Homeworking for Special Licence and Secure Access data

Okay. So, welcome to this presentation on homework special license and secure access data. I am Anna and I'm a member of the access team. So, if you have put in an application to access our data, it will likely be me or one of my colleagues you have spoken to. I am presenting today with my colleague Dominico. >> Hello, I'm Dominico. I'm also a member of the access team. Uh so you may have spoken to me or one of my uh team members through the your journey as a UKDS user. I hope you enjoy this presentation. Right. Can everybody see the mentter screen? Okay. Hopefully you can. Um obviously if you haven't had a chance to scan, you can scan the code now. I'll just give everyone a minute to do that and then we will start with questions. Right. The first question that we have is what is your research question slash topic? Maybe you're researching health or poverty or something else equally as interesting. Let's give everyone a minute to enter enter their answers. We already have some really great answers here and I can see the topics you're researching. We definitely have a wealth of data sets on the topics that you're looking at. see if anyone else wishes to put an answer. Just give it another minute. Okay, let's move on to the next question. What attracted you to attend this webinar today? Maybe I will just go back to the code. Um if if people haven't had a chance to um scan the code after this question, I will go back and just make sure everyone's had a chance to scan the code. Okay, I can see that we do have an answer um which addresses data policy. Um I I'm not sure how much we will touched on that in this webinar. However, we have a wealth of resources on our website and we also have other training sessions that we run which might be helpful for you also. Right, let me just go back to the first slide to give everyone a chance to scan the code if they haven't already. Just give everyone a couple more minutes. Okay, perfect. Let me carry on. Okay, we have some really good answers here. Obviously, I touched upon the data policy. um the other answers we definitely have information in this this presentation that will help you today. The next question we have is what data are you interested in or already have access to? For example, understanding society or the English housing survey. and understanding society is one of the most popular data sets and data series that we have in our collection. We do have a lot of requests for understanding society. Lovely. We have some really, really good answers here. I'm just going to wait to see if anyone else would like to put an answer. And obviously we do have a wealth of data sets in our collection. Um, and whatever your your research topic is, we hope we'll have a data set that can help you. Okay, lovely. Let's go to the next question and the final question. So this one asks how familiar are you with the UK data services special secure lab and homework procedure. Maybe you know a lot already or you've used special license and sec or secure data previously. Maybe you know a little bit of information and you would like to learn more. Or maybe um you're a newbie, which is perfectly fine, and you're here to learn about how homework works, how you apply, um if your project is eligible, and so on and so forth. Okay, lovely. a good range of answers. Um, obviously this is an introduction to homework and so for um people who would like to learn more hopefully we have a lot of information that will help you today. Uh people who already know or have used secure label special license previously. We hope that there's additional information that can help you with your research projects. And obviously we will have a chance for any questions at the end and you can pop them in the chat and we will do our best to answer. [snorts] I just give it another minute for anyone else who wants to put in an answer. Okay, lovely. I believe that's everyone. Let me see. Yes. Okay. Right. Let me um switch back to the presentation. right? Hopefully you can all see the presentation again. Um and we will carry on. Um on screen you can see the definition of safeguarded data as defined in the license compliance policy that is available on our website. Safeguarded as a level of access is suitable for data that are either uh classifi are neither classified as personal data nor personal information but where there is a potential residual disclosure risk. This data are effectively anonymized. Exceptions may apply. Use of safeguarded data subject to the UK data service end user license agreement abbreviated usually as EUL. This data are made available to register authenticated users and where appropriate additional conditions and agreements are put in place. Safeguarded data is available to all users that have registered for UKDS account. In doing so, they would have agreed to the uh EUL agreement. Um there are two types of safeguarded data. The first is broadly available to be downloaded from our catalog. Uh this type of safeguarded data can always be accessed from home. The other one is specialized safeguarded data which has an application process. Specializes data cannot be used for teaching projects. Secure data is the most restrictive data we hold in our collections. Users wishing to apply to access this data will need to uh be a Ph student or professional researcher. Now save guarded data. Additional conditions of use might be imposed which we have agreed to which you will have to agree with before access to the data set can be granted. For example, it may only be able to be accessed in certain geographical areas. It is the user's responsibility to ensure that all of the terms and conditions of use are respected regardless of whether the data are stored on end point devices for example a PC, a laptop or a thin client or on cloud platforms like Box or Google Drive. The use of shared credentials is strictly prohibited. Each user must have their own individual login credentials, including a unique username and password or passphrase to access the data storage location. For studies restricted to specific geographical locations, data must only be stored in a countries explicitly specified for that study. This condition must be strictly adhered to. When using a cloud