Protect our payroll data from a legal and moral obligation

Question

We have our payroll software to be installed on our file server. This contains all the details of current and past employees. The data contained in the payroll software includes tax, bank, National Insurance number, address, DOB, start and end date, etc.

We are in the UK and we want to protect ourselves legally and moral obligation. We want to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Technical details of the software:

• The databases are located on a Windows 2008 SBS server and the client application is installed on a Windows 7 64bit workstation.
• The databases are not encrypted and are of an old bespoke system. In order to read the database you will need the development suite.
• The application requires a password to enter the system.

What are the necessary steps in securing this system? How can we establish a list of precise requirements (access controls, permissions, auditing, …)? What laws, standards and best practices apply?

---

Further information from your questions

A breakdown of the security :

• The server is locked in the secure server room preventing unauthorised accessed.
• The database files are not encrypted but will be protected by access control list.
• The fields in the database are not Encrypted
• Transmission across the network is not encrypted
• No private Vlans on the network and no hardware that supports it at present. We will be upgrading shortly
• App developed in the 90’s so I’m guessing no encryption over transmission and probably not securely developed by todays standards.

I want to know if ACL is acceptable taking into account the server is physically locked away, the database/files are not encrypted and all machines are on the same LAN?

Here’s some more information ive collated from the UK:

Action taken against data protection and privacy and electronic comunications: http://www.ico.gov.uk/what_we_cover/taking_action/dp_pecr.aspx Lots of courts proceedings against companies and government departments

Data protection principles: ico.gov.uk/for_organisations/data_protection/the_guide/the_principles.aspx Lots of courts Quote from webpage "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

What security measures should I take to protect the personal data I hold?: ico.gov.uk/for_organisations/data_protection/security_measures.aspx Quotes "Only allow your staff access to the information they need to do their job and don't let them share passwords. Encrypt any personal information held electronically that would cause damage or distress if it were lost or stolen."

Answer 1

You should take the usual precautions to secure any important server.

1) Properly configure a firewall to have a deny by default policy and only whitelist approved traffic.

2) Proper ACL keeping in mind the principle of the least privileged.

3) Properly authenticating the application that accesses the server - this might mean a good highly random password with enough entropy, authenticating against an AAA server or even certificates depending on the scale of your setup.

3) Encrypt the database - do not count on an old legacy system making it difficult for a malicious attacker to read your database.

4) Log all activities - proper accounting makes it much easier to track unintended changes to the system.

Depending on the type of information you hold, you might need to meet certain compliance schemes. I do not have much idea about this point though, you might want to check with a local audit company for more information.

Answer 2

You have a very interesting problem.

You need to resolve these issues, as you probably have a time bomb on your hands.

(assuming that you haven't already solved the issues)

You don't sound as if you know enough to support the application yourself into the future, not saying this to be callous, but the combination of old insecure software, few users, custom dbms doesn't sound promising.

Primary recommendation:

Look to your own career, protect your own butt, throw the problem up the chain of command.

The issues are such that you need to clearly state that the issues are NOT resolvable by you without replacing the system. The data is at risk, the application is not being updated for security issues, the controls in place may not be fit for purpose in the current day and age. The mitigations you recommend may not be enough to secure the system/data.

Possible actions to resolve issues:

1. Separate the client and server from all other traffic and sources of compromise. You may be able to load client and server on a single Virtual Machine Image without network access. This can stop most network compromise, but the host should be secure, isolated as much as possible, single purpose if possible, and physically secured.
2. Port the HR system to another software package (cloud based might be best, but supported modern, secure is mandatory)

Obviously the cost of these fixes is non-trivial, but it will be legally and morally important for you to do the right thing.

Solution 1 (if the solution is possible) tries to isolate the application while not incurring heavy costs.

Answer 3

Lots of good advice offered here, particularly the bit about looking after your own career as this is likely a timebomb. I would also suggest: Hire someone who knows what they are doing. You may be very good at what you do but security and compliance isn't your ballgame. Hire an expert in this area to worry about these things. That person should be able to tell you what security controls are needed in this situation and be responsible for the security of the data.