What are the System Operating Procedures for PoliceBox?

We require a copy of the System Operating Procedures (SyOps) for PoliceBox. What are they?

How to use this Article?

This is a generic SyOps for PoliceBox, which will be formalised in terms of roles and responsibilities on a per-Customer basis, during the PoliceBox 'on-boarding' process.

Applicability

  1. This SyOps is intended for:
    1. Personnel of the Police Force in their management and use of the PoliceBox platform.
    2. Personnel of PoliceBox (the trading name of Coeus Software Ltd), in the provision of the PoliceBox platform and associated service management to a Police Force.
    3. Any personnel sub-contracted to or involved in the supply chain for either party where they may be connected to the management or delivery of the PoliceBox platform.

Introduction

  1. Set out are a baseline Security Operating Procedures (SyOps) for the PoliceBox frontline digital mobility platform (PoliceBox platform).
  2. All personnel are to read, understand and comply with these SyOps without departure from or amendment to them.
  3. Where a change to the SyOps is required, it may be raised with the PoliceBox Service Desk (servicedesk@policebox.com) for assessment and eventual inclusion.
  4. Disciplinary action must be taken against any personnel who breach or ignore these procedures.
  5. Any incident that has, or is likely to, compromise the integrity or security of (any part of) the PoliceBox platform, is to be reported immediately, using the appropriate reporting channels relating to the personnel who suspects or detects an incident.
    1. Any such incident happening in the Police Force may be immediately reported to PoliceBox Service Desk (servicedesk@policebox.com) for the attention of the Operations Manager.
    2. Any such incident happening at PoliceBox shall be immediately reported to the Police Force using the agreed communication mechanism.
  6. The term “Police Force” is equally applicable whether the Customer is:
    1. an individual Police Force, or,
    2. a group of Police Forces working together in collaboration.
  7. The term “PoliceBox” in this context relates to:
    1. The fact that PoliceBox is a trading name of Coeus Software Ltd
    2. All employees, sub-contractors, or suppliers of PoliceBox.
    3. Where those persons are involved in the development or delivery of the PoliceBox platform.

Scope

  1. The PoliceBox platform can be tailored to meet the digital transformation needs of any Police Force. The Platform can be used to deliver operational benefits to front line policing, streamline back-office functions, and deliver on multi-agency working strategies.
  2. PoliceBox is designed to meet the requirements of data (Police Information) classified to OFFICIAL under HM Government Security Classification Scheme (GSC).
    1. In certain conditions, this can also include the use of data which may be considered as OFFICIAL – Sensitive.
    2. These SyOps must not be applied to, or used with, any instance of the PoliceBox platform that has been deployed for use with higher classifications of Information such as Secret.
  3. PoliceBox acts as a secure ‘conduit’ for Police Information, which enables authorised Users of the Police Force to drive a native installable Client App to:
    1. Research data held on Police (back-end) systems, useful to reduce demand on control rooms and time spent for stop-checks,
    2. Aggregate that data into other (Information collection) Tasks, which help drive data quality and reduce re-keying of Information, and,
    3. Deliver new or updated Police Information to relevant back-end systems.
    4. Access and view situational awareness Information, including locations of incidents and resources, and other Information as agreed with the force.
  4. Where the PoliceBox platform has been configured by the Police Force, sub-sets of Information might be further delivered to partner agencies with the help of PoliceBox.
  5. The Police Force will use the App Designer to:
    1. Create or manage business processes so that business change can become more agile.   The App Designer enables unlimited processes and unlimited changes to those processes.
    2. Ensure users only access Information or business processes based upon their AAD user group membership (Access Control).
  6. The Police Force can instruct a third party to provide professional services assistance with the creation and management of business processes in the App Designer as an alternative to using its own Staff.
    1. The Police Force will remain responsible for testing those business processes, to ensure that Police Information is handled correctly.
  7. PoliceBox is hosted in the Microsoft “Azure” Cloud environment using:
    1. In-country data centres, with Task data that is encrypted in transit and at rest,
    2. Azure resources which derive from blueprints and policies which conform to national requirements.
    3. High availability architecture which presents a set of secured endpoints which are integrated into the Police Force’s Azure Active Directory (AAD).
  8. The secured endpoints are accessible to the native Client App and the Integration Server, from the Police Force’s own secured scope.

