Cyber Security and Open Source Community Call Summary
|
|
|
- Charity Gray
- 9 years ago
- Views:
Transcription
1 Cyber Security and Open Source Community Call Summary April, 2016 Seong K. Mun, PhD Don Hewitt OSEHRA Arlington, Virginia
2 Cybersecurity Workgroup Ad Hoc group to address questions posed by VA OSEHRA Cybersecurity Workgroup - Weekly Call Meetings held to discuss issues Summary in this briefing Will be followed by establishment of a VA Technical Working Group (TWG) on VistA Security Will operate under OSEHRA s VA contract Community participation will be invited 2
3 Key Questions from VA 1. Does the open source community have a focus on cyber security? 2. Are projects to enhance cybersecurity proposed to OSEHRA by the open source community? If so, have any been completed? 3. Are there lessons learned from Red Hat/LINUX WRT cybersecurity that might be applicable to health IT? 4. What is the relationship of OSEHRA certification to cybersecurity? 3
4 (Q1) Focus on Cyber Security OSEHRA has not (yet) Implementer has ultimate responsibility for security Open source code delivered as-is Community focus on tools Some examples of open source projects in greater OS community 4
5 (Q2) Open Source Projects Previous special project for vulnerability remediation M2M Broker Vulnerability Joint effort, closed project group under non-disclosure Precedent and process established No project proposals for explicit security upgrades VA has proposed an open source project for a code scanning tool (similar to HP Fortify) for M code OSEHRA recommends enhancing the existing Xindex tool rather than starting from scratch Most effective approach would be a funded community open source project 5
6 (Q3) Red Hat Reporting Are there lessons learned from Red Hat/LINUX WRT cybersecurity that might be applicable to health IT? 6
7 Securing Open Source Code - Red Hat Open Source Linux Community Open Source Compiled within Red Hat Automated Tamper Proof Build Code Scanned System, People (Supply Chain Management) Hardware Based Crypto Keys Testing and Certification Secure Content Delivery Secure Delivery End User Customer Open Source Projects for Cybersecurity Tools Open Source Cybersecurity Tools OS Community Innovation Productization OS Commercial Product
8 Open Source EHR Community Securing VistA - VA Open Code Review OSEHRA Certification Open Source VA: OI&T Compiled within VA Network VA Testing and Certification Automated Tamper Proof Build Code Scanned System, People (Supply Chain Management) Hardware Based Crypto Keys Secure Content Delivery Secure Deliver y Open Source Projects for Cybersecurity Tools Open Source Cybersecurity Tools OS Community Innovation Productization OS Commercial Product
9 (Q4) Certification What is the relationship of OSEHRA Certification to cyber security? Brief answer: OSEHRA Certification is intended as a prerequisite for, not a replacement of, the in-depth testing required for specific implementations. As such, while specific tools may be run during code review, OSEHRA does not intend to certify the security of code. However 9
10 (Q4) Certification Components 10
11 (Q4) SAC Checking Standards and Conventions Compliance Critical aspect of security Dependent upon quality / breadth of SAC rule base Example: scope checking Susceptible to use of scanning tools Fortify (but not for M code) Xindex (covers M code, but currently limited) 11
12 Current Status The XINDEX tool developed by VA is the only current MUMPS code scanning tool in use. XINDEX is a Mumps routine which parses and analyzes all the routines in VistA install. The analysis includes a variety of useful information, including: Errors and warnings for the code based on MUMPS language and VA SAC (The Department of Veterans Affairs M Programming Standards and Conventions) List of all calls to other routines List of calls within the routine Global and naked global usage in the routine Local variable usage in the routine OSEHRA utilized XINDEX as part of its certification process on VA Gold Disk support project.
