1 London School of Economics & Political Science Information Management and Technology Guidelines Remote Access and Mobile Working Guidelines Jethro Perkins Information Security Manager Summary This document outlines the controls from ISO27002 that relate to the LSE's Information Security Policy and Infrastructure that apply to the LSE, across all departments. Version Release 1.1 Date Library reference dd month yyyy IMT-GD-101
2 Table of contents 1 Introduction Purpose Scope Definitions Responsibilities Guidelines Principles guiding use of remote services and mobile devices Information Assessment Remote and mobile working with Confidential information Remote and mobile working with Restricted information Remote and mobile working with Internal Use information Remote and Mobile working with Public information Device Theft and information Breaches Policy Awareness and Disciplinary Procedures Further Policies, Codes of Practice, Procedures and Guidelines Review and Development... 7 IT Services reference: ISM-PY-001 Page 2 of 7
3 1 Introduction Mobile working and remote access form an increasingly normal and accepted part of working life and study. It can provide benefits to LSE, its employees and students by enhancing communication; supporting flexible working practices; enabling new modes of study, scholarship and research; and facilitating the more efficient and effective use of time. However the proliferation of mobile computing devices and remote access methods, and the increasing threats from malware and hackers, mean that information is increasingly at risk of being stolen, lost, leaked, inappropriately copied, or corrupted. This combination of factors puts LSE, users of LSE systems and stakeholders dependent on LSE systems at risk of breaching ethical, legislative, regulatory and contractual requirements. The Department of Information and Management Technology (IMT) aims to provide the opportunities for secure, safe, accessible and available remote access and mobile working through its systems and policies, through the provision of technical controls on information access and through raising user awareness and encouraging good working practices. These guidelines aim to outline user responsibility with regards to any remote access systems provided by LSE, and when working with LSE information using mobile devices. 1.1 Purpose The primary purposes of these guidelines are to: 1. Ensure all users are aware of their responsibilities when working remotely or on mobile devices, and understand the associated risks. 2. Provide Remote Access and Mobile Working Guidelines in line with LSE s Information Security Policy and Information Classification Standard. 3. Ensure that all users understand their own responsibilities for protecting the confidentiality, integrity and availability of the data that they handle remotely. 4. Protect LSE from liability or damage through the misuse of its IT facilities. 1.2 Scope These guidelines apply to all authorised users and the data/ information held, processed or controlled by or on behalf of LSE. They concern the end use of information used remotely and / or on mobile devices and does not cover the technical security provision of the systems that provide access to information. LSE does not make provision for all its IT systems and services to be made available remotely. Where the need for confidentiality or integrity of data is extremely high, such as when handling data classified as Confidential, remote access will be explicitly denied on request of the data owner, or as contractually demanded. Users should be aware that the availability and speed of remote access is subject to a number of external factors beyond LSE s control, such as the effectiveness of any Internet Service Provider leased line, or any third party supplied router, firewall, or anti-virus software in being able to create and maintain a connection to LSE systems and services. 1.3 Definitions Remote Access: accessing LSE systems from outside of LSE premises with an LSE owned, privately owned or publicly accessible computer, laptop, smart phone or other device. The information accessed and processed continues to reside on LSE systems. Mobile Working - carrying out work (i.e. the creation, storage, processing and transport or transfer of data/ information) as an employee of LSE from outside of LSE premises. IT Services reference: ISM-PY-001 Page 3 of 7
4 2 Responsibilities Members of LSE: All members of LSE, LSE associates, agency staff working for LSE, third parties and collaborators on LSE projects will be users of LSE information, and, may therefore be able to use information remotely or using mobile devices. This carries with it the responsibility to abide by the Information Security Policy, and its principles and any relevant legislation, supporting policies, procedures and guidance. It also carries the responsibility to assess the risk to information and handle it appropriately. Any access to LSE information is also governed by LSE s Conditions of Use of IT Facilities at LSE. Data Owners / Guardians: Data owners and guardians have responsibility for ensuring that appropriate information can be accessed remotely and that, if necessary, additional safeguards to the access of data are requested from Information Management and Technology. Data owners and guardians include: Principal Investigators, Heads of Department, Heads of Research Centres, Line managers Records Managers / School Secretary Responsible for LSE compliance with the Data Protection Act Department of Information Management and Technology, Library IT and STICERD IT Staff: Responsible for ensuring that the provision of LSE s IT infrastructure is consistent with the demands of the Information Security Policy, and current good practice. Information Security Manager: Responsible for these guidelines and subsequent information security policies and will provide specialist advice throughout the School on information security issues. Information Security Advisory Board Responsible for the advising on and recommending information security guidelines, and recommending policies to the Information Technology Committee, assessing information security risks, identifying and implementing controls to risks. IT Services reference: ISM-PY-001 Page 4 of 7
