Access denied? Managing access to the Web within the NHS in England: technology, risk, culture, policy and practice
•Download as PPTX, PDF•
3 likes•589 views
An account of the methods and findings of a research project that investigated web filtering practices with NHS Trusts in England and their impacts upon health professionals' information seeking, with recommendations for LIS practitioners.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Access denied? Managing access to the Web within the NHS in England: technology, risk, culture, policy and practice
Similar to Access denied? Managing access to the Web within the NHS in England: technology, risk, culture, policy and practice (20)
More from Catherine Ebenezer
More from Catherine Ebenezer (7)
Recently uploaded
Recently uploaded (20)
Access denied? Managing access to the Web within the NHS in England: technology, risk, culture, policy and practice
- 1. Access denied? Managing access to the Web within the NHS in England: technology, risk, culture, policy and practice Catherine Ebenezer PhD student, Information School, University of Sheffield Health Libraries Group Conference, Scarborough 16th September 2016 Supervisors: Professor Peter Bath, Professor Stephen Pinfield 1
- 2. “People assume that abusing the Internet is an IT problem … it isn’t an IT problem, it’s a management problem.” Retired NHS IT manager Shouldn’t we be managing the risks more effectively in order to allow learners the freedom to use IT resources to better effect? Prince et al. (2010, p. 437) 2
- 3. Overview • Introduction and background • Web application blocking: earlier findings • Research questions and issues • Methodology and methods • Web use at work – a risk? • Approaches to managing information security • Secure web gateways / web proxies • False positives – the ROC curve • Findings / Discussion • Recommendations • Questions 3
- 4. Introduction and background • LIS Manager in mental health NHS FT 2008-2012 • Variety of technological barriers / hindrances to information seeking, teaching and learning, clinical and management decision-making – ascribed variously to: • Information governance/ information security • IT infrastructure policies and practices • Communications policy • Blocking of ‘legitimate’ websites • Obstacles to use of particular content types and applications • Social media / Web 2.0 a particular problem • Implications? 4
- 5. Web application blocking 77 57 51 69 35 25 11 9 0 10 20 30 40 50 60 70 80 90 Social networking applications Wikis and blogs Communication tools Discussion forums Webmail E-journals* E-books* Online databases 5 % of trusts SHALL IT subgroup survey of NHS librarians (2008)) *’core content’ or locally purchased Impacts
- 6. Research questions / issues • The nature and extent of restrictions on access to the World Wide Web within NHS organisations arising from organisational policies and practices • Their impacts on professional information seeking and sharing, and working practices in general • The attitudes, presuppositions and practices which bear on how web filtering is implemented within NHS trusts, in relation to overall organisational strategies 6 • Web filtering devices and their limitations Differing stakeholder perspectives involved • Attitudes to / assumptions about (information governance, information security) risks • NB distinction between websites and web applications Part of a wider study of access to information for learning and teaching
- 7. Methodology and methods Exploratory case study • Unit(s) of analysis • One or more NHS trusts of different types (DGH + community services, MH + community services, teaching hospital) • Methods • Semi-structured interviews with key informants (10+ per trust) • selected via purposive / snowball sampling • representing a variety of perspectives: • Clinician education and staff development • Library and information • Communications • Information governance • IT management, esp. network security and PC support • Human resources • Workforce development 7
- 8. Methodology and methods Exploratory case study • Methods (cont’d) • Interviews with other key informants: NHS Evidence, medical school e-learning lead, secure web gateway vendor • Gained additional perspectives • Documentary analysis – selective / ad hoc • Background • Policies and strategies: IT, LIS, workforce development, information governance, Internet AUPs • Codes and standards • Reports and reviews • Statements of values • Security device documentation • Thematic analysis using NVivo 8
- 9. Web use at work – a risk? Categories of potential risk to the organisation: • Legal – employers can be legally liable for staff accessing and distributing illegal material • Child pornography and other obscene material or racially inflammatory material, racial or sexual harassment, discrimination, hacking, the defamation of management, customers or competitors, software piracy, copyright infringement, fraud, and breaches of the Data Protection Act • Security - ??? risks from websites and web applications • Web-borne malware – major security threat – but …. • NB not a close correlation between subject matter of web content type of content and malware risk - Provos et al. (2008) • Productivity - ??? • Network bandwidth clogged / performance degraded • Staff wasting time • Positive effects? 9
- 10. Approaches to managing information security (adapted from Fléchais et al., 2006) 10 Category Description Example Technical Prevent Stop attacks from occurring Firewalls, secure web gateways, access control etc. Detect Notice and identify attacks Monitoring of web use – not routinely permitted under UK law React Stop or mitigate an attack Automated response systems linked to intrusion detection systems Deter Discourage misuse Visibility of countermeasures Social Prevent Stop attacks from occurring AUPs; rules on locking screens, rules against p/w sharing, etc. Detect Notice and identify attacks Sysadmins, alert users, auditing React Stop or mitigate an attack Sysadmins or emergency response teams Deter Discourage misuse Prosecution, disciplinary action
- 11. Secure web gateways / web proxies • Sit at perimeter of organisation’s network – enforce acceptable use policies • Commonly in use: Forcepoint (formerly Websense), Smoothwall, Bloxx, Trustwave WebMarshal, Webroot, etc. • Two roles: • Authorisation and authentication / filters ‘inappropriate’ content • Blocks web-borne malware • SWGs are able to categorise URLs and to analyse and manipulate scripts on web pages • Main mechanisms: • Blacklists (may be third-party) • ‘On the fly’ via machine learning / content categorisation – ‘black box’ – commercially confidential 11
- 12. False positives / the ROC curve As sensitivity increases, specificity / accuracy declines 12 Zhang and Janssen, s.d.
