Information handling policy
Contents |
Risks addressed by policy
All IT resources (including data, not just equipment) must be appropriately secured from the following risks
- Actual or potential breach confidentiality from eavesdropping or misdirection (eg plaintext email or courier services or scope of access)
- Loss or breach of confidentiality from intentional attack (eg hacking, break-in)
- Loss or breach of confidentiality from theft or loss (eg stolen laptop, mislaid USB stick)
- Loss through software or hardware failure (eg hard-disk failure)
- Loss or breach of confidentiality through malware (eg virus, key-loggers)
The above risks are removed or minimised by following best practice in information security. To ensure there are no gaps all the below best practice is mandatory policy. The Company’s procedures document in detail the procedures to follow in order to implement the policy defined herein.
Passwords and Passphrases
Risks addressed
Strong passwords – encryption only as strong as access to the relevant user’s account. Another attack risk is keyloggers; thus
- strong account passwords are needed for ALL accounts, especially administrative accounts.
- regular malware sweeps for keyloggers are mandatory.
Policy statements
All individuals who have been allocated network and/or system access are required to
- ensure the integrity and confidentiality of their passwords, passphrases & PINs
- use strong passwords and passphrases according to password procedure
- prevent access to unauthorized users when leaving systems unattended, including use of password protected screensavers where appropriate
- comply with all security mechanisms, such as firewall restrictions, log-on/log-off controls and record-keeping
Use of encrypted disks
Risks addressed
User-switching from another admin account allows access to all unencrypted data, as would a successful attack on the login account, and/or direct disk access such as of a lost, stolen, or improperly disposed of hard-disk. Thus use of encrypted disks provide a second layer of defence against these risks. Whole-disk encryption defends access data leakage via swapfiles, temporary files etc
Policy statements
- Whole-disk encryption must enabled on all PCs and other devices capable of supporting it
- Strong-encrypted disks must be used for all data, whether sensitive company or patient data or non-sensitive data.
Use of encrypted transfers
Backups & Syncs
Weekly overall backups, and more regular sync of shared folders, as per Syncing procedure
Physical Controls
Laptops must be kept secured and out of view when not in use. In particular they must not be left in view of windows in cars or homes.
Access to Company premises is only allowed for the purposes of company business, and is controlled via physical doorway keys and alarm codes. When leaving company premises, all access points (doors and windows) must be locked shut, and the alarm must be armed.
Within company premises, any notes, jottings, letters, or telephone messages must be either shredded immediately after use, or if required to be filed need to be scanned into secure storage and then shredded.
Staff must also ensure they are not subject to eavesdropping while performing company business, especially if either patient information or company confidential information is being discussed.
Scope of Access
Scope of both security access and data access appropriate to job function
Remote Access
Policy statements
Strong encryption is mandatory at all times.
- Such encryption may be via VPN, or via the use encryption tools such as CVS using Putty
In addition to strong encryption, 2-factor authentication is mandatory for
- any access to patient-identiable data
- any access to N3
- any remote support (as this is most likely to have exposure to patient-identifiable data)
Refer to Remote working policy for other policy items applicable to remote working.
Mobile Computing
Prohibit USB sticks or phones, or other mobile media. Laptop or nothing. Home working
Malware Sweeps
Weekly Spyware Fortnightly AV
- Any file that is downloaded or from other external source must be scanned for viruses before it is run or accessed.
- All PCs connected to the Company network must have the Company’s approved Anti-Virus and Anti-Spyware software installed and activated.