5 3 Guidelines 3.1 Principles guiding use of remote services and mobile devices The following principles underpin all considerations of remote and mobile working, and should be considered by all users prior to accessing data remotely: 1. Confidentiality how will access to your information be restricted to the appropriate people? 2. Integrity how will information be kept in such a way as to ensure its accuracy, and that it is only changed by the appropriate people? 3. Availability how will information be available to all who need to access it? 3.2 Information Assessment The primary considerations for all members of the LSE community when either using remote access services, or working from a mobile device, are: 1. Know what data / information you are using 2. Consider what level of data classification should or does apply to it (for more information please refer to LSE s Information Classification Standard) 3. Understand and act upon any particular contractual, ethical or other requirement attached to the information 4. Consider how the mobile devices and the information you are processing can be managed in accordance with their information classification, or if they can t, how you can explicitly accept and manage the risk. If, after you assess your information, you are not comfortable with the conditions your information is held in, or how it can be accessed remotely, please talk to IMT about any steps that can be taken to improve the situation. 3.3 Remote and mobile working with Confidential information It is important that people accessing Confidential data remotely or on mobile devices clearly assess the risks they are exposing these data and the systems storing them to, and consider appropriate steps to keep these secure. We advise that when using remote or mobile devices to process or access data classed as Confidential under LSE s Information Classification Standard, the following minimum standards are applied: 1. All appropriate system updates have been applied to the device (e.g. Windows updates, ios updates, application updates) 2. Where appropriate to the device, Anti-Virus and anti-spyware tools are installed and regularly updated (LSE offers Sophos for free to all LSE staff and students; free anti-virus tools are available for Windows, Apple Mac and Android devices, but are not currently available for iphones and ipads) 3. Access to the device is controlled by username / password, or in the case of tablets / smartphones, a complex passphrase that meets the requirements of an LSE user account password (see the web page on LSE s password requirements) 4. The screens of any devices should regularly lock after periods of inactivity, requiring password authentication to re-enter them 5. These data are not accessed from, processed on or stored on public machines (e.g. machines in internet cafes or other public spaces) Additionally, if you are processing Confidential data on a mobile device (rather than just accessing it remotely) we recommend the following steps: 1. The hard drive or storage area of the device is encrypted (see LSE s Encryption Guidelines for further information) 2. Any external storage devices are also encrypted (see LSE s Encryption Guidelines for further information) IT Services reference: ISM-PY-001 Page 5 of 7
6 3. If the data are going to be sent to / from the device, they are encrypted before transit (see LSE s Encryption Guidelines for further information) 4. Important data is regularly backed up Please be aware that if you are travelling abroad with a laptop that has an encrypted drive or that contains encrypted data, you may be required by the authorities of that country to decrypt the data or hand over the encryption keys. Additionally, if the encryption software you are using is not a mass market product freely available to the public, you may need to obtain a Cryptography Open General Export Licence (OGEL) before travelling abroad with it. This will not be the case if you are using any of the products included in our Encryption Guidelines. See the UK Government s note on the export of Cryptographic items at https://www.gov.uk/export-of-cryptographic-items and for more information about OGEL rules https://www.gov.uk/dual-use-open-general-export-licences-explained. 