It looks like NHS trusts are starting to realise that Information Security is not just a matter of using complex passwords, locking drawers at the end of the day and installing the latest firewall and antivirus solutions. The Information Commissioner has been particularly critical of the NHS in the past due to a high proportion of security breaches as a result of inadequate Information Security controls and staff awareness programmes. The result has been an NHS wide initiative to ensure all removable media including laptops and USB drives are encrypted. However, this may not be enough. As reported by the BBC recently, a remarkable amount of non-medical personnel at UK trusts have access to patient records including recent medical history - at least 100,000 including porters, hospital domestics and IT staff, a Big Brother Watch survey stated.
It seems like the risk is not only from staff at off-shore service providers collecting and selling British data to make a few extra pounds, as reported on ITV not long ago. It also comes from internal personnel who have the potential to access extremely sensitive data without the appropriate authority or preventative controls.
This is not surprising: data collected in the BIS Information Security Breaches Survey 2009 illustrated that 60 per cent of all companies suffered a security breach in the previous two years and of these, 50 per cent were perpetrated by staff, often premeditated or malicious but in many cases simply a matter of a stolen laptop or lost removal media device.
There is an obvious need for greater awareness of information security regulations across the entire organisation, and measures must be taken to protect personal and sensitive data. Management in particular need to be involved in order to avoid resentment, complacency and to ensure everyone takes the matter seriously.
In the case of the NHS, information at risk is highly sensitive and breaches can have very serious outcomes. Consequences of Data Protection Act breaches are not confined to costly fines and a few employees being fired - it is the organisation's reputation that suffers the most.
This risk can be mitigated by conducting an independent gap analysis and security review which would assess compliance with Information Security best practice, i.e. ISO27001, IG Toolkit v7, and certify that information held within an organisation is secure, reducing the risk of incidents and the cost to the business.
Equally important are staff awareness sessions to which not only general staff but executive participation is required, which is vital in creating a culture where Information Security is part of the organisation's DNA.
David Cowan, Head of Infrastructure and Security
December(2) October(3) September(2) August(1) June(2) May(3) April(2) March(3) Current Month(1)
December(2) November(2) October(4) September(3) August(1) July(3) June(7) May(2) April(2) March(4) Current Month(6) January(2)
December(3) August(1) July(1) June(1) May(3) March(1) Current Month(3)
T: +44 (0)20 7353 4313 F: +44 (0)20 7353 4314
Hamilton House, 1 Temple Avenue, London EC4Y 0HA
