Dear healthcare providers
Safety is paramount for us, so we would like to remind you that Microsoft has completed the support and update of Windows XP and Windows Vista operating systems. Please note the Microsoft Windows 7 operating system, whose support ends on 14 January 2020, Computers with completed operating system support are thus increasingly at risk from viruses and malicious software. At the same time, the updates of their applications for these systems cease to be issued by independent suppliers. For this reason, the continued use of operating systems without supporting the safety risk you should consider if you use it to log in to the National Health Information System (NZIS). Also specialized unit CSIRT. SK does not recommend the use of operating systems without support. Its use means for healthcare providers according to CSIRTs. SK safety and legislative risks. Since April 8, 2014, when Microsoft for the Windows XP operating system and since April 11, 2017 for the Windows Visa operating system has completed its support, this means that updates, security patches and hotfixes are no longer published for these. Use of operating systems without support poses a risk of infecting a workstation with multiple types of harmful software with very negative potential consequences. These include, in particular, leakage, modification or destruction of sensitive information. For healthcare providers this means a direct threat to specific categories of personal data and in the opinion of CSIRT. EN is the processing of such data on such a vulnerable system of infringements -Protect processed personal data against their damage, destruction, loss, alteration, unauthorised access and disclosure, disclosure or disclosure. provided for by Act No 18/2018 Coll. on the protection of personal data and on the amendment of certain laws as amended. The controller to whom each healthcare provider is obliged, taking into account the latest knowledge, the costs of implementing the measures, the nature, extent, context and purpose of the processing of personal data and the risks of varying likelihood and severity for the rights of natural persons, shall take appropriate technical and organisational measures to ensure a level of security appropriate to that risk, and may include, in particular, ensuring the continued confidentiality, integrity, availability and resilience of personal data processing systems in information systems. Security measures, which provides for Decree No 362/2018 Coll. of the National Security Office laying down the content of the security measures, the content and structure of the security documentation and the scope of the general security measures in force, inter alia, It also includes the management of patches and updates.
Just as responsibly as the Ministry of Health of the Slovak Republic and the National Health Information Centre (NCZI) on the problem of using operating systems without the support of the manufacturer are also viewed by bank institutions, which also for security reasons do not support their Internet banking from computers
with the operating system without the support of the manufacturer, indicating that any user who continues to use the operating systems without support is acting on his own responsibility. Similarly, the financial report of the Slovak Republic informs the public that it is not possible to guarantee full support for applications of financial management in this environment due to the cessation of support of selected operating systems by the producer.
NCZI as manager and operator of NZIS therefore does not recommend the use of the operating system without the support of the manufacturer to sign in to NZIS and any healthcare provider that continues to use it shall act on its own responsibility. We recommend an update to a newer version of Windows with the manufacturer's functional support. More information on Microsoft's official website http://windows.microsoft.com/en-en/windows/end-support-help Only regularly updated software supported by the system manufacturer guarantees sufficient security.
It is important to keep in mind the safety standards applied to your computer systems by which you log into NZIS. Within the public administration but also within the private sector, CSIRTs are a specialised service to support the development of general information security. EN formulated the following safety standards and principles to be followed:
CSIRT.SK refers to compliance with the security standards mentioned in Decree No 55/2014 of the Ministry of Finance of the Slovak Republic on standards for public administration information systems in the current version and the National Security Office for the application of security measures provided for by Decree No 362/2018 Coll. of the National Security Office laying down the content of security measures, the content and structure of security documentation and the scope of general security measures in the current version.
In addition to meeting the legislative requirements of CSIRTs. EN recommends the following measures:
Use of antiviral software:
1. Installation:
- Install the antiviral system as soon as the operating system is installed. (If this is not possible, it needs to be installed at the earliest possible time.)
2. Update:
- It is necessary to regularly update the antivirus database of harmful code. (The ideal update interval is less than one day at a computer connected to the Internet and one week at a computer not connected to the Internet.)
3. Resident protection:
- In an antiviral solution it is necessary to allow resident system protection (computer protection during normal operation).
4 . System view:
- The system should be inspected regularly for the presence of harmful code in the form of a view of all files and a boot partition. If possible, this check needs to be set up as automated. The recommended full check frequency is one month.
- Before running or copying a file (s) from unknown media, these files need to be overlooked by the antivirus system. (This option is most often found in the file context menu.)
5. Antiviral solutions (most commonly used):
- Windows Platform
- Linux Platform
Using a firewall:
1. Installation:
- Personal firewall needs to be installed before the computer is connected to the network.