platform for storage, the platform must store the data within these specified countries. Where studies are are restricted to spec to specific countries, these will always be defined in the catalog metadata in the access data tab for each study. If in doubt, users should contact the UK data service for more advice. As you can see on the screen, the health survey for England 2022 has an additional condition whereby data storage and access are limited to the UK and countries that the UK have deemed to have an adequate level of data protection. See the screenshot and the circle around the countries. If you are home working, many of you will store the data on a cloud platform. It is important that the cloud platform you use must have servers within these locations. If you are unsure, this is something you can check with your IT team. With regards to the device used to access and store the data for specialized data, this must be an institutional device. Um, with safeguarded data that is not specialized. You can use a personal device, but you must be able to store and destroy the data safely and securely. The data must not be stored anywhere where others can see it either. When working with the data, it is important to ensure that non-compliance do not occur. For example, sharing the data with others not approved for access. We will talk more about this later in the presentation. Special license and secure data sets may also have additional conditions. Now we are going to talk about special license and secure access data and how you check if your project is eligible for homework. If you have access to these types of data sets to find out if your project is eligible for homework, the process is different for each type of data. For special license, there is a list of data sets on our website that can be accessed from home. We will show you this properly soon. But if you navigate to the help section on the UK data service web page, there's a section titled homework. You can click this and then click on the button which reads safeguarded special license working from home FAQs and permitted data collections. Here you will find a list of studies that are available permanently for homework and a list of studies which will be reviewed by the data owner periodically. These data sets can cease to be home working at any time. The process for secure access is slightly different. You will first need to email our secure applications inbox asking if your project is suitable for homework. We will then check each data set on the project to see if it is deemed safe for homework. We will then ask you to fill in one of two online forms depending if your project has ONS data or if your project has data from other data owners. It is important to note that you will only get access for home homework if your device is institutionally managed or and owned. You can never access special license or a secure access data via a personal device. Also, you must be using a secure connection method such as a VPN to access from home. Anonymous uh but contain more detailed information as compared to safeguarded data that's specialized. Uh in many cases, homework is the last step of the application process. Users often already have access to the data then often due to changes in the organization. Uh they need to be able to access it from home. When you come to consider homework, you may also already completed your application and the applications for additional researchers. We may have screenlets and gain approval for the project from the data owner. However, the specializes homework can be applied uh for at any point of the application process or afterwards. a researcher can apply as part of the um process or get an approval for the data and then decide to get homework in if it will be useful for them. >> As part of the application, you will need to complete a form called the special license user agreement. The section at the end, appendix B, is necessary if you want to work from home. We will show you that in a moment. If you already have an active project, we will already have one from you. If you didn't fill in the home working section at the time, we will need an updated user agreement with the appendix filled in from you to send to the data owner. An important point which will become apparent in a moment. If you do not mention all of the data sets on this form which you intend to use for homework, this will be a breach of your user agreement and there might be repercussions as suggested previously. These might include a suspension of your account. We will be asking you to add to your main application form whether you are already approved to access the data or if you applying are applying for homework afterwards. This section would include whether you have a secure connection through a VPN and where the data is stored. To find out if your data sets are viable for homework, we have previously mentioned list for special license data sets on the UK data service website. We will show you that now. Here you can see near the bottom of these categories a section for safeguarded special license. It's permanent working from home data collections. Opening up the list shows a list of surveys which should only include data which is available for homework. A little further down there is a list of individual data sets that are also available for homework. In in addition to this, we also have a list of conditional work from home data collections. Working from home access with this data could be revoked by the data owner at any moment. And you can see the list here of all all of the conditional studies. I will show you the user agreement. Now you will have filled in the top signature on this user agreement at the time and this is all we require to approve your project. However, if we move further down to the bottom of the form, you will find the homework appendix. What it asks from you is this. It asks that you specify the data sets you wish to access from home. It then asks for the cyber security/information security course you took and where you took it. Lastly, it asks you to sign the declaration. So, we can see here it asks for the cyber security training course you took. Um, usually your institution will have a course that is similar. Um, and that's what you would presumably