HOM/Security Measures

Access to Hotline Investigations Office

The following measures guarantee maximum security regarding the access to the office spaces in which investigations and reporting is made.

• The office must be held locked at all times.
• The Hotline Operator is in charge of keys to the office and keeps records of who has copies of such keys.
• Only staff authorized by the Hotline Operator can access the office in which reports are processed.
• Only staff authorized by the Hotline Operator can access the computers, which are used for investigation and processing of reports.
• Only staff authorized by the Hotline Operator can perform maintenance tasks on any computers used for investigation and processing reports.

Computer

• Only staff authorized by the Hotline Operator can access computer for report processing
• All external drivers (CD-ROM, floppy, etc) are disabled
• Computer enclosure must be locked to prevent access to the computer from others
• Computer hard drive is encrypted and password protected
• Computer BIOS is password protected
• Log in is password protected
• Computer for report processing has a minimal configuration and only absolutely necessary software installed
• Network access is limited with a firewall.

Web/Database Server

The database in which reports are stored is located physically on a separate server. The following measures guarantee the safety of this server and its data:

• The database Server is located within the secure space of the Hotline Operator’s office.
• Only staff authorized by the Hotline Operator can access server for repairs, hardware upgrades, etc
• If any other person needs to access the Hotline database server, s/he must be accompanied by the Hotline Operator, or by a person authorized by the Hotline Operator.
• The Hotline’s database is backed up on a daily basis automatically.
• The Hotline’s database backups are encrypted and stored at a location different from the Hotline Operator’s office secured by the management of the implementing organization.
• All sensitive information stored on the Hotline server’s database is encrypted.
• The server on which the Hotline’s database is hosted has a minimal configuration and only absolutely necessary software installed.
• The Hotline Database includes the following records: Report ID (created automatically by the software); date and time of the reporting; text inserted by the person making the report in the subject line; type of content reported by the person that filed the report.
• Every other record (traceroute, whois, etc.) is stored in database in form of encrypted files.
• Screenshots are not recorded at all; instead a link to those is recorded.
• Site mirror is provided for case of primary server failure.