- 13. Results • Blocking of websites a problem frequently reported to NICE by librarians • District general hospital (DGH) and mental health services (MH) reported very few instances of website blocking • When a legitimate website blocked, IT department had unblocked it promptly once reported • Pharmacists most affected; instances of website blocking at MH usually related to substance misuse, eating disorders or sexuality • Staff at teaching hospital (TH) experienced greatest number of obstacles to information-seeking caused by blocking of legitimate websites • Reported frequencies of blocking varied from ‘every two months’ to ‘constant’ or ‘daily, probably’ • Affected the work of clinical educators in particular • Most blocked sites not reported to IT department 13
- 14. Results 14
- 15. Results • Much decision-making in relation to information security issues was tacit – IT managers did not explicitly discuss risk • IT security managers reported not having time to evaluate the effectiveness or impact of the SWGs they deployed • Depended on reports from users (via calls logged with trust helpdesk) of false positives • Likely to accept default configurations and categorisations of content offered by suppliers • IT manager at TH appeared aware (via emails sent to him) of the inconvenience caused to users by false positives • Main focus of attention and concern at TH and MH: potential security risks or impact on network traffic presented by ‘recreational’/ non-work use of the web 15
- 16. Results • TH had explicit policy of blocking advertising • Claimed to mitigate potential security threat of ‘malvertising’ (web- borne malware spread via syndicated advertising) • Sometimes seemed to have effect of blocking entire site content • Likely factor in high number of blocked websites • Possible factor: TH SWG’s lack of specificity in identifying and blocking inappropriate or compromised content • Neither librarians nor IT managers aware of national whitelist of sites not to be blocked • No relationship found between IG / IT structures and levels of blocking • But communication between IT and IG in TH very poor 16
- 17. Discussion •“First, do no harm …” Hippocratic oath • IT staff should be at pains to avoid blocking the good when attempting to prevent the bad (Verma et al., 2012) • “Users … don’t pursue innovative ideas because they can’t face any more ‘battles with security’ that they anticipate on the way to realising those ideas” • Users’ experiencing false positives reduces the overall credibility of information security • (Sasse, 2015) 17
- 18. Recommendations • National whitelist: • Efforts needed to engage librarians with reporting / maintenance / updating • Put in place robust local systems for IT departments to be notified of updates • Responses to information security incidents should be proportionate • IT and IG departments should: • encourage the reporting of false positives as applicable • institute processes for responding promptly to unblocking requests • consult more widely with stakeholders in the development and revision of Internet AUPs • publicise / consult on web filtering practices and monitor and evaluate their impacts – part of policy process • establish enhanced levels of access to web content for clinical and clinical support staff groups (e.g. librarians) 18
- 20. References • Blenkinsopp, J. (2008). Bookmarks: web blocking – giving Big Brother a run for his money. He@lth Information on the Internet, (62), 2008. • Fléchais, I., Riegelsberger, J., & Sasse, M. A. (2006). Divide and conquer: the role of trust and assurance in the design of secure socio-technical systems. In Proceedings of the 2005 workshop on new security paradigms (pp. 33–41). ACM. • Prince, N. J., Cass, H. D., & Klaber, R. E. (2010). Accessing e-learning and e-resources. Medical Education, 44 436-437. • Provos, N., Mavrommatis, P., Rajab, M. A., & Monrose, F. (2008). All your iFRAMEs point to us. Mountain View, CA. http://research.google.com/archive/provos-2008a.pdf • Renaud, K., & Goucher, W. (2012). Health service employees and information security policies : an uneasy partnership? Information Management and Computer Security, 20(4), 296–311. • Sasse, M. A. (2015). Scaring and bullying people into security won’t work. IEEE Security and Privacy, (June), 80–83. • Technical Design Authority Group (2008). TDAG survey of access to electronic resources in healthcare libraries. London: TDAG. • Verma, S., Kavita, & Budhiraja, S. (2012). Internet security. International Journal of Computer Applications in Engineering Sciences, II(III), 210–213. • Zhang, W., & Janssen, F. (s.d.). The relationship between PR and ROC curves. Darmstadt: Technische Universität Darmstadt. http://bit.ly/2cpN7LO 20
Editor's Notes
- Managing access to the Web within the NHS in England: technology, risk, culture, policy and practice
- As we start, a couple of thoughts for you about proportionality in the management of risk in relation to use of the web … From one of my respondents And two medical education researchers
- The work reported here formed part of a wider study of technological and organisational barriers to information seeking, use and sharing within the NHS. My presentation focuses on the blocking of websites.
