NHS Secure Boundary

This is a software as a service (SaaS) based, modern next-generation firewall (NGFW) capability in the cloud, which can be used by NHS organisations to increase their digital security.  

It includes: 

• stateful High Availability (HA) pairs of VM-Series NGFW 
• the ability to be hosted across availability zones 
• dedicated firewalls for each tenant 
• a bandwidth pool apportioned to tenants based on identified bandwidths 

This collates all logs from the firewalls and management platforms within the solution.  

It includes: 

• retention of traffic, configuration and system logs for 30+ days in Cortex Data Lakes (CDL’s) accessible by an organisation (logs for six months   up to 180 days are accessible via a ticket to the CSF)
• forwarding of filtered logs to the Cyber Operations, Cyber Security Operations Centre (CSOC), enabling us to monitor cyber events across the NHS estate, and provide rapid protection as incidents and risks emerge

Wildfire is a sandboxing platform designed to identify zero-day threats.  

It includes:  

• file sandboxing for analysis of unknown threats 
• creation of signatures to block malware and block the other behaviours 
• dissemination of threat signatures to all Wildfire users, so detection by one can protect all  
• static and dynamic analysis over multiple operating systems and application versions 

Management of the Prisma platform will be done via the central management console, Panorama.  

It includes: 

• a common Graphical User Interface (GUI) integrated with NHS Mail Single Sign On (SSO) 
• a tenant-in-tenant approach to provide global and local control 
• Amazon Web Services (AWS) hosted Panorama with additional NGFWs and role-based access control 

This is a SaaS based WAF solution to protect applications from malicious online attacks.  

It includes: 

• protection against the most critical web application security risks, such as Structured Query Language (SQL) injection, cross-site scripting, illegal resource access, remote file inclusion 
• multiple capability offerings to meet current and future requirements whilst being cost effective 

Monitors and controls access to websites and website categories. 

Visibility of active applications. 

Protects against​ viruses, worms and​ trojans, and​ spyware.

Prevents spyware and malware from 'phoning home'.

Protects against​ potentially harmful​ applications.

Blocks files that are known to carry threats.

Reduces the portion of the​ network exposed to potential​ attack.

Can be created to detect​ and block specific​ traffic.

Protects against attempts to ​exploit flaws or gain​ unauthorised access into​ NHS systems.

Protects publicly hosted web services from a wide range of online threats.

Identification of all users on the network enabling enforcement of user and group-based access rules.

Customised messages and​ instructions to users when​ blocked websites​ or files are accessed.

Highest priority activity is not compromised when the network is busy.

Prevents sensitive information from ever leaving the network.

As we progress through on-boarding, NHS related services using IP allow lists to control access will become known and will be advertised on this support page.

Several services outlined below are thought to use allow list access.

If you are aware of any services that use allow list access but do not appear on this list, email the NHS Secure Boundary team at [email protected] so records can be updated.

A1.b Your organisation has established roles and responsibilities for the security of networks and information systems at all levels, with clear and well-understood channels for communicating and escalating risks.

A2.b You have gained confidence in the effectiveness of the security of your technology, people, and processes relevant to essential functions.

B3.b You have protected the transit of data important to the operation of the essential function. This includes the transfer of data to third parties.

B4.a You design security into the network and information systems that support the operation of essential functions. You minimise their attack surface and ensure that the operation of the essential function should not be impacted by the exploitation of any single vulnerability.

B4.b You securely configure the network and information systems that support the operation of essential functions.

B4.c You manage your organisation's network and information systems that support the operation of essential functions to enable and maintain security.

C1.a The data sources that you include in your monitoring allow for timely identification of security events which might affect the operation of your essential function.

C1.b You hold logging data securely and grant read access only to accounts with business need. No employee should ever need to modify or delete logging data within an agreed retention period, after which it should be deleted.

C1.c Evidence of potential security incidents contained in your monitoring data is reliably identified and triggers alerts.

C2.a You define examples of abnormalities in system behaviour that provide practical ways of detecting malicious activity that is otherwise hard to identify.

C2.b You use an informed understanding of more sophisticated attack methods and of normal system behaviour to monitor proactively for malicious activity.