Security Policies

Security Policies

1. Why have a policy

   • DPA puts onus on the practice to keep this information secure because of its potential for misuse

2. What a policy should contain

   • Rules on passwords and User IDs
   • Access rights
   • Firewalls
   • Virus checkers
   • Encryption
   • Physical security measures
   • Back up and restoration strategies
   • Staff code of conduct
   • Disciplinary procedures

3. Auditing - keeps record of who has done what on the network

   • Keeps a record of:
     • Usernames
     • Times logged on and off
     • Details of programs they used
     • Details of files accessed
     • Details of changes made
     • Details of from which machine

4. Potential threats to data

   • Terrorism
     • E.g. Cyber attacks to slow down or prevent online services
       • Loss of reputation
   • Criminal vandalism/sabotage
     • Attacks on firewalls by viruses to destroy data
       • Loss of business and income
   • Natural disasters
     • Floods, earthquakes
       • Costs of recovering data
   • Theft of data
     • Stealing storage media containing data
       • Legal action

5. Operational procedures

   • Screening potential employees
     • Ensure staff are controlled, CRB checks, Fit employee to the task
   • Establish security rights for updating web pages
     • Who.what/when
   • Establish a disaster recovery programme
     • Back up plans
   • Logon procedures/ User IDs and passwords
     • Allocating access rights, change regularly