Leveraging the spine at Microsoft’s Security Summit

Some of the infrastructure being created to give NHS staff access to new national services can also help trusts open up their data securely – especially if they use other solutions alongside it. Ian Shandling, solution specialist for identity and access at Microsoft UK, explains what’s possible to journalist Stephen Pritchard.

A number of the projects launched as part of the National Programme for IT in the NHS are already changing the way that staff access information electronically.

The first focus of the broadband network, N3, and the NHS data Spine, has been providing access to services at a local level. But they are also opening up new possibilities for local healthcare provision.

Authentication without reinventing the wheel

As part of the Spine project, NHS staff are being issued with authentication credentials to access national programme services, such as the NHS care records service (CRS), the electronic booking service Choose and Book and the new electronic prescription service.

This access is controlled by smart cards containing digital certificates, along with individual PINs. In turn, secure access is supported by data encryption, based on the public key infrastructure (PKI) standard. “With the core technology already tried and tested - not to mention paid for - NHS trusts are able to leverage it to provide secure access to both medical and administrative data.”

One result is that NHS trusts that want to provide secure access to their own local electronic services no longer have to overcome the hurdle of creating a bespoke secure access and authentication system, says Ian Shandling, solution specialist for identity and access at Microsoft UK.

PKI-based encryption projects can be complicated and expensive to implement, with IT managers often showing a healthy scepticism towards them as a result. However, “the work NHS Connecting for Health has done with the PKI Spine card is wonderful,” says Mr Shandling.

“The costs [for a trust] of implementing such a system are not trivial. But the NHS CRS smart card supports multiple digital certificates, so with a single PIN staff can not only access national systems, but also log on to local applications.”

Tried, tested, paid for

With the core technology already tried and tested - not to mention paid for - NHS trusts are able to leverage it to provide secure access to both medical and administrative data; which opens the door to new ways of using that data.

Strong authentication also goes hand in hand with strong identity management: if a member of staff leaves a particular organisation – or the NHS altogether - identity lifecycle management (ILM) ensures their credentials are revoked immediately.

And Mr Shandling says the single sign-on technology provided is proving especially useful in enabling both remote access and mobile access to local health applications.

The Spine provides an important building block for such projects, by removing the need for trusts to develop and deploy their own access management and identity technologies, as well as provide their own strong authentication credentials.

IAG: another piece of the security puzzle simplified

Meanwhile, the deployment of Microsoft’s Intelligent Application Gateway 2007 enables IT departments to allow users to connect to applications, without the need to re-write each piece of software to accommodate new strong authentication and identity management techniques.
“[An IT manager] might want to provide no access at all from a private device, but allow access to a device that is managed and connecting over an SSL VPN. We have already put in place those building blocks for trusts.”

The IAG is now covered by Microsoft’s enterprise agreement with the NHS, which means that all user licensing is paid for by NHS CFH. And it is now in use in a growing number of trusts.

The IAG works hand in hand with Spine credentials, says Mr Shandling, to enable safe and confidential remote access. “The IAGs lets you abstract access requests from the device the request is coming from,” he says.

“This is already being used in hospitals with fixed PCs that users can walk up to: it lets users log on to web services enabled through the NHS CRS smart card. One of the problems in hospitals is being able to move quickly from place to place, and this enables staff to use the nearest available terminal.

“You also have lots of people taking notes, whether on a PC or on a more mobile device. These could be used outside the hospital, and the IAG allows IT departments to extend appropriate access to individual applications.”

The first step in extending access to health applications is usually to bring on board trust-owned remote devices, for example those in off-site locations like clinics. But access from GPs’ surgeries or pharmacies is also possible.

Using the IAG, trusts can also set policies to determine which applications users can view from off-site or from non-trust own devices.

And coming soon: Spine authentication for mobile devices

Furthermore, although full Spine access usually requires a PC, Mr Shandling points out that mobile devices are rapidly becoming more powerful and more secure. Although mobile devices cannot usually read smart cards, they can carry digital certificates and can be encrypted.

Software like Microsoft’s Mobile Device Management (MDM) suite allows IT staff to turn off features such as cameras on PDAs and smartphones, as well as lock or wipe a device if it is lost or stolen.

The key point is flexibility. MDM, for example, lets IT managers set 130 group policies, giving fine levels of control over security on each individual device. This makes it much easier to include remote, and eventually mobile, devices into a policy for opening up access to health care applications.

“A local trust or hospital might want to allow local access based on a smart card, or based on a user name and password if requests are coming from managed devices,” Mr Shandling points out. “It is up to the IT manager to determine that policy.

“He or she might allow no access at all from a private device, but allow access to a device that is managed, and connecting over an SSL VPN. We have already put in place those building blocks for trusts.”

Ian Shandling will be presenting on the topic of “Leveraging the Spine – locally – how to get the best of both worlds” at Microsoft’s Security Summit on 23 September 2008. Find out more about the event.