I currently work in the healthcare billing field, and data security is a big deal. All employees, from receptionists on up, sign a statement acknowledging the HIPPA law. (Health Information Patient Privacy Act.) In the mundane everyday routine of an office, people often follow security protocol without much thought. With that in mind, I thought I'd write down some of the security principles we follow.
The principle of least privilege: How much access does a user need to get the job done? This concept is pretty simple- don't expose yourself to unnecessary risk by giving users access to more than they need. It may be obvious not to allow users to have access than human resources has. There are other cases that are more ambiguous. Should information that an insurance processor needs be available to a person who codes new medical charts? What's the harm? In a world where crazy, random and reckless behavior didn't happen, there wouldn't be any harm. Security personnel should never underestimate the amount of damage a well meaning person can do. It' s not just security risk. They could delete someone else's work. By default, things deleted off a network drive are gone forever, -there is no recycle bin. This principle extends to internet use, and access to physical areas. Whenever possible, narrow the amount of possible things that could go wrong.
Physical security- Most workplaces have security badges and codes to get in these days. It goes back to the previous principle, narrowing and identifying the amount of people in the building narrows the scope of risk of things going wrong.
Equipment security- At my current workplace, we have every piece of electronics identified with a sticker with a unique code. This is for insurance purposes if it gets stolen. I do not like this policy. Those stickers can get lost or damaged. Any thief with a lick of sense would peel the sticker off before selling it. Really, this policy only saves potential lost money from stolen goods. I'd much prefer we used physical locks on the pc towers.
Server Room security- Our server room is accessible by code only, and is kept at 63 degrees 24/7. The server room is far and away the most important security cog in my, and probably most workplaces. Are core software is ran as a terminal window that connects to our server which doles out licenses for a certain amount of logins. The active directory and outlook programs run from here. All of our shared work is here. So needless to say, no work gets done unless everything is in tact. It makes sense to treat it like an icy fortress. Most workplaces keep things even more secure than ours. These rooms often have two part doors where the second door won't open until the first is closed. No tailgaters!
Email security- Everything that goes out is encrypted.
FTP security- All of the information transferred between the hospital is encrypted and opened with a PGP security key.
USB policy- Nope. Regular employees don't need them . Easy way to smuggle out private info.
Password policy- We have passwords for Windows and our software that has to be changed regularly and quickly retired when an employee is terminated.
Shouldersurfing- I've never really encountered this, but for security purposes employees lock their computers when they are away from their desks.
As you can see, security goes fire beyond firewalls and antivirus. The people you work with daily are far and away the biggest threats to information security.
