Transcription
NETWORK SECURITY POLICYPolicy approved by: Assurance CommitteeDate: 3 December 2014Next Review Date: December 2016Version: 1.0Page 1 of 12Network Security Policy
Review and Amendment Log/Control SheetResponsible Officer:Chief Financial OfficerClinical Lead:Medical DirectorAuthor:Date Approved:Kath Allen Information Governance Specialist, DavidGreen Information Governance Advisor3 December 2014Committee:Assurance CommitteeVersion:1.0Review Date:December 2016Version HistoryVersion0.1Date10 Sept 2014AuthorIG SpecialistWSYBCSUDescriptionInitial DraftCirculationDirector of Informatics0.223 Sept 2014IG AdvisorAmendments andrationalisation of policySenior ManagementTeam, all staff, CounterFraud LeadFurther amendmentsand corrections.Advice section detailsaddedAssurance CommitteeDirector ofInformatics0.318 Nov 2014IG AdvisorEquality Impact AssessmentIn applying this policy, the organisation will have due regard for the need to eliminateunlawful discrimination, promote equality of opportunity, and provide for good relationsbetween people of diverse groups, in particular on the grounds of the followingcharacteristics protected by the Equality Act (2010); age, disability, gender, genderreassignment, marriage and civil partnership, pregnancy and maternity, race, religion orbelief, and sexual orientation, in addition to offending background, trade unionmembership, or any other personal characteristic. A single Equality Impact Assessment isused for all policies and procedures.This document has been assessed to ensure consideration has been given to the actual orpotential impacts on staff, certain communities or population groups.Page 2 of 12Network Security Policy
44Accountability and Responsibilities54.1Provision of IT and Network Services55Definition of Terms66Processes to Ensure Network Security66.1Risk Management66.2Physical and Environmental Security66.3Access Controls to the Network76.4Third Party Access to the Network76.5External Network Connections86.6Connecting Devices to the Network86.7Maintenance Contracts86.8Fault Logging86.9Network Operating Procedure86.10Data Backup and Restoration96.11Malicious Software96.12Unauthorised Software96.13Changes to the Network96.14Security Monitoring106.15Reporting Serious Incidents and Weakness107Training108Implementation and Dissemination109Monitoring Compliance and Effectiveness of the Policy1110Advice1111Associated Documents1112Legal References and Guidance12Page 3 of 12Network Security Policy
NETWORK SECURITY POLICY1.INTRODUCTIONThis Network Security Policy sets out the NHS Leeds West ClinicalCommissioning Group (CCG) overall approach to the maintenance of theintegrity, confidentiality and availability of its information technology infrastructureand sets out the responsibilities for ensuring compliance with this guidance.The policy forms part of the overall CCG approach to information governanceand should be read in conjunction with the organisation’s other informationgovernance and security policies and procedures.2.AIMSThe aim of this policy is to ensure that all staff understand their obligations withregard to the network infrastructure and the acceptable use of informationtechnology equipment and systems which they come into contact with in thecourse of their work. It also provides assurance to the Governing Body that suchsystems are maintained and used legally, securely, efficiently and effectively.The CCG will establish, implement and maintain procedures linked to this policyto ensure compliance with the requirements of Data Protection Act 1998, recordsmanagement guidance, information security guidance, other related legislationand guidance, contractual responsibilities and to support the assurancestandards of the Information Governance Toolkit. The Toolkit standards are: Information Governance ManagementConfidentiality and Data Protection AssuranceInformation Security AssuranceClinical Information AssuranceApplication of the policy will ensure the networks used by the CCG: 3.Are available when and where requiredAre secure at all timesRetain their integrityAre protected from unauthorised or accidental modificationAre designed and maintained to preserve confidentialityProtect information assetsSCOPEThis policy must be followed by all staff who work for or on behalf of the CCGincluding those on temporary or honorary contracts, secondments, volunteers,pool staff, Governing Body members, students and any staff working on anindividual contractor basis or who are employees for an organisation contractedto provide services to the CCG. The policy is applicable to all areas of theorganisation and adherence should be included in all contracts for outsourced orshared services. There are no exclusions.Page 4 of 12Network Security Policy
