HOM/Security Measures

From Future Worlds Center Wiki

SECURITY MEASURES

Access to Hotline Investigations Office

The following measures guarantee maximum security regarding the access to the office spaces in which investigations and reporting is made.

  • The office must be held locked at all times.
  • The Hotline Operator is in charge of keys to the office and keeps records of who has copies of such keys.
  • Only staff authorized by the Hotline Operator can access the office in which reports are processed.
  • Only staff authorized by the Hotline Operator can access the computers, which are used for investigation and processing of reports.
  • Only staff authorized by the Hotline Operator can perform maintenance tasks on any computers used for investigation and processing reports.

Computer

  • Only staff authorized by the Hotline Operator can access computer for report processing
  • All external drivers (CD-ROM, floppy, etc) are disabled
  • Computer enclosure must be locked to prevent access to the computer from others
  • Computer hard drive is encrypted and password protected
  • Computer BIOS is password protected
  • Log in is password protected
  • Computer for report processing has a minimal configuration and only absolutely necessary software installed
  • Network access is limited with a firewall.

Web/Database Server

The database in which reports are stored is located physically on a separate server. The following measures guarantee the safety of this server and its data:

  • The database Server is located within the secure space of the Hotline Operator’s office.
  • Only staff authorized by the Hotline Operator can access server for repairs, hardware upgrades, etc
  • If any other person needs to access the Hotline database server, s/he must be accompanied by the Hotline Operator, or by a person authorized by the Hotline Operator.
  • The Hotline’s database is backed up on a daily basis automatically.
  • The Hotline’s database backups are encrypted and stored at a location different from the Hotline Operator’s office secured by the management of the implementing organization.
  • All sensitive information stored on the Hotline server’s database is encrypted.
  • The server on which the Hotline’s database is hosted has a minimal configuration and only absolutely necessary software installed.
  • The Hotline Database includes the following records: Report ID (created automatically by the software); date and time of the reporting; text inserted by the person making the report in the subject line; type of content reported by the person that filed the report.
  • Every other record (traceroute, whois, etc.) is stored in database in form of encrypted files.
  • Screenshots are not recorded at all; instead a link to those is recorded.
  • Site mirror is provided for case of primary server failure.