Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have our payroll software to be installed on our file server. This contains all the details of current and past employees. The data contained in the payroll software includes tax, bank, National Insurance number, address, DOB, start and end date, etc.

We are in the UK and we want to protect ourselves legally and moral obligation. We want to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Technical details of the software:

  • The databases are located on a Windows 2008 SBS server and the client application is installed on a Windows 7 64bit workstation.
  • The databases are not encrypted and are of an old bespoke system. In order to read the database you will need the development suite.
  • The application requires a password to enter the system.

What are the necessary steps in securing this system? How can we establish a list of precise requirements (access controls, permissions, auditing, …)? What laws, standards and best practices apply?


Further information from your questions

A breakdown of the security :

  • The server is locked in the secure server room preventing unauthorised accessed.
  • The database files are not encrypted but will be protected by access control list.
  • The fields in the database are not Encrypted
  • Transmission across the network is not encrypted
  • No private Vlans on the network and no hardware that supports it at present. We will be upgrading shortly
  • App developed in the 90’s so I’m guessing no encryption over transmission and probably not securely developed by todays standards.

I want to know if ACL is acceptable taking into account the server is physically locked away, the database/files are not encrypted and all machines are on the same LAN?

Here’s some more information ive collated from the UK:

Action taken against data protection and privacy and electronic comunications: http://www.ico.gov.uk/what_we_cover/taking_action/dp_pecr.aspx Lots of courts proceedings against companies and government departments

Data protection principles: ico.gov.uk/for_organisations/data_protection/the_guide/the_principles.aspx Lots of courts Quote from webpage "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

What security measures should I take to protect the personal data I hold?: ico.gov.uk/for_organisations/data_protection/security_measures.aspx Quotes "Only allow your staff access to the information they need to do their job and don't let them share passwords. Encrypt any personal information held electronically that would cause damage or distress if it were lost or stolen."

share|improve this question
1  
Why are you storing this information in a plain text format? What you are doing is likely very illegal. I suggest removing any information you don't actually need, for instance do you actually need the tax and banking information, it would seem, after the first pay check this could easily be a paper copy placed in a safe. –  Ramhound Jul 13 '12 at 12:56
    
'The databases are not encrypted and are of an old bespoke system' - I've seen some real security horrors on 2 payroll systems neither of which used a proper, standard DBMS - but rather just files on a shared network drive. –  symcbean Jul 16 '12 at 10:54
1  
What are the legal obligations? Consult a lawyer; legal advice from the internet is of negative value. It is also highly localized both by where you are and what you do. –  Mark C. Wallace Jan 14 at 19:43

3 Answers 3

You should take the usual precautions to secure any important server.

1) Properly configure a firewall to have a deny by default policy and only whitelist approved traffic.

2) Proper ACL keeping in mind the principle of the least privileged.

3) Properly authenticating the application that accesses the server - this might mean a good highly random password with enough entropy, authenticating against an AAA server or even certificates depending on the scale of your setup.

3) Encrypt the database - do not count on an old legacy system making it difficult for a malicious attacker to read your database.

4) Log all activities - proper accounting makes it much easier to track unintended changes to the system.

Depending on the type of information you hold, you might need to meet certain compliance schemes. I do not have much idea about this point though, you might want to check with a local audit company for more information.

share|improve this answer
    
I agree with everything above but may also reccomend that you lock down IP's and or MAC addresses and actively monitor/scan the machines on your network to see if anyone is penetrating physically or wirelessly. If you have any WiFi AP's disable WPS and use the higest level of encryption that's supporteds by your hardware. –  Brad Jul 16 '12 at 19:46
1  
There are a vast number of security controls that could and should be implemented here. To try to enumerate them all is pointless and bound to be woefully incomplete. I think the other two answers provide better advice. –  Tracy Reed Jan 14 at 19:06
    
Add patch management. To help the "transmission not encrypted" problem, consider accessing the application only via Terminal Services. Also recommend using an outsourced payroll provider instead. –  Ben Jan 15 at 12:38

You have a very interesting problem.

You need to resolve these issues, as you probably have a time bomb on your hands.

(assuming that you haven't already solved the issues)

You don't sound as if you know enough to support the application yourself into the future, not saying this to be callous, but the combination of old insecure software, few users, custom dbms doesn't sound promising.

Primary recommendation:

Look to your own career, protect your own butt, throw the problem up the chain of command.

The issues are such that you need to clearly state that the issues are NOT resolvable by you without replacing the system. The data is at risk, the application is not being updated for security issues, the controls in place may not be fit for purpose in the current day and age. The mitigations you recommend may not be enough to secure the system/data.

Possible actions to resolve issues:

  1. Separate the client and server from all other traffic and sources of compromise. You may be able to load client and server on a single Virtual Machine Image without network access. This can stop most network compromise, but the host should be secure, isolated as much as possible, single purpose if possible, and physically secured.
  2. Port the HR system to another software package (cloud based might be best, but supported modern, secure is mandatory)

Obviously the cost of these fixes is non-trivial, but it will be legally and morally important for you to do the right thing.

Solution 1 (if the solution is possible) tries to isolate the application while not incurring heavy costs.

share|improve this answer

Lots of good advice offered here, particularly the bit about looking after your own career as this is likely a timebomb. I would also suggest: Hire someone who knows what they are doing. You may be very good at what you do but security and compliance isn't your ballgame. Hire an expert in this area to worry about these things. That person should be able to tell you what security controls are needed in this situation and be responsible for the security of the data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.