enter down on this form. And then lastly, we have the declaration. Uh we will need your full name and title and we will need you to sign and and date the declaration. What training is appropriate? Both the homeworking application process for special license and secure access requires the user to fill out a section on training. For special license, we will need you to have undertaken a course in information and or cyber security and for you to put down the title and where you took the training uh on the specialized user agreement. If you have undertaken safe researcher training to access a cure lab, unfortunately this does not cover information security awareness and we cannot accept it for special license. We need the application to be filled out with details of an information security course that is usually part of essential training at an institution or organization. If you're unsure whether you have done one of these courses, you can always consult your IT team who will assist you further. This training should be from the last 12 months. Secure lab. What have you already done? Secure data is data classified as personal information or personal data and data that are are particularly sensitive commercially or otherwise. In order to apply and access secure data, an application must be made by the project lead. When applying for secure lab, it is important to note that home working can only be approved after most of the application has been completed. So, it is likely that you already have a full application. You will need approved data access before you can apply to work from home. On that basis, the likelihood is that you have already submitted a secure lab application with a main form and forms for each of your researchers. This will have been administered including you undertaking training, technical checks and gaining data owner approval for access to the data sets on your application. Our technical team will set you up for access from your institution. Once this has been achieved and you have successfully accessed secure lab, you can then apply for homework. In order to apply to work from home with secure data, you will need to email us to ask if your project is eligible for homework. It is important to note that if you don't ask us if the project is eligible, you may be surprised later when we tell you that it's not. We will need to have completed technical checks before we can let you know whether you are eligible to work from home. How do I request home access for secure lab projects? Like special licensed projects, not all secure lab projects are available from home working. Uh we have made an agreement with the data owners for the release of the data and they ultimately make the decision whether you're allowed or not for homework. Importantly, when you apply from homework, this is based on individual access, not for the whole team. It is only for the specific request only. In the first instance to apply from homework access uh you will need to email us at secure.applications at ukataservice.ac.uk and ask if this is an eligible project for homework. We will check and tell you the answer. This information can be found on our website. So, uh I yeah um assuming uh you've been given if assuming the project is eligible for homeworking access, we will send you the necessary web form. You will have to fill that out in its entirety. As said, any people in your project who require homework will need to fill in this form individually. Uh fill it in and tell us you've completed it. We'll pick it up. Our technical checks may be required on your computer and network but not all the time. This is mostly for projects involving data governed by the ONS under DEA legislation. Um let's look at this form. The homeworking form has several different questions about where you intend to work from home with the data and it has several statements that you will need to agree with before you submit the form. We can see the questions and the statements on the slides above. The ONS form is very similar although it includes different information that we need to capture from you to start. This is the nonS version of the form. The first thing you'll notice is a large section at the top which will inform you that while we are going through this process, you do not have a permission to work from home yet. Working from home should only be attempted after we have given written approval. If you attempt to access from home prior to us giving you approval, this will be considered a breach of your user agreement. It also points out that access is restricted to the UK. After this, we have some basic information that we need from you, including the project number. So there we can see we ask for your name, institutional email address, project number, project title, um the address which is not your home address. It's the address um of your institution. It will ask you a little further down the page about what when we have a confirmed that you can have access to the data. You're going to be confirming a lot of things. we have talked about before like your computer being institutionally managed that you are using a VPN that the computer is receiving regular updates and so on. Screen capture or recording software should not be running whilst you are accessing secure lab. And you can see here all all of the points we ask you to agree upon when you um submit the homework application. We have now come to the training. We can see here that the researcher has said that they have taken the mandatory cyber security awareness training and that this has has occurred this year. As with special license, we will need the training to have been undertaken in the past year. And the next condition is that your monitor is not overlooked while you're at home. So your partner and your cats cannot see your screen. You then I confirm that everything's accurate and you understand the consequences of a non compliance. You would confirm at the end and then email us to say the form is with us for this application. There are no technical checks required required afterwards. Okay, we've had a look at the nonS application for now. Let's have a look at the ONS application for um on this version. It is very similar with a few additional details that are brought up because of our agreement with the RS on point 11. It makes it very clear that you can't access outside of the UK. So all of this information is very similar to the NOS I'm working for. You can see here and you can see the point 11 there which says you can't access outside of the UK. On point 12, it asks for an organizationally approved VPN and evidence of that. However, this is not strictly necessary. Our technical team will find this out using the other checks that they conduct. You can see the other other points we ask you to agree to upon applying for homework with ONS data. On point 16, we have the training. Again, you can't use SR T. You have to have a completed an information security awareness course. 