3.4 Remote and mobile working with Restricted information Restricted information would not expose LSE to significant censure or reputational damage were it lost, hacked or leaked. It may however, lead to negative publicity and censure. A series of measures are therefore still recommended in order to mitigate the risks: 1. All appropriate system updates have been applied to the device (e.g. Windows updates, ios updates, application updates) 2. Where appropriate to the device, Anti-Virus and anti-spyware tools are installed and regularly updated (LSE offers Sophos for free to all LSE staff and students; free anti-virus tools are available for Windows, Apple Mac and Android devices, but are not currently available for iphones and ipads) 3. Access to the device is controlled by username / password, or in the case of tablets / smartphones, a complex passphrase that meets the requirements of an LSE user account password (see the web page on LSE s password requirements) 4. The screens of any devices should regularly lock after periods of inactivity, requiring password authentication to re-enter them 5. These data are not accessed from, processed on or stored on public machines (e.g. machines in internet cafes or other public spaces) 3.5 Remote and mobile working with Internal Use information 1. All appropriate system updates have been applied to the device (e.g. Windows updates, ios updates, application updates) 2. Where appropriate to the device, Anti-Virus and anti-spyware tools are installed and regularly updated (LSE offers Sophos for free to all LSE staff and students; free anti-virus tools are available for Windows, Apple Mac and Android devices, but are not currently available for iphones and ipads) 3. Access to the device is controlled by username / password, or in the case of tablets / smartphones, a passphrase or PIN 3.6 Remote and Mobile working with Public information There are no restrictions on working with Public information. 3.7 Device Theft and information Breaches Please report the theft of any device holding Confidential or Restricted information, or any loss of or suspected inappropriate access to Confidential or Restricted information, to the Information Security Manager or the Records Manager. 3.8 Policy Awareness and Disciplinary Procedures IT Services reference: ISM-PY-001 Page 6 of 7
7 The loss or breach of confidentiality of personal data is an infringement of the Data Protection Act 1998 and may result in criminal or civil action against LSE. The loss or breach of confidentiality of contractually assured information may result in the loss of business, financial penalties or criminal or civil action against LSE. Therefore it is crucial that all users of the School s information systems adhere to the Information Security Policy and its supporting policies as well as the Information Classification Standard and the Data Protection Policy. Any security breach will be handled in accordance with all relevant School policies, including the Conditions of Use of IT Facilities at the LSE. 3.9 Further Policies, Codes of Practice, Procedures and Guidelines These guidelines sit beneath LSE s overarching Information Security Policy. Other supporting policies have been developed to strengthen and reinforce these guidelines. These, along with associated codes of practice, procedures and guidelines are published together and are available for viewing on LSE s website. All staff, students and any third parties authorised to access LSE s network or computing facilities are required to familiarise themselves with these supporting documents and to adhere to them in the working environment. The below list of current policies is in no way authoritative and new policies will be published on the LSE website as they become available. Associated polices: Conditions of Use of IT Facilities at LSE Policy on the use of mobile telephony equipment Policy on the use of school-funded iphones Conditions of use of the residences network Password Policy Asset Management Policy Data Protection Policy Standards and Guidelines: Information Classification Standard Encryption Guidelines Guidelines on the use of Cloud storage 3.10 Review and Development These guidelines shall be reviewed and updated regularly to ensure that they remain appropriate in the light of any relevant changes to the law, organisational policies or contractual obligations by the Information Security Advisory Board (ISAB) and an auditor external to IT Services as appropriate. Additional regulations may be created to cover specific areas. ISAB comprises representatives from all relevant parts of the organisation. It shall oversee the creation of information security and subsidiary policies. The Information Security Manager will determine the appropriate levels of security measures applied to all new information systems. IT Services reference: ISM-PY-001 Page 7 of 7
Data Protection Act 1998 Guidance on the use of cloud computing Contents Overview... 2 Introduction... 2 What is cloud computing?... 3 Definitions... 3 Deployment models... 4 Service models... 5 Layered
Information Security Policy The purpose of this Policy is to describe the procedures and processes in place to ensure the secure and safe use of the federation s network and its resources and to protect
Cloud Software Services for Schools Supplier self-certification statements with service and support commitments Please insert supplier details below Supplier name Address Isuz Ltd. trading as Schoolcomms
Reducing the Cyber Risk in 10 Critical Areas Information Risk Management Regime Establish a governance framework Enable and support risk management across the organisation. Determine your risk appetite
Security Standard The security and risk management baseline for the lottery sector worldwide Updated by the WLA Security and Risk Management Committee V1.0, November 2006 The WLA Security Standard is the
Poplar Street Primary School ICT Security and Acceptable Use Policy E-Safety policy 2013/14 Working Together Aiming High! 1 Contents 1. Introduction... 3 2. Policy Objectives... 3 3. Application... 3 4.