Acceptable Use

  1. All users are to comply with the Acceptable Use Policy. In Summary this means;
    1. Users are not allowed to:
      1. Attempt to access areas of the PoliceBox platform that they are not authorised to access;
      2. Attempt to access areas of the PoliceBox platform with either a generic account, or an account that has not been issued to them;
      3. Attempt to decompile or damage any component of the PoliceBox platform, or prevent its use;
      4. Attempt to use PoliceBox on any device which has not been approved for use by the Police Force;
      5. Attempt to use PoliceBox on any device which is not subject to the Police Force security controls, including but not limited to the Mobile Device Management (MDM) platform;
      6. Knowingly provide false Information into the business processes or to generate Information from those business processes on false grounds.
    2. Users must:
      1. Ensure that Information they submit into PoliceBox is compliant with:
        1. Police Force Policy/Guidance
        2. Relevant legislation
      2. Ensure that the configuration of business processes in the App Designer is checked and approved so that only authorised and necessary Information is collected or shared with Police Force back-end systems or passed to its partner agencies.
      3. Ensure that the PoliceBox platform remains secure and available.

Classification

  1. PoliceBox is designed and secured to handle OFFICIAL Information.
  2. On occasion where needed, PoliceBox can support the handling instruction of SENSITIVE.
    1. The platform will rely on its architected design which:
      1. Ensures the security of the Data while at rest and in transit because of the use of encryption of the Information to AES256 in addition to the use of HTTPS TLS 1.2. - preventing risk against disclosure due to unauthorised access or seizure.
      2. The App Designer which allows the Police Force to define discreet and well-defined Tasks, which enables Police Information for research, re-use & further Information collection.
      3. Digital forensic techniques which assure against non-repudiation and provide for tamper detection.
  3. Where Information is to be handled with the SENSITIVE instruction:
    1. It is to be managed on a Task design basis. The Task design property “Protective Marking” must be set with the instruction,
    2. PoliceBox does not permit “downgrading” of Data. Copy & Paste of data from Tasks marked with the instruction into Tasks with a lower handling instruction is not permitted.
    3. When creating Task Designs in the App Designer, users must ensure that Exporting data is made only to appropriate back-end systems in accordance with:
      1. SyOps clauses set out below, which always require caution over how data is Exported to back-end systems.
      2. The specific requirements of the business process being modelled in PoliceBox Task design(s) following business process analysis and proper business justification.
    4. If it is necessary to share data from Task Designs, which carry Information with the handling instruction, beyond the Police Force (i.e. to partner agencies), it is important to ensure that proper measures are put in place to safeguard the Information in those other places.
  4. Information of a higher classification such as SECRET must not be used in PoliceBox. If the Police Force identifies that Information of a higher classification has been used in PoliceBox then it must follow its incident reporting procedures immediately.
  5. Once any Information has been exported beyond the PoliceBox system boundary, it is no longer under the control of the PoliceBox platform or these SyOps.
  6. The Police Force is advised that PoliceBox “Tasks” which carry Police Information are protected at rest, and in transit with AES256 encryption, this means that:
    1. PoliceBox Service Desk staff are unable to view Police Information held in “Tasks”,
  7. In PoliceBox, a “Task” is a generic term used for any form which is received and/or recorded in the Client App by a User.
  8. A Task encapsulates any Information passed through PoliceBox between the User (Client App) and the back-end Police System to which it is sent. The Task also includes digital forensic controls such as non-repudiation and tamper-detection techniques.
  9. The App Designer can be configured to control what Information can be subject to “Copy & Paste” between Tasks. When building business processes in the App Designer, it is important that personnel are cognisant of protective marking and handling issues (such as unwittingly using Information previously marked at a higher classification).

Email

  1. The PoliceBox platform has an automated emailing capability which is processed via the Export service (Integration Server).
  2. The ability to send a completed Task by email, perhaps as a PDF attachment allows the Police Force to:
    1. Send relevant copies (much like carbon paper carbon) of Information to different departments in the Police Force to act as an alert when actions are taken.
    2. Send relevant Information to partner agencies, if appropriate. Perhaps in lieu of existing back-end integration. An example might be a completed Sudden Death form, which must be sent to the local HM Coroner’s office.
  3. Emails when generated are disseminated via the Police Force email server (e.g. Exchange 365)
  4. Emails are only generated where configured and enabled at the business process design level in the App Designer.
    1. When building business processes in the App Designer, Users must remain cognisant of what Information could be held in a completed Task, and the scope of possible recipients.
    2. As more than one connector may be assigned to a business process, the App Designer caters for situations where diverse recipients have separate needs in terms of the Information they expect to receive.