13 Challenges MUMPS expertise increasingly scarce Declining even within VA Scattered pockets of expertise in community Code base continually evolving Continuing development and bug fixes Fileman being changed during intake
14 (Q4) Code Review Major advantage of open source More eyes on code is better Security through obscurity is a myth Proper facilitation is key Bugs Possible improvements Possible (or definite) vulnerabilities Documented issues and results 14
15 (Q4) Regression Testing Continuous Unit Testing Emergent best practice Critical part of defense in depth Required for higher OSEHRA certification levels M-Unit available for M code Newest version in OSEHRA repository Certified to OSEHRA Level 4 15
16 (Q4) Summary No overt security certification by OSEHRA Substantial contribution to security of incoming open source code Use of automated scan tools Open code review Requirement for unit tests As tools improve (e.g. Xindex), OSEHRA contribution to security will increase 16
17 Contact: Don Hewitt (571)
BladeLogic Software-as-a- Service (SaaS) Solution. Help reduce operating cost, improve security compliance, strengthen cybersecurity posture
BladeLogic Software-as-a- Service (SaaS) Solution Help reduce operating cost, improve security compliance, strengthen cybersecurity posture February 20, 2014 Contents The Configuration Security Compliance
Department of Veterans Affairs. Open Source Electronic Health Record Services
Department of Veterans Affairs Open Source Electronic Health Record Services MTools Installation and Usage Guide Version 1.0 June 2013 Contract: VA118-12-C-0056 Table of Contents 1. Installation... 3 1.1.
Creating Value through Innovative IT Auditing
Redefine Cybersecurity, Explore Innovative Strategies and Develop Trust Creating Value through Innovative IT Auditing Ronnie Koh Head of IT Audit, DBS Bank How do we create value? By Increasing both Breadth
Frontiers in Cyber Security: Beyond the OS
2013 DHS S&T/DoD ASD (R&E) CYBER SECURITY SBIR WORKSHOP Frontiers in Cyber Security: Beyond the OS Clear Hat Consulting, Inc. Sherri Sparks 7/23/13 Company Profile CHC was founded in 2007 by S. Sparks
Department of Veterans Affairs VA DIRECTIVE 6402
Department of Veterans Affairs VA DIRECTIVE 6402 Washington, DC 20420 Transmittal Sheet August 28, 2013 MODIFICATIONS TO STANDARDIZED NATIONAL SOFTWARE 1. REASON FOR ISSUE. To set forth policies and responsibilities
High Availability of VistA EHR in Cloud. ViSolve Inc. White Paper February 2015. www.visolve.com
High Availability of VistA EHR in Cloud ViSolve Inc. White Paper February 2015 1 Abstract Inspite of the accelerating migration to cloud computing in the Healthcare Industry, high availability and uptime
CONTINUOUS DIAGNOSTICS BEGINS WITH REDSEAL
CONTINUOUS DIAGNOSTICS BEGINS WITH REDSEAL WHAT IS CDM? The continuous stream of high profile cybersecurity breaches demonstrates the need to move beyond purely periodic, compliance-based approaches to
Product Build. ProPath. Office of Information and Technology
Product Build ProPath Office of Information and Technology Table of Contents Product Build Process Maps... 1 Process: Product Build... 3 Product Build and Goals... 4... 4 Goals... 4 Product Build RACI
Cybersecurity in a Mobile IP World
Cybersecurity in a Mobile IP World Alexander Benitez, Senior Scientist, ComSource Introduction by Robert Durbin, Cybersecurity Program Manager, ComSource Introduction ComSource s cybersecurity initiative
IT-CNP, Inc. Capability Statement
Securing America s Infrastructure Security Compliant IT Operations Hosting Cyber Security Information FISMA Cloud Management Hosting Security Compliant IT Logistics Hosting 1 IT-CNP, Inc. is a Government
ivos Technical Requirements V06112014 For Current Clients as of June 2014
ivos Technical Requirements V06112014 For Current Clients as of June 2014 The recommended minimum hardware and software specifications for ivos version 4.2 and higher are described below. Other configurations
2012 CIP Spring Compliance Workshop May 7-11. Testing, Ports & Services and Patch Management
2012 CIP Spring Compliance Workshop May 7-11 Testing, Ports & Services and Patch Management Purpose This presentation provides an overview of the CIP-007-3 R1 Test Procedures which includes a discussion
Open Source Software Project Management A Case Study Red Hat Enterprise Linux. Bob Johnson, Red Hat
Open Source Software Project Management A Case Study Red Hat Enterprise Linux Bob Johnson, Red Hat Goals for this talk Red Hat Enterprise Development Model From the community perspective Red Hat Process
Common Criteria Evaluation Challenges for SELinux. Doc Shankar IBM Linux Technology Center [email protected]
Common Criteria Evaluation Challenges for SELinux Doc Shankar IBM Linux Technology Center [email protected] Agenda Common Criteria Roadmap/Achievements CAPP/LSPP Overview EAL4 Overview Open Sourcing
Linux Technologies QUARTER 1 DESKTOP APPLICATIONS - ESSENTIALS QUARTER 2 NETWORKING AND OPERATING SYSTEMS ESSENTIALS. Module 1 - Office Applications
NETWORK ENGINEERING TRACK Linux Technologies QUARTER 1 DESKTOP APPLICATIONS - ESSENTIALS Module 1 - Office Applications This subject enables users to acquire the necessary knowledge and skills to use Office
What is Really Needed to Secure the Internet of Things?
