[ISN] NHS mobile data security is pants

[InfoSec News]

http://www.theregister.co.uk/2006/06/28/nhs_mobile_security_survey/

By John Leyden
28th June 2006

Sensitive medical and personal details are in danger of exposure
because of lax data security among health sector workers, according to
a new survey.

The study, sponsored by mobile security firm Pointsec, found that
almost two thirds of health sector workers use inadequate security.  
Half of those in the NHS use their own mobile devices to store data, a
basic breach of security practice.

The Mobile device usage in the health care sector survey carried out
by Pointsec and the British Journal of Healthcare Computing &
Information Management also found found that one-fifth of the devices
used to store data have no security on them at all. A further 40 per
cent have only password-controlled access that would be easy for a
skilled hacker to defeat using a dictionary-style attack.

Only a quarter of respondents used passwords in conjunction with other
security features such as encryption, biometrics, smart card and
two-factor authentication. The 117 participants in the survey included
information managers, IT managers and medical professionals in the
NHS. A quarter of those who took part in the study supplied equipment
to the health care sector.

USB memory sticks or cards (76 per cent) were often used to download
data among health care pros, followed by laptops (69 per cent),
PDA/Blackberry (51 per cent), smartphones (nine per cent) and mobile
phones (two per cent). Almost half (42 per cent) of respondents owned
at least one of the devices they used.

These mobile devices were commonly used to store work contact details
(75 per cent), but nearly two thirds stored corporate data, and one in
five used mobile devices to store security details, such as passwords
and PIN codes. About half of the medical professionals surveyed stored
patient records on mobile devices, a potentially serious risk to
patient confidentiality given that a quarter of respondents have
admitted losing a mobile device.

Pointsec says its survey is evidence that inadequate security
procedures are allowing mobile devices to "fall through the security
net". It advises wider use of mobile encryption technologies, a
business Pointsec itself specialises in. ®