Data and information risks in dental practices

ADA Guidelines and resources contains intellectual property owned by or licensed to the Australian Dental Association Ltd (ADA) and is provided for the professional use of ADA members and authorised users. It must not be reproduced, shared, modified or used commercially without ADA's written permission. Users should check the ADA website for the latest version. This resource is for general information only and does not constitute professional or legal advice. To the extent permitted by law, ADA excludes liability for reliance on this resource. Use is subject to the ADA Terms and Conditions.

Date: 1 July 2018

Threat/risk source	Disruption/impact	Vulnerability	Suggested appropriate solutions and mitigation strategies
Human – unintentional – internal	(insider threats/staff/authorised third parties)
Error/omissions (e.g. deletion of files, failure to check backup)	• Financial loss • Disruption of operational activities • Breach of integrity (inadvertent information modification or destruction)	• Legitimate access to systems • Lack of training	• Staff trained in policy and procedures • Information backup and recovery procedures in place
Inadvertent access by staff	• Violation of legislation or regulation • Breach of confidentiality (potential information disclosure)	• Legitimate access to systems by staff • Lack of formal implemented policy and procedures, particularly password controls	• Access control policy and procedure implemented and monitored • Breach reporting in place • Confidentiality and non-disclosure agreements signed • Agreements with third parties signed • Password protected screen savers in place • Access to system utilities limited
Human – deliberate – internal	(insider threats/staff/authorised third parties)
Leakage or theft of information	• Violation of legislation or regulation • Adverse effect on reputation • Breach of confidentiality (potential information disclosure)	• Legitimate access to systems	• Confidentiality and non-disclosure agreements signed • Agreements with third parties including compliance with practice policies signed • Access rights removed on termination of employment • Information securely deleted when equipment and assets disposed of • Use of external and personal devices such as USBs controlled or prohibited
Fraud	• Financial loss	• Access to systems • No monitoring of access or business functions	• Access control policy and procedure implemented and monitored • Breach reporting in place • Agreements with third parties signed • Access rights removed on termination of employment • Information securely deleted when equipment and assets disposed of
Human – deliberate – external
Malicious hacking and unauthorised access	• Disruption of operational activities • Breach of integrity (potential information disclosure, modification or destruction)	• Inadequate network and internet protection	•Network configured to identify and record unauthorised access attempts and provide alerts on this •Network services configured to deny all incoming traffic not expressly permitted • Remote access methods such as modems secured and use of VPNs • Connection time of users restricted and log-on attempts limited (seek advice from technical service provider) • Private IP addresses used on internal networks and unused services disabled on servers accessible to internet (seek advice from technical service provider) • Good password policy in place • Physical access to critical equipment restricted • Users required to change passwords regularly • All publicly accessible services put on secured demilitarised zone (DMZ) network segments • Use of equipment and information off-site includes education and suitable home-office or tele-working security measures • Access to system utilities limited
Ransomware	• Data Loss • Financial Loss	• Access to systems
Technical – unintentional
Power outage or spikes	• Disruption of operational activities	• Lack of power backup and conditioners • Ageing infrastructure	• UPS and power line conditioners installed • If power supply unreliable alternative power source installed UPS batteries periodically tested • Serviceable infrastructure (electricity and telecommunications) maintained
Technical – deliberate
Malicious code (e.g. virus)	• Disruption of operational activities • Denial or degradation of service • Data loss • Breach of integrity	• Inadequate network and internet protection • Lack of staff training • Not keeping anti-virus updates current • Inadequate spam filtering	• Spam filtering activated • Sender policy framework and DomainKeys identified email • Staff educated on email attachments • All downloaded file segregated from network until scanned and established safe (seek advice from technical support) • Use of unauthorised software prohibited • Use of mobile code blocked (e.g. use web browser security to limit program add-ons (unknown ActiveX) • Use of file transfer/peer-to-peer applications limited unless essential to normal operations (Use of external and personal devices such as USBs controlled or prohibited) • Anti-malware software automatically updated • Precautionary scans of information systems done regularly
Environmental
Fire (including bushfire)	• Disruption of operational activities • Endangerment of personal safety	• Incomplete business continuity and information recovery plans	• Business continuity and information recovery plans completed and tested and alternative site identified • Backup procedures effective and monitored Electrical-based fire fighting equipment available in close proximity to critical equipment • Staff trained in emergency (electrical fire) procedures • Other occupational, health and safety provisions applied