1

The Situation

I'm presently a member of a healthcare records team that is sorely understaffed and has an incredibly low bus factor, with only two people with the majority of system knowledge, myself - allocated temporarily, and a consultant - also allocated temporarily. As a result I'm aware the system must be documented or face clinical risk.

Why it's being documented

There is an incredible amount of system sprawl, complex processes with very little documentation, and I've taken it upon myself to start documenting the internal systems (including IPs, ports and database names, but no usernames, passwords or personally identifiable information) on an internal Wiki which the entire organisation can view (which if kept behind a username/password, might be lost in the event of either or both of us leaving).

The issue

The consultant has reasonably raised that they are not comfortable with the idea of IPs and ports for databases etc being found in a central location accessible by the entire organisation.

Whilst I acknowledge that could be useful information for an attacker, my counter-argument is a simple IP and port scan would reveal the same information (if not more), that no usernames or passwords are included on the Wiki, and if they can get in with an IP/port, then that process wasn't secure to begin with.

My greater concern, on balance of best interests, is to document the system in a transparent manner such the organisation is able to train replacements, which otherwise, if left undocumented, could become an unmaintainable mess and cause all sorts of clinical risks and issues.

The question

Is the approach I'm using for the current situation the correct approach security wise, or is there a better way of handling it?

[It's worth noting this organisation has no coherent usable system of documentation of available skills, knowledge etc with similar situations in other departments, and I'm trying to encourage an organisation-wide adoption of a Wiki to help mitigate this problem.]

SE Does Not Like Dissent
  • 158
  • 5
  • 1
    How do you manage the credentials which are needed to access these systems, i.e. how you make sure that future employees get access to these once you left? Why do you cannot handle the documentation the same way as the credentials, so that the employees which need to manage the system in the future have access to both credentials and documentation? Is there any need to make this documentation fully accessible internally, i.e. who needs to know this apart from the ones who have or will have the credentials? – Steffen Ullrich Apr 30 '19 at 15:09
  • @SteffenUllrich There's absolutely no system, to my knowledge, of handling credentials. There is no prior system, coherent design, or competency to refer to. It would be best to assume this organisation has little working knowledge of any InfoSec practices. I consider myself not very knowledgeable and the general knowledge is less than mine. – SE Does Not Like Dissent Apr 30 '19 at 15:11
  • @SteffenUllrich It's also worth assuming this organisation is very reluctant at changing practices. So you might be inwardly screaming 'that is horribly insecure', and 'get them to change it', but apathy coupled with lack of knowledge coupled with a lack of staff coupled with a lack of skill means little forward momentum. It is, after all, one of the main reasons I'm trying to build a Wiki - to help distil this kind of knowledge. – SE Does Not Like Dissent Apr 30 '19 at 15:18
  • 1
    What needs the best documentation if the credentials to access these documented systems are not known? If would recommend that you focus on the credentials part and bundle the documentation to it. Do you have any supervisor or anybody who feels responsible that the IT is working or at least gets officially blamed if it is not working? – Steffen Ullrich Apr 30 '19 at 15:59
  • @SteffenUllrich Whilst we technically have an IT department, I'm not senior enough (regularly ignored) to get any meaningful response, there is a combination of apathy and a lack of competence. I suppose what I'm looking for are suggestions for ways to secure credentials/documentation that I can both simultaneously propose (which will most likely be ignored) and implement. It's hard to explain the workplace culture, but it boils down to 'either I do it, or no-one else does'. – SE Does Not Like Dissent May 01 '19 at 14:31

0 Answers0