17 asks if your wireless network is a secured using a WPA 2 encryption and apologies that is 20. In case you don't know, you'll find this in the properties um for the Wi-Fi if you look at it on the computer or it is often on a sticker on the router. Point 21 asks that any security incidents will be reported back to us. Point 23 makes it clear that your institution must allow you to work from home under the terms of the secure access user agreement. You will also provide some location data at the end of the form and you will see it sends us a little map. So this is the declaration and then you will see the map at the end which um specifies where you are accessing the data from. When you're undertaking a project, your circumstance might change. For example, you may switch offices or institution getting a new IP address whether you're homework or not. If this is the case, we would ask you to inform us. A change in these things might require us to check your connection again and it is very possible you may not be able to access a QA at all. Once you have informed us of the change of circumstance, our technical team will probably ask you for some checks on your network similar to when the project was set up. If your office at your workplace is changed to somewhere nearby, it is less necessary to tell us, but we would still recommend it to make sure that your connection is solid. If you move house, however, you will need to tell us. Also, keep in mind when you add new team members to your project, they will need to go through the same homeworking application process. If you do not tell us that you have changed institutions and you access the data from that location, this is classed as a breach. whether you are homework or not. >> Next, we will go through some dos and don'ts that often come up when we screen homework applications. The most important point is that you can only access the special license and secure access data on an institutional device via a VPN or another secure connection method supplied by your institution. Secure Lab users will see all of their Secure Access projects when they log in to their Secure Lab account at home. You must not access projects that have not been approved for home working at home. Not all of the special license or the secure access data sets in our collection are suitable for homework. When working from home, it is also important to be aware of your surroundings. Access your computer in a private setting. Lock your screen away. Lock your screen when you are away from your computer. Also, if you have a laptop, it is best practice to lock this away when it is is not in use. Secure Lab users should also remember not to save the Citrix login details to the browser. If you have any issues homeworking on your project, please get in touch with us. We can put you in touch with our technical team to help you resolve the issue. It is also important to refer to the research data handling and security guide for users and the secure lab guide for further information. You can also contact us via the help desk form on the UK data service website. >> Non-compliance. When working from home with any data, it is important that the breach does not occur occur. Non-compliance can happen in many ways, but it is your responsibility as a user to prevent them. The end user license agreement and the research data handling and security guys guide has more information on your responsibilities whilst working with the data. It is always important to read through the EUL agreement and the research data handling guides. uh this will outline best practices of how to use, store and analyze different types of data. We find that one of the most common acts of non-compliance is users using the data at home when they have not been approved to do so. Another is saving the data to a shared drive where other people who are not approved on the project can access. for safeguarded special license and secure access data. You're not permitted to share it with anyone who's not approved for access. This includes them accidentally being your screen. It is also important to note that you are not permitted at any time to share anything on the secure lab screen once you have logged in. This include sharing a error message to us. If you have any questions, you'll be you will be able to put them in a word document within secure lab for our support team to teach to check and help you with it. Moreover, the use of AI and online data tools is prohibited. Online data tools are defined as any software application system or platform that operates via the internet or a cloud-based service and is used to process, analyze, manipulate, or generate data and other types of content. Included, but not limited to, tools that employed artificial intelligence technology. This includes generative AI technologies that are designed to perform human life cognitive functions. As you can see from the list on the screen, there are several penalties that can be an outcome of a breach. This varies on a case-to case basis. The majority of non-compliance results in a suspension and or retraining. We are nearing the end of this webinar, but before we go, we have some useful links here to help you with your homework in application. We will email you this PowerPoint after the training session ends. So, you will be able to refer back to these. So, thank you very much for attending the training. We hope it was helpful and useful and and and informative. Um, and we hope to see you soon at any of our other training and we hope you have a lovely day. Thank you very much. >> Thank you.