This is the security policy of OpenWrench, which has been created in order to support staff in carrying out our work securely. It is important to understand and comply with the rules described as they aim to protect everyone involved in our work, including clients and partner organizations.
This policy applies to full or part-time staff.
If you have questions about this policy or its recommendations, please contact Vignesh Venkataraman at vignesh@useopenwrench.com
This policy will be reviewed by Vignesh Venkatariaman on an annual basis. Any suggestions or feedback on the policy’s contents should be directed to him.
OpenWrench manages device security in the following way, depending on the situation:
- OpenWrench devices for work-only use: We will provide you with devices, such as a computer, to use solely for work purposes.
To protect devices from unauthorised physical infiltration, all devices which are used for OpenWrench purposes should have an automatic screen lock enabled and may be configured to use fingerprint authentication, and facial recognition authentication.
OpenWrench is responsible for managing data backups which are kept in cloud storage.
To ensure we’re able to recover data during a data loss or compromise incident, we perform backups on an another schedule basis.
OpenWrench requires that devices used for work purposes be backed up as the loss, exposure or corruption of OpenWrench data puts us, and those we work with, at risk. Backups are managed in the following ways:
- Backups are encrypted to help protect against unauthorised access.
- Sometimes backup data becomes corrupted, so to minimise the impact of this we test the backups regularly to detect any issues.
- Multi-factor authentication is required to access the backups.
When communicating sensitive work data, OpenWrench prefers staff use the following tools.
- For 1-1 communications (e.g. direct message to a colleague), please use Slack.
- When communicating with a group (e.g. your project team), please use Slack.
- We use Zoom, Slack for internal video or audio calls, e.g. for remote staff meetings.
- External video and audio calls take place through Zoom.
Passwords are hard to remember, so OpenWrench ask staff to use a password manager.
In particular, we ask you to use LastPass and if you require any help with set up or using this tool then you should discuss it with Vignesh Venkataraman.
Two-factor authentication is a good method of securing our accounts beyond passwords as it requires an additional one-time code to be provided at login, putting an extra barrier between your data and an attacker. Two-factor authentication should be enabled on every account which supports it.
OpenWrench requires staff to use two-factor apps or hardware authentication methods. Please do not use SMS or phone call authentication as they are insecure methods that can be intercepted.
To ensure consistency and help with training and troubleshooting, OpenWrench recommends the Google Authenticator app for two-factor authentication. If this app is not pre-installed then you should install it from your platform’s app store, requesting assistance from Vignesh Venkataraman when needed.
Hardware authentication has a few options for keys and it is up to staff to select and purchase their preferred key if they wish to use one. If you are uncertain of the choices available and their suitability for your work, please contact Vignesh Venkataraman to discuss.
Before travelling on work-related business, staff should prepare ('clean') their everyday devices in such a way as to reduce the impact of any unauthorised access while abroad. Vignesh Venkataraman can provide more information on how to do this.
Before travelling, there are steps which should be taken to prepare devices containing sensitive information. For help with any of the following security measures, please contact Vignesh Venkataraman.
- Deleting unnecessary data from your devices before travelling reduces how much is exposed should the device be accessed without your knowledge. Assess each data group by how essential it is to your trip and whether it can be safely accessed via non-local storage while abroad.
- Full disk encryption is available on most operating systems, and we require staff to ensure it is set up and working prior to travel. For help on how to do this, please contact Vignesh Venkataraman.
Protecting your internet activity from invasive monitoring can involve a range of solutions. OpenWrench advises staff to use a VPN on devices that are connected to the internet. Vignesh Venkataraman can help with set up.
OpenWrench provides a paid subscription to ProtonVPN.
If you are in need of assistance while travelling, please contact either your pre-arranged travel buddy or Matt Velker at matt@useopenwrench.com
You’ll be provided with a lockable cabinet which should be used to store papers and valuable hardware, such as phones, memory sticks and sensitive documents.
The devices you use for work should not be shared with others outside of OpenWrench, as it can put the confidential information they hold at risk of deletion or damage.
When the work day is over, documents and devices should be locked away to deter thieves.
Your web browser can provide a window into your online activities, potentially exposing confidential data. To mitigate this, we recommend implementing the following security hygiene techniques in your browser:
- delete browser history (this can be set up on an automatic schedule)
- enable Do Not Track to hide from trackers
Anti-virus software is required on your computer, in order to deal with any virus-related threats. However, this will not take care of all viruses, and so you should continue to be vigilant against suspicious downloads.
Automatic updates simply ensures that your software is updated quietly in the background, so there is less chance of it being out-of-date and therefore vulnerable to exploits. On occasion, the latest software version may be unstable, in which case you will be informed to prevent the update.