sticks or phones, or other mobile media. Laptop or nothing. Home working
Malware Sweeps
Weekly Spyware Fortnightly AV
- Any file that is downloaded or from other external source must be scanned for viruses before it is run or accessed.
- All PCs connected to the Company network must have the Company’s approved Anti-Virus and Anti-Spyware software installed and activated.