Roles & Responsibilities

  1. The roles and responsibilities for PoliceBox are set out below. Terms set out in bold type are platform defined roles, which can be allocated to Authorised Users via the web portal:
    1. Police Force
      1. AppUsers
        1. Any Authorised User who will access the PoliceBox client app on an authorised and secured mobile device or laptop for operational purposes i.e. Police Officers, Case Workers etc.
        2. Ensure that procedures are followed so that their own account and credentials remain secure.
      2. Designers
        1. Any Authorised User who will access the App Designer to create or manage business processes.
      3. Publishers
        1. Any Authorised User who will access the App Designer to publish (versions of) PoliceBox configuration, containing new or amended business processes.
        2. The “Publishers” role is distinct from “Designers” role so the Police Force may apply supervision/oversight to business process design for the benefit of continual assurance of Information integrity.
        3. It is possible for a Police Force to apply both “Designers” and “Publishers” roles to a given user.
      4. Auditors (e.g. Professional Standards)
        1. Permits review of the Audit Log in the PoliceBox platform. Enables searching and dip-sampling of User activity.
      5. Service Desk (may include an outsourced provider)
        1. Provision of First Line support to Police Force users
          1. Manager
            1. On boarding Authorised Users
            2. Managing User Groups (loose or tight coupling to AAD)
            3. Setting User Properties (fields used in business processes with data specific to the user e.g. Mobile No, Station, Job Title).
            4. Adding Connector registration settings (back-end integration)
          2. TaskManagers
            1. Monitor the Task processing queue. Help identify bottlenecks and re-queue Tasks for export if necessary.
        2. Liaison with PoliceBox Service Desk for Incident & Problem Management, Change Management and initial escalation.
          1. LogViewers – Analysis/Monitoring of system logs
        3. General Maintenance of the Integration Server
          1. Applying operating system and security updates.
          2. Performing troubleshooting and other support tasks associated with “first line fix”.
    1. PoliceBox
      1. Maintaining the Platform (DevOps)
        1. Availability & Business Continuity
        2. Provision of PoliceBox software upgrades
      2. Provision of Service Management (PoliceBox Service Desk)
        1. Second Line support to the Police Force
          1. Use of separate “Admin Portal” to oversee system availability e.g. analysis of system logs[1]
        2. Third Line support
          1. Liaison with third party system component providers
          2. Liaison with DevOps related to platform availability.
            1. A strategy of DevOps is to provide tools to assist with restoring a lost or degraded Service.
          3. Maintenance of the PoliceBox Knowledgebase, including
            1. Training materials & how-to guides
            2. First-line fix guides

    Accounts & Passwords

    1. The use of the PoliceBox platform, by the Police Force shall:
      1. Expect the Police Force to be responsible for maintenance and management of all Authorised Users on-boarded in the PoliceBox platform in accordance with the number of user licenses purchased.
      2. Be integrated with the Police Force’s Azure Active Directory (AAD)
        1. An App Registration is used and will be visible to the Police Force in the relevant AAD blade.
      3. Expect AAD integration to mean that the Police Force will, according to its own Force Security Policy, apply technical controls associated with:
        1. Password Management – including complexity & renewal,
        2. Use of Multi-Factor Authentication and Single Sign-On technology
        3. Brute force password attack prevention (account lockout)
        4. Police Force standard ‘Acceptable usage’ notice displayed at login (web browser surface login).
      4. User accounts may not be generic in nature or shared in any way.
      5. Passwords must not be shared with anyone nor recorded anywhere under any circumstances.
    2. The Provision of the PoliceBox service, (by the PoliceBox team) shall;
      1. Be subject to the Terms and Conditions of the contract of supply of PoliceBox.
      2. Apply technical and environmental controls:
        1. To safeguard any Information Assets under its care (e.g. Project documentation, Service Management Information – such as service tickets and contact details).
        2. In accordance with recognised industry standards e.g. Cyber Essentials, ISO2700x
        3. To include enforcement of Password management and control policies
      3. Operate the PoliceBox Service Desk from a UK location, with its own staff. Staff will be vetted using the National Non-Police Vetting (NPPV3) service, cleared to SC.
      4. Ensure separation of concerns and staff between Development and Operations.
        1. Development personnel will not have access to live environments.
        2. Operations personnel (which includes the PoliceBox Service Desk) will have role-based access to live environments in the following ways:
          1. PoliceBox “admin” portal will provide day to day oversight of platform availability for the PoliceBox Service Desk.
          2. PoliceBox Service Desk staff will not have access to the PoliceBox “web” portal pertaining to an instance of the PoliceBox platform. Staff cannot gain access to Police Information.
          3. In-Depth analysis of faults may be permitted when allocated to a service ticket.
            1. Data Layer work, including DBA activity, will not permit access to customer data, but allow for tuning and maintenance.
            2. Full fault resolution will require mocking and issue replication where data is concerned and may invoke Change Management.
          4. PoliceBox Service Desk may request remote access to the Integration Server to resolve problems affecting the availability of the platform. The Police Force may monitor any remote access activity for its security purposes.
          5. Exception(s) to these restrictions may be permitted, only on a case-by-case basis, and . only when accompanied by approval by the Police Force in full sight of the circumstances of the service ticket.

