Sécurité

Le fait que le DHIS2 soit couramment utilisé pour saisir et analyser des informations sur la santé signifie que les questions de sécurité et de confidentialité des données sont d’une importance capitale. Les données collectées dans le cadre du DHIS2 doivent être accessibles à ceux qui en ont besoin et qui sont habilités à y accéder – tels que les prestataires de soins de santé ou les gestionnaires de programmes au sein d’un système de santé donné – et être protégées contre tout accès non autorisé par d’autres personnes. En plus de s’efforcer de rendre le logiciel lui-même aussi sûr que possible, DHIS2 offre une sélection de fonctions de sécurité et de confidentialité personnalisables, y compris la gestion des utilisateurs, le cryptage, et plus encore. Vous trouverez ci-dessous une brève présentation de certaines fonctions de sécurité et de confidentialité du logiciel DHIS2 et de l’application de capture Android, ainsi qu’un lien vers notre collection de vidéos sur les fonctions de sécurité.

Pour des lignes directrices et des bonnes pratiques sur la mise-en-œvre de systèmes DHIS2 sécurisés, veuillez consulter la documentation DHIS2.

Vous pouvez également rester informé des dernières mises à jour de sécurité de l’équipe de sécurité DHIS2 sur la Communauté de Pratique DHIS2 (CoP) en vous abonnant aux posts étiquetés avec « dhis2-security ».

Security is much more than just software — people are just as important to ensuring a secure DHIS2 implementation. As a starting point for best-practice system implementation and administration, DHIS2 recommends that implementers hire a security manager, establish a security plan, and update your DHIS2 software regularly and responsibly.

Have a dedicated security manager

• Make sure that a senior member of your team is responsible for security
• This person should be up to date with security announcements and be in contact with the DHIS2 security team.
• This person should have oversight of organizational, configuration and technical aspects of the DHIS2 implementation.
• They should be empowered to act, and should ideally be a member of the senior management team.

Have a security plan

• For example, follow ISO27001 methodology. A security plan should include things like:
• Management tools like risk register, inventory, SOPs, incident response etc
• Backup and disaster recovery plans
• Software version management
• User and role management
• Training and messaging

A plan is a living document — keep refining the plan as you go!

Upgrade regularly and responsibly

• Remember we only provide security support for the last 3 major versions. You need to plan / budget for a major version upgrade approximately once per year.
• Patch releases contain critical bug fixes, often related to security, and are relatively low-risk. Monitor patch releases carefully and have a process to apply them quickly.
• Don’t upgrade production before testing thoroughly on a staging or test instance. Involve users in testing.
• Backup before doing any upgrade. Handle backups carefully.

DHIS2 officially supports the latest three major released versions — see the Downloads page. When a vulnerability in the DHIS2 software is discovered and fixed, a security patch release will be published for each supported major version. Versions which have reached End of Support are not guaranteed to receive security patches, so it is critical that older DHIS2 implementations upgrade to a recent, supported major version as soon as possible.

DHIS2 has a dedicated security team focused on maintaining the integrity of the DHIS2 software. If you discover what you believe to be a vulnerability in DHIS2 then we want to hear from you. Please visit our Vulnerability Reporting & Disclosure Policy page for information on how to contact the DHIS2 security team, what you can expect when you contact us, and what we expect from you.

Read the DHIS2 Vulnerability Reporting & Disclosure Policy

The DHIS2 security team participates in responsible disclosure. When vulnerabilities are discovered in released, supported versions of DHIS2, the team makes every effort to evaluate, address, and release fixes in a timely manner. Due to the sensitive nature of many DHIS2 implementations around the world, information relating to these vulnerabilities may be embargoed for some period of time. Eventually, the DHIS2 team endeavors to disclose any known vulnerabilities in older software versions once they have been fixed and sufficient time has passed to allow production DHIS2 implementations to upgrade their software.

See a list of known DHIS2 vulnerabilities