- My library was part of a Medical Education and Development Department As a librarian I was concerned with access to information – as a fundamental professional value Barriers a source of much discussion and complaint – not just by me, but by others – complaints made to the Chief Executive! When investigated informally they were explained or justified to me as relating to a number of different organisational issues or factors Hindrances (discussed in more detail later) included Blocking of websites e-journals, union catalogues such as COPAC, official websites) Unable to download podcasts Unable to use many web applications It seemed that significant barriers were thereby being presented to: Information seeking to support clinical and management decision-making Teaching of students CPD and e-learning Networking with professional peers Clinical practice With possible adverse consequences for quality of care?
- There has been very little previous research on this. The effects of blocking of access to consumer health resources has been studied in the USA The MAIPLE project (Loughborough University) and McMenemy and associates at Strathclyde have studied website blocking in British public libraries Prince, Cass and Klaber (2009), whose work I quoted earlier, studies access to resources for medical education Blenkinsopp’s LIS-MEDICAL post about website blocking, and an article he published in the Health Information on the Internet, led to … … a piece of work you may remember Survey conducted among NHS librarians in England in autumn 2008, published 2009 – Blenkinsopp’s work led to the former Technical Design Authority Group undertaking this Note how discussion forums, wikis, blogs, and SNS are frequently blocked – would include things such as iCSP, RCSLT Discussion Groups etc. I wasn’t able to run the survey again as part of my research, for research governance reasons – it wouldn’t have been practical. I feel strongly, however, that this survey should be re-run, to see how far we have progressed in the last eight years, or not …
- Essentially this is about: What is going on? What effects is it having? Why is it happening?
- Two groups of staff: clinicians with staff development responsibilities, and non-clinicians with relevant perspectives: Clinicians were medical, AHP, nursing, pharmacy Had hoped to recruit a psychologist in MH but failed! Maybe should have interviewed midwives in DGH and TH Stratified sample of respondents
- I conducted other interviews with other key informants. Unable to recruit publishers. Not conducted systematic documentary analysis – was ad hoc / as indicated, mostly AUPs Wasn’t able to get hold of technical documentation for security devices – only promotional material The major themes emerged from the process of coding. Wrote up in a matrix format: major themes vs. interview topics
- I thought I would talk about some of the different types of security risk relating to web use. We cannot live without the World Wide Web, but … access to it does present significant risks. What I am saying here concerns mainly non-work-related web use, but legitimate use can present issues as well … I am trying to convey some of the complexities. Threats can be categorised as legal, security-related and productivity-related You may think: OK to block illegal material, but impossible to block everything potentially illegal, especially where copyright infringement is concerned – cannot stop cut/paste, saving images, etc. Sometimes cited as a reason to block YouTube, as includes pirate versions of TV programmes! In US health care organisations, Web-borne malware attacks now among the most common forms of security incident (Ponemon report, February 2016) Important to note that legitimate websites can be compromised via a variety of mechanisms, including drive-by downloads, malvertising and so-called search engine poisoning / DNS poisoning – DNS information is deliberately corrupted to point to an infected site. Also that there is no behavioural defence these forms of compromise – any site can be compromised – all you have to do is visit the page – and, if it’s a zero-day exploit and your AV doesn’t recognise it and block it, you have malware on your computer … Personal web use at work (PWU) is also referred to in the literature as cyber loafing or cyberslacking Many different types of PWU – some relatively innocent, some nefarious (see under ‘Legal’ on the slide) Many organisations allow sensible PWU during breaks – analogy with use of telephones Most of us have look at the news, silly cat videos, etc. at some stage of our lives … Adverse effects on productivity of PWU are disputed: some research shows positive effects associated with personal web use, such as increased productivity and job satisfaction, improved morale, relief of stress, and improved work-life balance Attempts to regulate PWU may have adverse effects, e.g. reduced organisational trust, lower staff morale
- Just to set web filtering in context: the table on this slide represents the main approaches to managing information security as a whole, much of which is applicable to the management of PWU. Approaches can be categorised as either technical or social, and can be further divided into measures to prevent, detect, react to or deter computer misuse. Note that routine monitoring of individual web use is not allowable under British law – RIPA and its associated code of practice - IT departments can only monitor individual web use at a manager’s request if misuse is suspected. The role of the acceptable use policy – to prevent and discourage misuse – specifies disciplinary sanctions for different forms of misuse The NHS tends to favour technological rather than social measures for managing information security.