This policy applies to:All networks to which the organisation has access for: The storage and sharing and transmission of non-clinical data and imagesThe storage and sharing and transmission of clinical data and imagesPrinting or scanning non-clinical or clinical data and imagesThe provision of Internet systems for receiving, sending and storing nonclinical or clinical data and imagesThe provision of remote access to internal systems via secure access routesFailure to adhere to this policy may result in disciplinary action and wherenecessary referral to the appropriate regulatory bodies including the police andprofessional bodies.4.ACCOUNTABILITY AND RESPONSIBILITIESThere are a number of key Information Governance roles and bodies that theCCG needs to have in place as part of its Information Governance Framework,these are: Governing BodyAssurance CommitteeAccountable OfficerSenior Information Risk OwnerCaldicott GuardianInformation Asset OwnerInformation Asset AdministratorHeads of ServiceAll employeesThe accountability and responsibilities are set out in more detail in theInformation Governance Strategic Vision, Policy and Framework which must beread in conjunction with this policy.In addition to responsibilities outlined in the Information Governance StrategicVision, Policy and Framework some additional responsibilities are detailed inrespect of network security for employees. They must ensure through theirnormal working practices that the network is protected through such safeguardsas locking screens when not in use, logging off the network when finished,prevent the introduction of Malicious Software. These safeguards are coveredwithin the sections of this policy and also in the Information Security Policywhich details safeguards in the workplace.4.1Provision of IT and Network ServicesIT and network services are provided by a service provider on behalf of the CCG.The service provider has provided assurances to the CCG to ensure integrity,confidentiality and security of CCG information in the provision of those services.Therefore, some of the roles and responsibilities outlined in this policy refer toPage 5 of 12Network Security Policy
staff roles that are part of the service provider organisation e.g. Head ofInformation Technology who will have specific responsibilities in terms ofensuring process and security arrangements are complied with. However, theoverarching responsibility for security of CCG information affected by theoperation of the network remains with the CCG.5.DEFINITION OF TERMSThe words used in this policy are used in their ordinary sense and technicalterms have been avoided.The network is a collection of communication equipment such as servers,computers, printers, switches, hubs and routers, which have been connectedtogether. The network is created to share data, software, and peripherals suchas printers, photocopiers, Internet connections, email connections, tape drives,hard disks and other data storage equipment.6.PROCESSES FOR ENSURING NETWORK SECURITYSome of the roles and responsibilities mentioned below will be of staff who areemployees of the service provider organisation who provide IT services, theseinclude Head of Information Technology (IT), Chief Information Officer, NetworkManager and Information Security Manager.6.16.2Risk Management Risk assessments will be carried out in relation to all the business processescovered by this policy as part of business continuity and disaster recoveryplanning. These risk assessments will cover all aspects of the network thatare used to support business processes. The risk assessment will identify theappropriate security countermeasures necessary to protect against possiblebreaches in confidentiality, integrity and availability. Risk assessments will be conducted by the service provider to ensure thenetworks conforms to ISO27001 Risk assessments will be conducted by the service provider to determine theInformation Technology Security Evaluation Criteria (ITSEC) Assurancelevels required for security barriers that protect the network.Physical and Environmental Security Entry to secure areas housing critical or sensitive network equipment will berestricted to those whose job requires it. The Head of IT will maintain andperiodically review a list of those with unsupervised access.Network computer equipment will be housed in a controlled and secureenvironment.Critical or sensitive network equipment will be housed in secure areas,protected by a secure perimeter, with appropriate security barriers and entrycontrols.The Head of IT is responsible for ensuring that door lock codes for entry toPage 6 of 12Network Security Policy
6.3Access Control to the Network 6.4Network Equipment are changed periodically where there has been acompromise of the code, it is suspected that the code has beencompromised, or when required to do so by the Chief Information Officer.Critical or sensitive network equipment will be protected from power supplyfailures by the use of Uninterruptible Power Supply (UPS) devices.Critical or sensitive network equipment will be protected by intruder alarmsand fire suppression systems.Smoking, eating and drinking is forbidden in areas housing critical or sensitivenetwork equipment.All visitors to secure network areas must be authorised by the Head of IT orthe relevant Network Support Manager for that area.All visitors to secure network areas must be made aware of network securityrequirements.All visitors to secure network areas must be logged in and out. The log willcontain name, organisation, purpose of visit, date, and time in and out.The Head of IT or Network Support Manager will ensure that all relevant staffare made aware of procedures for visitors and that visitors are escorted,when necessary.Access to the network will be via a secure log-on procedure, designed tominimise the opportunity for unauthorised access.Where remote access to the network is implemented remote access policyand home working/mobile working procedures will apply.There is a formal, documented user registration and de-registration procedurefor access to the network. Forms for new user, changes and leavers areavailable on the Extranet.The staff member’s line manager must approve the application.Access rights to the network will be allocated on the requirements of theuser's job, rather than on a status basis.Security privileges (i.e. 