Definitions
Portable devices
The following devices are frequently used outside the office environment and require extra information security measures described in detail below:
- laptops
- mobile phones
- tablets
- other portable computers
- memory cards
- USB memory sticks
- portable hard disks
- recordable media such as CDs, DVDs, or BluRay discs
Sensitive data
The following types of data are sensitive (this list is indicative but not exhaustive):
- user passwords
- passwords to access Prater Raines services (see Saved passwords and Private keys)
- source code
- end-user data, for example database backups
- staff records including financial information and personal information such as addresses
- credit card data
Storage of data
Storage on portable devices
Sensitive data must never be stored unencrypted on any portable devices outside a Prater Raines office.
It is recommended to encrypt all data on all equipment using BitLocker or ecryptfs. Removable media used with a Windows device must be encrypted using BitLocker.
It is permitted (but not recommended) to use one of the devices above to temporarily transfer data within a Prater Raines office, but the data must be erased (see Disposal of data) before the device is removed from the building.
Saved passwords
Passwords which allow access to:
- business email
- website admin panels
- the Prater Raines intranet and related status, or project sites, etc
- shell access to development, staging, or production servers
may only be saved for later use in a web browser or terminal (see also Private keys) on any portable device if they are stored in a secure, encrypted fashion. This is in addition to any login password for the operating system. This is recommended (but not required) for fixed devices as well.
This includes using a password manager such as LastPass, Chrome, Edge, or Firefox.
Staff should not use the same password for access to any personal (ie non-work related) service and for a business service. If the same password is used in a personal context, the rules above also apply to the use of that password personally.
If a password might be compromised it must be changed as soon as practicable wherever it is used.
Private keys
Private keys must not be stored without passphrases on any device including fixed devices such as desktop computers (except that they can be stored in memory using a password agent such as pageant or ssh-agent, provided a passphrase is required to load the key into the agent).
In PuTTY this means you must not use a private key file for authentication unless you are prompted for a passphrase when you first use the key. SSH using WSL is preferred over PuTTY for Windows devices.
Physical security
Any unattended office containing sensitive data will be protected by an active burglar alarm and/or CCTV installation.
Sensitive data stored in an unattended office on removable media (for example, backups) will be kept in a locked fireproof safe.
Sensitive data stored in an unattended office on paper or another physical medium will be kept in a locked cabinet and ideally in a fireproof safe.
Wherever possible (ie where the device has an attachment for a Kensington lock) all devices will be locked in place when left unattended. Whenever a logged-in user leaves a computer or portable device a password, passcode or fingerprint should be required to regain access.
Transmission of data
Encryption
Sensitive data must not be sent to anyone unencrypted by:
- FTP
- post, on removable media (see Post)
- the "send file" function of any instant messaging service (see Instant messaging)
- any third party "large file" sending service
See Disposal of data.
Instant messaging
Sensitive data, especially passwords and access details, must not be transmitted in the clear over any instant messaging service.
For internal communications, instant messaging services other than Slack, Teams or MatterMost workspaces provided by the company are prohibited.
Post
If sensitive material must be physically sent to a client, member of staff, or third party, it must be sent using a mechanism which requires a signature on delivery, such as Royal Mail recorded or special delivery or by courier.
Data sent on removable media must be encrypted and the password must be sent under separate cover, or ideally out-of-band (for example by telephone).
The requirement to keep the information secure and dispose of it correctly should be impressed on the recipient where appropriate.
Disposal of data
Hard disks which once contained sensitive data must not be discarded until they have been securely wiped using shred --iterations=25 --zero.
The following items must be shredded using a professional quality cross shredder before disposal:
- recordable media such as CDs, DVDs, and BluRay including rewritable discs which contain or have once contained sensitive data
- paper copies of sensitive data
- company credit and debit cards
- cheque book stubs
Password strength
Passwords used for access to any Prater Raines system or to encrypt data or passwords must not be easily guessable. In particular, passwords must not be:
- the user's name or any part of the user's name
- the user's date or year of birth
- a family name such as the user's mother's maiden name
- the name of the application
- the word "password"
- shorter than 12 characters by default, 14 characters for admin passwords on Window devices, and 8 characters where multi-factor authentication is enabled
- a single dictionary word
or any simple variation on these details (for example the password is reversed, or has numbers substituted for similar looking letters).
Ideally your encrypted password should not be crackable by john in the default configuration.
PINs used for access to Prater Raines systems must not be:
- 0000
- 1234
- the user's date or year of birth
Wherever possible, multi-factor authentication should be used, including biometric methods where possible. Throttling of login attempts and locking of accounts should be enabled wherever possible.
Software updates
Software on devices used to access Prater Raines services or data must be kept up-to-date with vendor patches by their owner. This typically means enabling Windows Update. Only approved software should be installed upon devices that are used for this purpose. Anti-virus software must also be installed wherever available.
Servers, WSL, project dependencies, and frameworks should be updated daily using Apt, Composer, Yarn, or NPM.
All software that is no longer required should be removed or automatically archived. All bundled software should be reviewed when setting up new devices. Devices should be replaced where operating system software reaches end of life and cannot be updated or replaced.
Networks
Sensitive data must not be transmitted unencrypted across WiFi networks unless they are secured using WPA-2 authentication (Neither WEP nor WPA-1 is sufficient. It is trivial to crack a WEP key within 1 minute and a WPA-1 key within 15 using software included with standard Linux distributions.).
In practice this means it is OK for example to read business email on a shared WiFi network because it is accessed over secure IMAP or HTTPS, but not to log in to any service which is not SSL encrypted or to enable filesharing.
It would be inconvenient to prohibit the saving of WiFi passphrases on portable devices. As a consequence if a portable device with a saved WiFi passphrase is lost or stolen, it must be reported immediately. All WiFi passphrases must then be changed as soon as practicable.