- Am going to focus on web filtering in my discussion; there are, however, issues about the security of browsers and plugins with which you may be familiar, e.g. regarding older browser versions, Java, ActiveX controls, Shockwave, Flash – Secunia Research’s 2016 Vulnerability Review found that among the five most popular web browsers (Google Chrome, Mozilla Firefox, Internet Explorer, Opera, and Safari), 1,114 vulnerabilities were discovered in 2015, and the majority were rated highly critical. Unfortunately, as we know, browser security controls enforced via group policies can impinge on access to information. An important type of security device commonly used within the NHS is the secure web gateway (SWG), also known as a web proxy . The popularity of these as security devices has increased in response to the increased incidence of web-borne threats. They sit at the organisation’s perimeter, and all web traffic has to pass through them. (However, the Sophos report of August 2016 on cybersecurity in the NHS suggests that only 38% of respondents indicated that their organisation was using web gateway scanning.) SWGs have two roles: 1) they perform security-related tasks such as authorisation and authentication relating to web content requests sent from a user’s browser, rejecting requests which do not meet the configured criteria; 2) they examine the requested content for malware and other threats before sending it to the user. One can say that their role in 1) is to represent and enforce the AUP … Content categories are established by the system vendor. These categorisations vary considerably. One may legitimately ask, therefore, what values does this categorisation represent? SWGs vary in the accuracy of their filtering … which brings us to …
- Main problem with web filtering devices in general – blocking of legitimate websites = false positives – these are what cause grief to users and librarians, and makes their so controversial. No device is perfect – there is a trade-off between specificity and sensitivity Relationship between specificity and sensitivity may be represented graphically via the ROC – receiver operating characteristic Blue line – useless device Yellow line – excellent device Purple line – decent device A perfect device would have the line right up to the top and against the left hand side!
- The high incidence of blocking of websites at a teaching hospital surprised me immensely – no apparent correlation with research and teaching activity / research ‘culture’ One clinical educator reported taking work home on many evenings a week to avoid website blocking Others looked for information elsewhere: “I just shrug” (Pharmacist, TH)
- My model of factors leading NHS staff to report or not to report blocked websites. Confirms what we know intuitively … The considerations listed relate to: the information itself, relationships with the IT department, and the frequency of blocking Discussions with respondents indicated that, where incidence of blocking was high, blocked sites were often not reported. Reporting occurred where frequency of blocking was low and IT department was perceived to be responsive.
- IT managers didn’t ever look at logs of blocked websites or act on individual instances of blocking reported by SWGs – no time – depended on users reporting them Categories of blocked content listed in TH SWG marketing material reproduced verbatim in TH AUP! IT managers at both MH and TH would have liked to extend overall monitoring of / reporting on non-work related web use – felt it represented a risk to the organisation.
- As well as the malvertising issue, the IT manager at TH seemed to be unclear about the image blocking settings of the TH SWG Users told me that sites carrying advertising and sites with images tended to be blocked. Some sites appear in Google searches twice, at top if advertising, elsewhere if not. Advertising sites could be blocked, but same site not blocked further down. NB some highly informative websites are advertising-supported (e.g. newspapers) Communication and working relationships between IG and IT in DGH and MH seemed to be good - pragmatic, proportionate approach. However, they were virtually non-existent in TH, despite physical proximity of departments, and IG did not have effective reporting lines to senior management. Actually I was surprised that my IG manager in TH hadn’t resigned some time ago!
- Information security researchers do discuss the usability of security … In a health libraries context, Verma et al.’s reference to the Hippocratic oath is noteworthy, as are the ideas of Angela Sasse, a security usability researcher based at UCL Sasse’s comment brings out the extent to which problems with the functioning and usability of information security, of which blocking of websites is a part, acts as a ‘drag factor’ on people’s working lives in knowledge industries, and can potentially affect the organisation in which they work …
- Proportionate – e.g. no blanket bans We need as librarians to go into battle with IT departments on this on behalf of our users – ask about their web security devices and their configurations – and challenge their policies where access to information is being blocked.