    Device & Infrastructure Hardening

    1. The Police Force and the PoliceBox team (in providing the service) shallapply controls to harden devices and infrastructure under their respective control, which may include:
      1. The use of a Mobile Device Management (MDM) platform:
        1. To secure the device with encryption
        2. To protect the device against unauthorised access
        3. To assure against data loss
        4. To provide organisational approved apps, including the PoliceBox app.
      2. The use of Police Force’s Group Policies:
        1. To secure the Integration Server, sufficient to permit execution of
          1. Exporter Service (windows service) – which requires NTFS read/write to disk (storage) for exporting.
          2. Real-Time Integration Gateway (RIG) (IIS Web Applications) which cover:
            1. Real-Time Integration Gateway
            2. RMS back-end integration
            3. PNC query integration
          3. Task Polling Service which integrates with Dispatch Systems to send Tasks to PoliceBox users in a near real-time.

    Monitoring & Auditing

    1. As with any Police System, the PoliceBox platform is subject to monitoring and auditing.
    2. Monitoring covers the availability and integrity of the PoliceBox platform. The Police Force are advised to monitor the system logs of their PoliceBox service through their PoliceBox “web” portal.
    3. The Police Force also accept that the PoliceBox Service Desk will monitor the health of PoliceBox by reviewing system logs using the PoliceBox “admin” portal which is accessible by PoliceBox Service Desk staff.
    4. The PoliceBox platform can provide diagnostic Information, for the purposes of system integrity and cyber security, to a Security Information and Event Management (SIEM) system for oversight by the Police Force’s cyber monitoring centre.
    5. Where a legitimate legal/business requirement arises, the Police Force may give the PoliceBox Service Desk permission to access the PoliceBox “web” portal for its PoliceBox platform.
    6. This access may be afforded indirectly through a collaboration tool (e.g. WebEx / Teams) under supervision of an appointed employee of the Police Force, to assist with:
      1. Technical fault resolution,
      2. Collaborative interpretation of System Logs
      3. Other system management issues not documented in the Knowledge base.
    7. Auditing covers the appropriate daily use of the PoliceBox service. The Police Force are advised to monitor the behaviour of PoliceBox Users for compliance with this SyOps and other Force Policies and legislation.
    8. Anyone suspected of breaching the Acceptable Use Policy or detected misusing their access and privileges to PoliceBox, will be liable to investigation by the Police Force which could result in disciplinary or even legal action.

    Data Protection & Subject Access

    1. The Police Force will remain responsible for the actions of its Authorised Users in respect of:
      1. The appropriate configuration of its PoliceBox system via the App Designer
      2. The appropriate and acceptable use of PoliceBox as a frontline digital mobility platform.
    2. The PoliceBox platform ensures compliance with Data Protection such that Police Information is not visible to its PoliceBox Service Desk staff.
      1. Tasks containing Police Information are
        1. Encrypted using AES256.
        2. Processed using “Store & Forward” Only methodology. Tasks held in the PoliceBox platform (cloud data layer) only until such time that the Information has been exported to the back-end system.
      2. It is not possible for the PoliceBox Service Desk carry out Subject Access/Erasure requests on behalf of the Police Force.

    Privacy Policy & Cookies

    1. Please consult the articles which explain the Privacy Policy and Cookies Policy for PoliceBox.