What is Really Needed to Secure the Internet of Things? By Alan Grau, Icon Labs [email protected] The Internet of Things (IoT) has become a ubiquitous term to describe the tens of billions of devices
RED HAT ENTERPRISE LINUX 6 SECURITY TECHNICAL IMPLEMENTATION GUIDE (STIG) OVERVIEW. Version 1, Release 8. 24 July 2015
RED HAT ENTERPRISE LINUX 6 SECURITY TECHNICAL IMPLEMENTATION GUIDE (STIG) OVERVIEW Version 1, Release 8 24 July 2015 Developed by Red Hat, NSA, and for the DoD Trademark Information Names, products, and
The Operating System Lock Down Solution for Linux
The Operating System Lock Down Solution for Linux The Challenge: Meeting Organizational Security Requirements Linux Operating System Security Operating system (OS) security is a priority for System Administrators
Dell UPS Local Node Manager USER'S GUIDE EXTENSION FOR MICROSOFT VIRTUAL ARCHITECTURES Dellups.com
CHAPTER: Introduction Microsoft virtual architecture: Hyper-V 6.0 Manager Hyper-V Server (R1 & R2) Hyper-V Manager Hyper-V Server R1, Dell UPS Local Node Manager R2 Main Operating System: 2008Enterprise
Implications of Security and Accreditation for 4DWX (Information Assurance) By Scott Halvorson Forecasters Training 26 February 2009
Implications of Security and Accreditation for 4DWX (Information Assurance) By Scott Halvorson Forecasters Training 26 February 2009 Users If I [user] am doing my job, then they [DOIM] are not doing theirs!
Tips and Best Practices for Managing a Private Cloud
Deploying and Managing Private Clouds The Essentials Series Tips and Best Practices for Managing a Private Cloud sponsored by Tip s and Best Practices for Managing a Private Cloud... 1 Es tablishing Policies
VMware vcenter Update Manager Administration Guide
VMware vcenter Update Manager Administration Guide Update 1 vcenter Update Manager 4.0 This document supports the version of each product listed and supports all subsequent versions until the document
Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring, and Restoration Services
4937 Fargo Street North Charleston SC 29418 Phone 843.266.2330 Fax 843.266.2333 w w w. c o d e l y n x. c o m Request for Information: Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring,
VA Medical Device Protection Program (MDPP)
VA Medical Device Protection Program (MDPP) Presented to National Institute for Standards and Technology (NIST) Health Security Conference May 11, 2011 Table of Contents Introduction MDPP Timeline and
Electronic Health Record System (EHR) Project. Request for Information RFI-CDVA-200907-01. Attachment 5 Statement of Work 2 Maintenance & Operations
State of California DEPARTMENT OF VETERANS AFFAIRS Electronic Health Record System (EHR) Project Request for Information RFI-CDVA-200907-01 Attachment 5 Statement of Work 2 Maintenance & Operations STATEMENT
BMC Client Management - SCAP Implementation Statement. Version 12.0
BMC Client Management - SCAP Implementation Statement Version 12.0 BMC Client Management - SCAP Implementation Statement TOC 3 Contents SCAP Implementation Statement... 4 4 BMC Client Management - SCAP
CYBER4SIGHT TM THREAT INTELLIGENCE SERVICES ANTICIPATORY AND ACTIONABLE INTELLIGENCE TO FIGHT ADVANCED CYBER THREATS
CYBER4SIGHT TM THREAT INTELLIGENCE SERVICES ANTICIPATORY AND ACTIONABLE INTELLIGENCE TO FIGHT ADVANCED CYBER THREATS PREPARING FOR ADVANCED CYBER THREATS Cyber attacks are evolving faster than organizations
Applying Software Quality Models to Software Security
Applying Software Quality Models to Software Security Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Carol Woody, Ph.D. April 21, 2015 Copyright 2015 Carnegie Mellon University
Cyber Threat Intelligence and Incident Coordination Center (C 3 ) Protecting the Healthcare Industry from Cyber Attacks
