Food Safety : Backup and Prevention of Corruption of the Food Safety Database Policy

Aims and Objectives

1.1             The aim of this document is to outline the policies and procedures adopted by North Lanarkshire Council to ensure that the database that houses food safety information is protected against the loss or corruption of that information. The objective in operating these policies and procedures is to prevent either a failure to suitably back up the database or the implementation of unauthorised changes to the information held on the database, whether intentional or unintentional.

Review

2.1             This policy document will be kept continuously under review by a senior member of the food safety management team, in conjunction with North Lanarkshire Council's Information Technology Section.

2.2             In creating this food safety policy, cognisance was taken of North Lanarkshire Council's current information security policy (V1.0.2) dated 31st August 2003.

Corrective Actions

3.1             If it is established that the terms of this policy document are not being adhered to in relation to either local desktop, departmental or corporate practises, corrective action will be taken either by a senior Business Regualtion Manager or a relevant officer within North Lanarkshire Council's Information Technology Section to ensure compliance.

Database back up systems

4.1             Food Safety information is retained in a database known as Authority Public Protection (A.P.P.) and is installed on the server PLFLARE01, which is located in Protective Services Divisional Offices, Coatbridge. For fault tolerance, the server has a 2 x 18Gb Raid 1 mirror set-up for the operating systems and 4 x 72Gb hard disks with advanced data guarding for applications and data.

4.2             As an additional measure to ensure back up is effected, every evening the entire database is automatically backed up to the hard drive and then replicated on the mirror. This is an automated process.

4.3             To ensure that a single point failure or event such as a fire in the server room does not effectively disable the food safety database, a remote additional "Silo" back up system has been installed.

4.4             The "Silo" system automatically backs up the PLFLARE01 server onto a tape unit each evening. It consists of a full back up every Monday, followed by incremental back ups for the rest of the week.  Back ups are run on a four weekly cycle. This is carried out at the Civic Centre Building in Motherwell, under the control of the Council's Central Information Technology Section and is an automated process.

Protection against corruption and loss of information

5.1             Protection against corruption and loss of database information is conducted on three different levels: Corporate; Departmental; and Desktop.

Corporate

6.1             North Lanarkshire Council's Information Technology Section implement security practises based on British Standard B.S.7799, Code of Practice for Information Technology Management Systems, which provides guidance on best practice.

6.2             The security implemented at corporate level to prevent unauthorised access to North Lanarkshire Council's Information Technology systems comprises a corporate firewall which protects against hacking when authorised users are on line within the world wide web.  Since the Flare system is in-house, and not published on the web, hacking is not a problem.   However, if it were proposed that the system goes online in the future, a security policy between A.P.P. and the Corporate Information Technology section would be established.

6.3             The servers are kept in a locked room, which are monitored by web cams to mitigate against unauthorised access.

Departmental

7.1             The A.P.P. database is protected by a security password system. A select group of fourteen System Administrators are granted access to the database and these individuals are empowered to add, vacate, or delete premises information held on the database. Ordinary users can add or close premises but are prohibited from deleting premises.

Desktop

8.1             All workstations, accessed by authorised users of the database, on which food safety information is held, operate on a Windows XP system with full password and user name protection.

8.2             All staff have been instructed to implement their own passwords to prevent unauthorised access to the system. These passwords are altered every six weeks by an automated request process that prohibits access unless the user password is changed and has a minimum of eight characters. Users cannot repeat any of their four previous passwords.

Date of this Previous Review: 01/04/2007

Date of this Review:                   07/08/2008