2. Update:
- Personal firewall needs to be updated regularly.
- (Ideal update interval is one day)
3. Settings:
- Everything needs to be banned and only the necessary services allowed.
- If the computer does not serve as a server or to share folders or printers, it is appropriate to prohibit any initiation of a connection from the network.
- In the event that firewall enables learning through interaction with the user, only actions that the user has himself launched and allowed to connect to the Internet should be allowed in this interaction only by trusted applications.
- For individual firewalls it is necessary to read the recommended firewall configuration from the manufacturer or the best practices of a given firewall from a trusted source and set firewall based on these sources.
4. Firewall and personal security solutions (most commonly used):
- Windows Platform
- Linux Platform
System and App Updates:
1. The operating system should be supported by the manufacturer and always in the current version.
2. The operating system needs to be updated regularly. If the system allows it, then automatic operating system updates need to be set up.
3. Installed applications need to be updated regularly.
Use of antispyware solution (protection against harmful non-viral code):
1. Installation:
- Antispyware solution needs to be installed before connection to the Internet.
2. Update:
- Antispyware solution needs to be updated regularly. Ideal every day.
3. System view:
- The system should be inspected regularly for the presence of a harmful code in the form of a viewing of all files. If possible, this check needs to be set up as automated. The recommended full check frequency is one month.
- Before running or copying a file (s) from unknown media, these files need to be viewed by an antispyware system (This option is most often found in the file context menu).
4. Antispyware solutions (most commonly used):
- Windows Platform
Password creation and storage:
- Passwords shall not be stored in electronic or paper form in an unprotected space. Ideally, they should only be kept in the user's memory or in a specialised, dedicated programme equipment.
- Passwords must not be the same for different accounts.
- Passwords need to be created complex enough to prevent attacks by guessing or rude force (small and capital letters, numbers, dialictics, other printable characters). The password length should be at least 12 characters.
- Passwords shall not be associated with the user, have a dictionary meaning or be created by slight modification of previous types.
- Passwords need to be changed regularly.
- The passwords to important accounts need to be changed at least every 2-3 months.
- The passwords to minor accounts need to be changed at least once a year.
- If a password compromise is suspected it is necessary to make a password change immediately and report the event as a security incident to the computer/network administrator.
Installation of programmes:
- Only legal applications obtained only from a trustworthy source need to be installed and used. If there is also a checksum on the manufacturer's website, it is recommended to verify this checksum.
- It is advisable to install extensions to the Internet browser only from trusted sources.
Use of the Internet:
- Never send your passwords or login data anywhere by e-mail, chat, or other means.
In the event that a request has also come from a seemingly credible source, this requirement should be rejected and reported to the appropriate points as a security incident. This is particularly true for important accounts such as Internet Banking, a workstation account or an organization's intranet. - Accessing secure sites through a protocol https the certificate must always be verified.
- Before registering on the site you need to read the terms of use carefully.
- When leaving the site, you always need to unsubscribe from the site.
- It is highly recommended not to distribute chain emails and unverified warnings via email.
- It is highly recommended caution on the sites that announce winnings. There's a good chance there's an attempt at fraud.
- Nowhere on the Internet should a payment card number be entered or any other data contained on this card, except where the user wants to pay it. Also in this case, caution is needed and the use of services only by trusted e-commerce.
- Caution is highly recommended when using unknown antiviral applications. It may be a fake antivirus program to infiltrate your device.
- After you have finished working with your browser, it is appropriate to delete the history and saved temporary files and cookies."
- The web browser recommends using extensions: Adblock, NoScript and Ghostery.
Computer usage:
1. Registration:
- The access password must always be set up on the computer.
- When leaving the computer, it is always necessary to lock or unsubscribe.
- The screen saver needs to be set so that a password is needed to turn it off.
- The password must not be written anywhere near the computer in a visible or less visible place.
2. Encryption:
- All sensitive data on the computer must be stored in encrypted form only.
- A suitable solution is the use of encrypted disk (for example, Truecrypt and Bitlocker software tools) or the encryption of the entire disk (if the internal guidelines allow it).
3. Backup:
- All important data needs to be backed up outside your computer regularly in encrypted form. The recommended backup interval is one month for minor data, a week for important data and every day for very important and critical data.
- Backup data must be checked regularly to see if the backup has gone well.
The recommended interval for checking advances is one month.
CSIRT. EN has developed a number of guidelines to ensure the safety of terminal stations and published them on its web portal
( www.csirt.gov.sk ).