Cyber Threat Intelligence and Incident Coordination Center (C 3 ) Protecting the Healthcare Industry from Cyber Attacks July 2014 Cyber Threat Intelligence and Incident Coordination Center: Protecting
Patch and Vulnerability Management Program
Patch and Vulnerability Management Program What is it? A security practice designed to proactively prevent the exploitation of IT vulnerabilities within an organization To reduce the time and money spent
Cisco Unified Communications Remote Management Services
Cisco Unified Communications Remote Management Services What You Will Learn Our remote, high-visibility, co-management approach gives you complete ownership and control of your converged network. Cisco
Federal Desktop Core Configuration (FDCC)
Federal Desktop Core Configuration (FDCC) Presented by: Saji Ranasinghe Date: October, 2007 FDCC Federal Desktop Core Configuration (FDCC) Standardized Configuration with Hardened Security Settings to
Storage Capacity Management for Oracle Databases Technical Brief
Storage Capacity Management for Oracle Databases Technical Brief Written by Name Title Quest Software, Inc. Technical Brief Copyright Quest Software, Inc. 2008. All rights reserved. This guide contains
CYBERSPACE SECURITY CONTINUUM
CYBERSPACE SECURITY CONTINUUM A People, Processes, and Technology Approach to Meeting Cyber Security Challenges in the 21 st Century 1 InterAgency Board 1550 Crystal Drive Suite 601, Arlington VA 22202
Shipping Products Chart. Contents
Shipping Products Chart Currently shipping EVault Software products and supported platforms Contents Director (Vault) and Related Products Director (Vault) 7.11d ()... 2 Director Management Console (console
Practical Applications of Software Security Model Chris Nagel
Practical Applications of Software Security Model Chris Nagel Software Security Consultant Fortify Software Introductions About Me: Chris Nagel Software Security Consultant With Fortify for 2+ Years Before
High End Information Security Services
High End Information Security Services Welcome Trion Logics Security Solutions was established after understanding the market's need for a high end - End to end security integration and consulting company.
BSM for IT Governance, Risk and Compliance: NERC CIP
BSM for IT Governance, Risk and Compliance: NERC CIP Addressing NERC CIP Security Program Requirements SOLUTION WHITE PAPER Table of Contents INTRODUCTION...................................................
Outsource IT Services
Computer Systems and Network Solutions Table of Contents 1. IT Services...3 a. Computer and Networking Solutions...3 b. Benefits...3 2. DETAILS OF THE SERVICES... 4 3. COSTS AND TERMS...5 APPENDIX: List
An Esri White Paper January 2010 ArcGIS Server and Virtualization
An Esri White Paper January 2010 ArcGIS Server and Virtualization Esri 380 New York St., Redlands, CA 92373-8100 USA TEL 909-793-2853 FAX 909-793-5953 E-MAIL [email protected] WEB www.esri.com Copyright 2010
Dynamic Service Desk. Unified IT Management. Solution Overview
I T S E R V I C E + I T A S S E T M A N A G E M E N T INFRASTRUCTURE MANAGEMENT Dynamic Service Desk Unified IT Management Achieving business and IT alignment requires having insight into hardware and
Intelligent Power Protector User manual extension for Microsoft Virtual architectures: Hyper-V 6.0 Manager Hyper-V Server (R1&R2)
Intelligent Power Protector User manual extension for Microsoft Virtual architectures: Hyper-V 6.0 Manager Hyper-V Server (R1&R2) Hyper-V Manager Hyper-V Server R1, R2 Intelligent Power Protector Main
CONTINUOUS INTEGRATION
CONTINUOUS INTEGRATION REALISING ROI IN SOFTWARE DEVELOPMENT PROJECTS In the following pages we will discuss the policies and systems that together make up the process called Continuous Integration. This
Best Practices for Threat & Vulnerability Management. Don t let vulnerabilities monopolize your organization.