Delgado Community College Information Technology Security Policy Approved: *November 5, 2010 ) Delgado Community College IT Security Policy Page 2 *November 5, 2010 Table of Contents Title Page 1.0 Introduction
Data Security Policy Member of Staff Responsible ICT Team Author: Sunil Pindoria Dated 03/02/2015 Date of next review 03/02/2016 Page 1 CONTENTS INTRODUCTION... 3 MONITORING... 4 BREACHES... 5 DATA SECURITY...
Cloud Software Services for Schools Supplier self-certification statements with service and support commitments Please insert supplier details below Supplier name Address Contact name Contact email Contact
Marist College Information Security Policy February 2005 INTRODUCTION... 3 PURPOSE OF INFORMATION SECURITY POLICY... 3 INFORMATION SECURITY - DEFINITION... 4 APPLICABILITY... 4 ROLES AND RESPONSIBILITIES...
Tameside Metropolitan Borough Council ICT Security Policy for Schools Adopted by: 1. Introduction 1.1. The purpose of the Policy is to protect the institution s information assets from all threats, whether
The Ministry of Information & Communication Technology MICT Document Reference: ISGSN2012-10-01-Ver 1.0 Published Date: March 2014 1 P a g e Table of Contents Table of Contents... 2 Definitions... 3 1.
School Information Security Policy Created By: Newport Education Service Date Created: 22 December 2009 Version: V1.0 Contents Background... 3 IT Infrastructure... 3 IT Access... 3 Acceptable use policy...
Internet Acceptance Use and Data Security Policy Last Updated: 08/10/2012 Date of Next Review: 08/10/2015 Approved by GB: 10/10/2012 Responsible Committee: Student Welfare and Development Internet Acceptable
School of Anthropology and Museum Ethnography & School of Interdisciplinary Area Studies Information Security Policy Page 1 of 10 Contents 1 Preamble...3 2 Purpose...3 3 Scope...3 4 Roles and responsibilities...3
Version 2.0 This policy maybe updated at anytime (without notice) to ensure changes to the HSE s organisation structure and/or business practices are properly reflected in the policy. Please ensure you
Data protection A practical guide to IT security Ideal for the small business The Data Protection Act states that appropriate technical and organisational measures shall be taken against unauthorised or
ONE TO ONE LAPTOP PROGRAMME POLICY CONTENTS 1 Vision and Rationale... 2 2 Ownership Model... 2 3 End of Lifecycle Process... 2 4 Early Return Policy... 2 5 Appearance / Personalisation... 2 6 Device Specifications...
Information and ICT Security Policy Care Excellence Partnership Updated May 2011 Due for review July 2012 Senior Information Risk Owner (SIRO) P. Tilson I:drive/Policies/Information and ICT Security Status
Data breach notification guide: A guide to handling personal information security breaches August 2014 The Office of the Australian Information Commissioner (OAIC) was established on 1 November 2010 by
INTRODUCTION Legal practices are increasingly using cloud storage and software systems as an alternative to in-house data storage and IT programmes. The cloud has a number of advantages particularly flexibility
ICO lo Data Protection Act Contents Introduction... 1 Overview... 2 What the DPA says... 3 Create an asset disposal strategy... 3 How will devices be disposed of when no longer needed?... 3 Conduct a risk
Standards for Internal Control in New York State Government October 2007 Thomas P. DiNapoli State Comptroller A MESSAGE FROM STATE COMPTROLLER THOMAS P. DINAPOLI My Fellow Public Servants: For over twenty
CYBER SECURITY AND RISK MANAGEMENT An Executive level responsibility Cyberspace poses risks as well as opportunities Cyber security risks are a constantly evolving threat to an organisation s ability to
Consumerization of IT: Risk Mitigation Strategies [Deliverable 2012-12-19] Consumerization of IT: Risk Mitigation Strategies I Acknowledgements This report has been produced by ENISA using input and comments