'super user' or network administrator rights) to thenetwork will be allocated on the requirements of the user's job, rather than ona status basis.Access will not be granted until the Network Support Manager, IT Helpdesk,or Head of IT registers a user.All users to the network will have their own individual user identification andpassword.Users are responsible for ensuring their password is kept secret.User access rights will be immediately removed or reviewed for those userswho have left the organisation or changed jobs.Third Party Access Control to the NetworkThird party access to the network will be based on a formal contract that includesa standard clause which satisfies all necessary NHS confidentiality and securityconditions and completion of A New User Form must also be completed and allthird party access to the network must be logged.Page 7 of 12Network Security Policy
6.5External Network Connections 6.6Connecting devices to the CCG Network 6.7All connections to external networks and systems must have documented andapproved system security policies and procedures.All connections to external networks and systems must conform to the NHSwide Network Security Policy, Code of Connection and supporting guidanceAll external connections must be approved by the Information SecurityManager.All devices connected to the CCG network are governed by the NHSStatement of Compliance.The connection of any equipment to the CCG network requires authorisationfrom the IT service provider.All electronic processing devices connecting to the CCG network must beprotected by up to date anti-virus software. Where the device does notupdate automatically, it is the responsibility of the user to ensure that theanti-virus software is up to date.Personally owned devices should only be directly connected to the Networkwith appropriate authorisation from the IT service provider. ‘Personallyowned’ refers to devices that are not provided by the CCG or other NHSorganisation and directly connected means either by network cable orcorporate Wi-Fi. However, a guest Wi-Fi facility can be used.The CCG has the facility to allow non-NHS provided devices to connect tothe internet via a ‘guest’ wireless connection. This will be via password thatis changed regularly.External visitors may connect to the internet via a ‘guest’ Wi-Fi account.Maintenance ContractsThe Network Support Manager/Head of IT will ensure that maintenance contractsare maintained and periodically reviewed for all network equipment. All contractdetails will constitute part of the Asset Register.6.8Fault LoggingThe Head of IT and Help Desk Manager are responsible for ensuring that a log ofall faults on the network is maintained and reviewed. A written procedure toreport faults and review countermeasures will be produced.6.9Network operating proceduresDocumented operating procedures should be prepared for the operation of thenetwork, to ensure its correct, secure operation. Changes to operatingprocedures must be authorised by the Head of IT.Page 8 of 12Network Security Policy
6.10Data Backup and Restoration 6.11The Network Support Manager and their team are responsible for ensuringthat backup copies of network configuration data are taken regularly.Documented procedures for the backup process and storage of backup tapeswill be produced and communicated to all relevant technical staff.All backup tapes will be stored securely and a copy will be stored off-site.Documented procedures for the safe and secure disposal of backup mediawill be produced and communicated to all relevant staff.Users are responsible for ensuring that they back up their own work-relateddata to the network server i.e. not storing data on a local hard drive.Malicious SoftwareMeasures are in place to detect and protect the network from viruses and othermalicious software – viruses, spyware, Trojan horses, worms etc.6.12Unauthorised SoftwareRequired use of any non-standard software equipment processing CCGinformation must be notified to the Head of IT before installation. All softwareused on NHS equipment must have a valid licence agreement. It is theresponsibility of the “owner” or responsible user of non-standard software toensure that this is the caseSoftware is no longer centrally funded from a National Programme. Any newadditional PCs added to the network must have a licence for the appropriatesoftware i.e. Operating System, SQL Client, Exchange Client, Anti-Virus,Microsoft Office etc.6.13Changes to the Network Any proposed changes to the network will be reviewed and approved by theHead of IT and passed where appropriate to the Chief Technology Officer.The Network Support Managers are responsible for updating all relevantdesign documentation, security operating procedures and network operatingprocedures.The Head of IT or the Chief Technology Officer may require checks on, or anassessment of the actual implementation based on the proposed changes.The Head of IT is responsible for ensuring that selected hardware or softwaremeets agreed security standards.As part of acceptance testing of all new network systems, the Head of IT willattempt to cause a security failure and document other criteria against whichtests will be undertaken prior to formal acceptance.Testing facilities will be used for all new network systems. Development andoperational facilities will be separated.Page 9 of 12Network Security Policy
