Skip to main content

NHS Secure Boundary

Our NHS Secure Boundary service is a perimeter security project supporting NHS organisations. Find out how we can help you secure your organisation.

About our secure boundary service 

Our secure boundary service provides a perimeter security solution offering protection against security threats. It’s free for NHS trusts and Commissioning Support Units (CSUs).

This solution is part of a larger programme of work being delivered by NHS Digital’s Data Security Centre (DSC) to ensure the confidentiality, integrity, and availability of patient data, as well as protecting clinical and business systems from emerging threats.

The solution uses next generation firewall (NGFW) and web application firewall (WAF) protection to protect internet traffic from digital and cloud-based threats. 

Benefits

Find out about the benefits of NHS Secure Boundary.

Visibility

An increased visibility of network traffic, so NHS organisations can better manage their own risk. 

It enables us to identify malicious content within encrypted traffic on behalf of the wider NHS.

Intelligence

It provides enriched threat intelligence, enabling us to respond quickly across the NHS during incidents.

Advanced threat protection provides a detailed view of what's happening locally. 

Compliance

It provides capabilities to improve Data Security Protection Toolkit (DSPT) and Cyber Essentials plus (CE+) assessment scores. 

The solution is compliant with CE+, DSPT, National Cyber Security Centre (NCSC) and IT Healthcare (ITHC) regimes and will remain compliant throughout the development of the service.

Value

It's procured at scale to one national standard, enabling improved planning and better value for money for the NHS. 

The solution is free (centrally funded) for NHS organisations. 

How the service is being developed

Find out how the service is being developed by expanding each phase: 

Set up 

This phase ran until December 2019 and consisted of configuring and testing the platform, and the design and build of operational services, processes and procedures.

Onboarding

The onboarding phase will consist of project teams working with NHS organisations and consumer network service providers to deploy the service.

This phase is expected to last for two years.

Run

Accenture will provide tier 2 support into the NHS Customer Service Function with tier 3 support from Palo Alto and Imperva. Managed services will be delivered utilising an IT Service Management (ITMS) Framework with ISO 20000 accredited ITIL v3 processes.

This phase is expected to last for at least five years.

How it works 

NHS Secure Boundary contains two main technology parts, protecting two types of internet traffic:

Graphic showing how the service works

Bi-directional traffic (internal traffic) 

This is traffic from within the NHS perimeter. Internet activity is protected by PaloAlto and Prisma Access technology. 

Inbound traffic (external traffic) 

This is traffic from outside of the NHS perimeter. Data is protected by the Imperva Incapsula web application firewall.

Components

Below are details of the different secure boundary components. You can expand them to find out more:

Palo Alto Prisma Access 

This is a software as a service (SaaS) based, modern next-generation firewall (NGFW) capability in the cloud, which can be used by NHS organisations to increase their digital security.  

It includes: 

  • stateful High Availability (HA) pairs of VM-Series NGFW 
  • the ability to be hosted across availability zones 
  • dedicated firewalls for each tenant 
  • a bandwidth pool apportioned to tenants based on identified bandwidths 
Cortex Data Logging Service 

This collates all logs from the firewalls and management platforms within the solution.  

It includes: 

  • retention of traffic, configuration and systems logs for six months 
  • forwarding of filtered logs to the Data Security Centre Cyber Security Operations Centre (CSOC), enabling us to monitor cyber events across the NHS estate, and provide rapid protection as incidents and risks emerge 
WildFire

WildFire is a sandboxing platform designed to identify zero-day threats.  

It includes:  

  • file sandboxing for analysis of unknown threats 
  • creation of signatures to block malware and block the other behaviours 
  • dissemination of threat signatures to all Wildfire users, so detection by one can protect all  
  • static and dynamic analysis over multiple operating systems and application versions 
Panorama Management Console 

Management of the Prisma platform will be done via the central management console, Panorama.  

It includes: 

  • a common Graphical User Interface (GUI) integrated with NHS Mail Single Sign On (SSO) 
  • a tenant-in-tenant approach to provide global and local control 
  • Amazon Web Services (AWS) hosted Panorama with additional NGFWs and role-based access control 
MineMeld

MindMeld is a platform taking in threat data from sources outside of the secure boundary, allowing that threat data to be used by the firewalls in the solution.  

It includes:  

  • aggregation and correlation of threat intelligence feeds 
  • enforcement of new prevention controls, including IP blacklists 
Imperva Cloud Web Application Firewall (WAF) 

This is a SaaS based WAF solution to protect applications from malicious online attacks.  

It includes: 

  • protection against the most critical web application security risks, such as Structured Query Language (SQL) injection, cross-site scripting, illegal resource access, remote file inclusion 
  • multiple capability offerings to meet current and future requirements whilst being cost effective 

Capabilities 

Here are some of the capabilities offered by the secure boundary service. Expand them to find out more:

Uniform Resource Locator (URL) filtering 

Monitors and controls access to websites and website categories. 

Application ID (APP ID) 

Visibility of active applications. 

Decryption

Selective decryption of traffic for the advanced detection of threats. 

WAF 

Protects publicly hosted web services from a wide range of online threats.

Webinars

We're holding a series of briefings in May 2020 to explain the solution, answer questions and explain how NHS organisations can sign up to the service. We recommend representation from technical, service and project management staff within NHS Trusts and CSUs. 

The dates are: 

  • Monday 27 April 11.00 to 12.00 
  • Monday 4 May 15.00 to 16.00 
  • Monday 11 May 15.00 to 16.00 
  • Monday 18 May 15.00 to 16.00 
  • Tuesday 26 May 15.00 to 16.00 

Email nhssecureboundary@nhs.net to book a place.

Register for the service

To register for the secure boundary service, or if you have any questions, please email nhssecureboundary@nhs.net.

Access our knowledge base

If you've already registered for NHS Secure Boundary, you can access our knowledge base, which contains guidance on the service.

NHS Secure Boundary news

Protective DNS now offered as part of NHS Secure Boundary.

NHS Secure Boundary – the next layer of cyber protection for the NHS.

Last edited: 13 May 2020 5:06 pm