Skip to main content

CQC Using Email to Verify Care Workers

The Care Quality Commission (CQC) has decided to put registration of Care Providers online to make everything faster and easier for the providers. At least that's what they said. In practice, care providers had to fill in the online forms addressing standards that won't be published for another 5 months after the registration deadline. Ignoring all the problems, ridiculous re-branding to avoid inconsistencies and money wasted, there was a serious problem/lack of understanding that has lead to this blog post.

All care providers and managers have to register online individually and have to agree to particular terms in order to be registered and, therefore, trade. I have no problem with this as these care providers are looking after vulnerable people. However, it became obvious that there are serious problems with their system. First off, it isn't possible to change the owner's name if you make a mistake (they can't change it either apparently). Therefore, if you make a mistake, you now have to lie to say that all the details are correct, otherwise you can't register and you'll be out of business - not a good start.

However, this is overshadowed by the fact that the CQC uses only email to verify care managers. First of all they sent a 6-character password to the main business email address with the URL and details of how to log in (no paper verification was done at all). Don't they realise that email is all sent in plaintext and can be read by anyone with a packet sniffer? When logged in, the care provider has to fill in some initial forms as the owner and then list the care managers that they employ. Following this, each care manager is sent a 6-character password via email in order to log in and register their care service. There are a couple of problems with this. Firstly, the email addresses are just entered during the initial form filling exercise and are not checked and secondly, you can't reuse the same email address. So if you are the manager for more than one care service you have to use two different email addresses. The stupid thing is that they accept any email address from an alias to the same mailbox through to hotmail accounts with no checking at all.

They don't seem to realise that half the email addresses people use are just aliases onto other email accounts. On one of my accounts I have 9 email addresses all delivering mail to the same mailbox as they are various options of name and domain all relating to the same company. However, CQC would treat this as 9 different people. There is no checking done to see if that really is the care manager at all. Anyone could sign up as long as they intercept the initial password. Who has access to the standard email address for the organisation? Usually several people and usually not the actual owner of the business - the only person who should receive that email. Due to the way their system works, if someone were to intercept that email (such as a disgruntled ex-employee) they could sign up with a random free email address begin the registration process, not complete it and put the care provider out of business as they won't have registered in the set time.

This is mostly a PR exercise as far as I can see and a bad one. They say that they are checking providers and improving standards. However, it is perfectly possible for the owners and managers to be completely unaware of their registration process because no actual checking is done. In addition, to assume that two email addresses entered into a website are for two different people, and base your authentication on that, shows a lack of understanding of the technology that they are forcing on people.

Edit: 13/7/10
I sent an email to the CQC about this issue and being able to hold people to it legally a while back and a few days ago I received a reply. Here is the main bulk of their reply:

"Thank you for taking the time to write to us and we would acknowledge that the
points you correctly make present some element of risk. To reassure you, and
your customer, we were previously aware of each of those points and have
considered, with our compliance and legal teams, the balance of risk that they
present and any difficulties with legal status that could result, before making
a positive decision to implement in this manner."
"To further reassure you, we commission independent penetration testing of our systems prior to go live to assure their security."
I did ask to see one of their security assessment reports, but was (unsurprisingly) turned down. I understand that they don't want everyone to know how their systems works as that could reveal further problems, but I would like to know what was actually said about this issue and how they justify it.

Comments

Popular Posts

Coventry Building Society Grid Card

Coventry Building Society have recently introduced the Grid Card as a simple form of 2-factor authentication. It replaces memorable words in the login process. Now the idea is that you require something you know (i.e. your password) and something you have (i.e. the Grid Card) to log in - 2 things = 2 factors. For more about authentication see this post . How does it work? Very simply is the answer. During the log in process, you will be asked to enter the digits at 3 co-ordinates. For example: c3, d2 and j5 would mean that you enter 5, 6 and 3 (this is the example Coventry give). Is this better than a secret word? Yes, is the short answer. How many people will choose a memorable word that someone close to them could guess? Remember, that this isn't a password as such, it is expected to be a word and a word that means something to the user. The problem is that users cannot remember lots of passwords, so remembering two would be difficult. Also, having two passwords isn't real

Trusteer or no trust 'ere...

...that is the question. Well, I've had more of a look into Trusteer's Rapport, and it seems that my fears were justified. There are many security professionals out there who are claiming that this is 'snake oil' - marketing hype for something that isn't possible. Trusteer's Rapport gives security 'guaranteed' even if your machine is infected with malware according to their marketing department. Now any security professional worth his salt will tell you that this is rubbish and you should run a mile from claims like this. Anyway, I will try to address a few questions I raised in my last post about this. Firstly, I was correct in my assumption that Rapport requires a list of the servers that you wish to communicate with; it contacts a secure DNS server, which has a list already in it. This is how it switches from a phishing site to the legitimate site silently in the background. I have yet to fully investigate the security of this DNS, however, as most

Web Hosting Security Policy & Guidelines

I have seen so many websites hosted and developed insecurely that I have often thought I should write a guide of sorts for those wanting to commission a new website. Now I have have actually been asked to develop a web hosting security policy and a set of guidelines to give to project managers for dissemination to developers and hosting providers. So, I thought I would share some of my advice here. Before I do, though, I have to answer why we need this policy in the first place? There are many types of attack on websites, but these can be broadly categorised as follows: Denial of Service (DoS), Defacement and Data Breaches/Information Stealing. Data breaches and defacements hurt businesses' reputations and customer confidence as well as having direct financial impacts. But surely any hosting provider or solution developer will have these standards in place, yes? Well, in my experience the answer is no. It is true that they are mostly common sense and most providers will conform