6.14Security MonitoringThe Head of IT will ensure that the network is monitored for potential securitybreaches. All monitoring will comply with current legislation.6.15Reporting Security Incidents and WeaknessesA major incident would constitute a loss of function of a system or breach ofconfidential information for one or more individuals or a breach of informationwhich is likely to lead to harm to an individual, therefore: All potential security breaches must be reported in accordance with therequirements of the Incident Reporting Policies and the SIRO must beinformed about serious incidents. Investigations will be undertaken by the appropriate Information TechnologyOfficers or someone nominated by them. Incidents will be reviewed in line with the Incident Reporting Policies. Any information governance related incident, especially related to a breach ofthe Data Protection Act such as one that has the potential to be classed as aSerious Incident Requiring Investigation (SIRI) will need to be logged on theIncident Reporting Module on the Information Governance Toolkit to grade theincident. The CCG Information Toolkit Administrator will have access to themodule and can grant access to appropriate staff. Examples of SIRIs arewhen there is a loss of personal data involving many individuals or whereparticularly sensitive personal information is lost or sent to the wrong address.Staff must read the Incident Reporting Policy for general reporting of incidentsand the process for SIRIs.7.TRAININGInformation governance and security will be a part of induction training and ismandatory for all staff. The CCG will identify the information governance trainingneeds of key staff groups taking into account their role, responsibility andaccountability levels and will review this regularly through the PersonalDevelopment Review process.8.IMPLEMENTATION AND DISSEMINATIONFollowing ratification by the Assurance Committee this policy will bedisseminated to staff via the CCG’s Extranet and communication through inhouse staff briefings.This Policy will be reviewed every two years or in line with changes to relevantlegislation or national guidance.Page 10 of 12Network Security Policy
9.MONITORING COMPLIANCE AND EFFECTIVENESS OF THE POLICYAn assessment of compliance with requirements, within the InformationGovernance Toolkit (IGT), will be undertaken each year. This includesinformation and network Security, confidentiality and data protection. Incidentsare reported and all serious information governance issues must be reported bythe SIRO at Governing Body level and in Annual Reports.Any suspicion of fraud or bribery should be reported at the earliest availableopportunity by contacting the CCG Counter Fraud Specialist at the following link:Counter fraud10.ADVICEAdvice and guidance on any matters stemming from the Policy can be obtainedby contacting:yhcs.infogov@nhs.net11.ASSOCIATED DOCUMENTS(Policies, protocols and procedures)The CCG will produce appropriate procedures and guidance inconjunction This will include an Information Governance Handbookwhich will be updated annually and which will be given to all staff.This policy should be read in conjunction with: Confidentiality and Data Protection PolicyRecords Management and Information Lifecycle PolicyFreedom of Information Act and Environmental Information RegulationsPolicyInformation Governance Strategic Vision, Policy and FrameworkInformation Security PolicyRisk Management PolicyIncident Reporting PolicyBusiness Continuity PolicyAnd their associated procedures (including but not limited to) Access to Records ProcedureInformation Sharing ProtocolFreedom of Information ProceduresPrivacy Impact ProcessesRemote Access and Home Working ProceduresSafe Haven ProcedureAnti-Fraud PolicyAnti-Bribery PolicyWhistle Blowing PolicyInternet and Email Policies and ProceduresAny system specific proceduresPage 11 of 12Network Security Policy
12.LEGAL REFERENCES AND GUIDANCE NHS Act 2006Data Protection Act 1998Human Rights Act 1998Computer Misuse Act 1990Caldicott Guidance as updated 2013Common Law Duty of ConfidentialityAccess to Health Records Act 1990 (where not superseded by the DataProtection Act 1998)Health and Social Care Act 2012Crime and Disorder Act 1998The Children Act 1989 and 2004 Copyright, Designs and Patents Act 1988(as amended by the Copyright (Computer Programs) Regulations 1992Electronic Communications Act 2000Regulation of Investigatory Powers Act 2000 (& Lawful Business PracticeRegulations 2000)Public Interest Disclosure Act 1998Audit & Internal Control Act 1987Prevention of Terrorism (Temporary Provisions) Act 1989 & Terrorism Act2000Road Traffic Act 1988Regulations under Health and Safety at Work Act 1974Public Records Act 1958Freedom of Information Act 2000Environmental Information Regulations 2004Protection of Freedoms Act 2012Coroners and Justice Act 2009Fraud Act 2006Bribery Act 2010Enterprise and Regulatory Reform Act 2013Equality Act 2010NHS Information Security Management Code of Practice 2007ISO/IEC 27001:2005 Specification for an Information SecurityManagement systemHealth and Social Care Information Centre GuidanceProfessional Codes of Conduct and GuidanceInformation Commissioner’s Guidance DocumentsPage 12 of 12Network Security Policy
Information Governance Strategic Vision, Policy and Framework which must be read in conjunction with this policy. In addition to responsibilities outlined in the Information Governance Strategic Vision, Policy and Framework some additional responsibilities are detailed in respect of network security for employees. They must ensure through their
