IT Security Policy

The Development Team are responsible for monitoring the use of Our Information systems to ensure this IT Security Policy is not breached. The Development Team are responsible for enforcing effective operation of this IT Security Policy to ensure that Information Systems and other devices are adequately protected.

All Users are required to demonstrate compliance to this IT Security Policy in order to protect the confidentiality, integrity, and availability of Our Information Systems. This IT Security Policy also extends to contractors, consultants and/ or 3rd parties providing services to Us.

Safe guarding the confidentiality of Information through the protection of information from unauthorised disclosure with access only by entitlement. 

Data Classification and Management

• Blue Ring Digital Services Ltd and Users are obligated to respect the rights of individuals and to protect confidential Data;
• All of Our digital records should be classified according to the Data Management Policy; 
• When Data is classified as confidential Data, appropriate access and security controls are applied in transmission and storage. Confidential Data is not to be transmitted without adequate precautions being taken to ensure that only the intended recipient can access the Data; 
• All of Our Data is to be treated as confidential if not otherwise indicated;
• Where Data and Information systems on the Our Network are accessed by 3rd parties (such as suppliers, contractors and consultants) for support and maintenance provided to Us, a Third Party Access request form with the accompanying Data Protection agreements must be built into the service agreement with the 3rd party.

Network Security

• The Development Team maintain a perimeter firewall. All externally facing services must be registered, this register is used to configure the firewall based on the services they offer. This eliminates low level vulnerability probing attacks from the internet while allowing access to registered services;
• In addition to the perimeter firewall, some network ranges are protected by access-lists or additional firewalls;
• Perimeter traffic is logged and appropriately monitored for security purposes;
• Devices that connect to Our Network should have:
  • Anti-virus installed and up-to-date;
  • An Operating System patched with latest security updates;
  • Personal Firewall active;
  • User authentication.

User Authentication and Audit Logging

• Authentication is required for each connection to Our Network;
• Where possible two factor authentication should be considered for access to Information Systems that process sensitive Data;
• Users must follow best practices to prevent misuse, loss or unauthorised access to systems:
  • Keep passwords confidential;
  • Change passwords regularly;
  • Never write down passwords;
  • Never send passwords via email, fax or post;
  • Change temporary passwords at first logon;
• Do not leave Your device unattended without locking Your device or logging off.
• Audit logs containing the following User events of staff, students and any 3rd parties accessing Our Network are captured and monitored:
  • User IDs;
  • Dates and times for logon and logoff;
  • Computer identity and location where possible;
  • Records of successful and rejected system access attempts;
  • Records of successful and rejected system access attempts;
  • Monitoring of privileged User accounts.

Encryption

• All Devices owned by Us must have their storage space encrypted;
• All of Our devices must be protected by encryption and layered authentication where appropriate;
• Where personal Data is being stored by Users on a portable Device, then this Data must be encrypted;
• Where sensitive Information is transmitted through a public network to an external third party the data must be encrypted first and sent via secure channels (SFTP, SSH, HTTPS or VPN);
• WIFI networks must be encrypted using WPA2 or better.

Integrity

Safeguarding the integrity of Data such as the accuracy and completeness of Information, by protecting against unauthorised modification.

User Access and Audit Logging

• Access to data is granted on a needs only basis, Users are granted specific access to allow them to carry out their job functions;
• Access to amend data and/ or access to Information Systems which process and record this Data is restricted to authorised personnel;
• All Users have a unique User ID for their personal and sole use so that activities can be traced to the responsible person;
• Access to device administration settings, software code, services and commands is restricted to only those individuals who require access as part of their day-to-day job responsibilities;
• All access to Information systems is to be logged and appropriately monitored to identify potential misuse of Information Systems or Data. Logs must be retained and access granted according to the appropriate legislation;
• Security event logs, operational audit logs, error logs, transaction and processing logs are monitored on information systems and retained to record events for trouble shooting, provide forensics during security incidents and to identify potential misuse of Information Systems and Data;
• An appropriate audit trail including database logs of the creation, amendment and deletion of Our data is to be maintained. 

Vulnerability Management

Users connecting a Device to Our Network is responsible for ensuring that the device is configured correctly, that the operating system and software applications are up-to-date and that the device has adequate protection against viruses and other malware. If there is any suspicion that the device may be infected or compromised it must not be connected.

• Devices be hardened appropriately before joining Our network and should be locked down before being used in a production environment; 
• Information Systems and Devices must follow a regular update schedule to ensure they remain protected from security vulnerabilities and remain within mainstream support;
• Antivirus is a compulsory pre-requisite for any Device joining the Our Network and must be kept current and up-to-date;
• We have the authority to remove from Our Network any device for which no owner can be identified;
• We have the authority to remove from Our Network any device which is interfering with Our Network service or is deemed likely to compromise the security of Our Information Systems. While every effort will be made to contact the owner of the Device in advance, maintining Our network and Information Systems must take precedence.

Availability

Maintaining the availability of Our Information and Information Systems for business processes usage as required.

Software Licensing and Maintenance

• The Development Team and Users must ensure that all software licenses are up-to-date and that maintenance support is available for both the hardware and software associated with their Device;
• Software licencing for standard software is managed centrally via the Development Team. Licensing for non-standard software is the Users responsibility;
• Illegal and unlicensed software must not be installed on any Device owned by Us.

Disaster Recovery and Backup Strategy

• It is the responsibility of the User and the Development Team to ensure that an adequate business continuity plan is in place in the event that their Information Systems is affected by the non-availability of the relevant servers, network or other elements of the IT infrastructure;
• The Development Team and Users must ensure the prevention of Data loss through Data back-ups;
• The Development Team maintain Disaster Recovery plans for all of Our centrally managed Information Systems;
• Disaster Recovery plans and processes are tested regularly;
• Recovery from backup is tested regularly.

Incident Management

Formal incident management procedures are in place for IT related security incidents and procedures relating to personal Data breaches. Please see IT Policy Framework for further details.

Security Operations

The Development Team manage multiple security tools with the aim of protecting Our Information systems against unauthorised access, intrusion and disruption.  Processes are in place to support these tools and ensure proactive management of IT vulnerabilities and reported incidents.

Physical computer storage Environmental provisions

Any servers hosting production services must be housed in a suitable environment with regard to security, electrical power and air cooling.

• All hardware used for the storage of Our Data is to be purged of all Data and securely destroyed once it is no longer to be used;
• When tapes and other secondary storage Devices reach the end of their useful life they are to be purged of all data and securely destroyed.