Best Practices for Threat & Vulnerability Management Don t let vulnerabilities monopolize your organization. Table of Contents 1. Are You in the Lead? 2. A Winning Vulnerability Management Program 3. Vulnerability
CS 2 SAT: The Control Systems Cyber Security Self-Assessment Tool
INL/CON-07-12810 PREPRINT CS 2 SAT: The Control Systems Cyber Security Self-Assessment Tool ISA Expo 2007 Kathleen A. Lee January 2008 This is a preprint of a paper intended for publication in a journal
HP Fortify Software Security Center
HP Fortify Software Security Center Proactively Eliminate Risk in Software Trust Your Software 92% of exploitable vulnerabilities are in software National Institute for Standards and Technology (NIST)
Automated Patch Management Service
Service Data Sheet Automated Patch Management Service Establishes elements for successful and proactive Automated Patch Management strategy for anti-virus signature screens, OS security patching and DeltaV
Office of Information and Technology 2015 National Veterans Small Business Engagement
Office of Information and Technology 2015 National Veterans Small Business Engagement Presentation for Business Opportunity Session Health Management Products Portfolio Presented By Larry Weldon Project
Content Distribution Management
Digitizing the Olympics was truly one of the most ambitious media projects in history, and we could not have done it without Signiant. We used Signiant CDM to automate 54 different workflows between 11
FedVTE Training Catalog SUMMER 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov
FedVTE Training Catalog SUMMER 2015 advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov Access FedVTE online at: fedvte.usalearning.gov If you need any assistance please
Application Code Development Standards
Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards
Enabling IT Agility with an Open Hybrid Cloud
Enabling IT Agility with an Open Hybrid Cloud Red Hat and Cisco Solutions and Collaboration Karthik Prabhakar [email protected] Global Cloud Architect 2 3 The Move to Hybrid Cloud PHYSICAL VIRTUAL CLOUD
Cyber4sight TM Threat. Anticipatory and Actionable Intelligence to Fight Advanced Cyber Threats
Cyber4sight TM Threat Intelligence Services Anticipatory and Actionable Intelligence to Fight Advanced Cyber Threats Preparing for Advanced Cyber Threats Cyber attacks are evolving faster than organizations
Integrating Physical Protection and Cyber Security Vulnerability Assessments
Integrating Physical Protection and Cyber Security Vulnerability Assessments Presented by Doug MacDonald Information Release # PNNL-SA-99462 Definition Wikipedia defines Vulnerability Assessments as the
Carahsoft End-User Computing Solutions Services
Carahsoft End-User Computing Solutions Services Service Description Horizon View Managed Services Bronze Package Managed Services Package Options # of Desktops to be Managed Desktop Type Duration of Services
CA Client Automation
CA Client Automation Supported Content for CA Patch Manager and Supported Application Signature Content April 2015 Contents CA Content Research Team... 3 CA Patch Manager Content... 3 Operating Systems
VPNSCAN: Extending the Audit and Compliance Perimeter. Rob VandenBrink [email protected]
VPNSCAN: Extending the Audit and Compliance Perimeter Rob VandenBrink [email protected] Business Issue Most clients have a remote access or other governing policy that has one or more common restrictions
Symantec Client Management Suite 7.6 powered by Altiris technology
Symantec Client Management Suite 7.6 powered by Altiris technology IT flexibility. User freedom. Data Sheet: Endpoint Management Overview With so many new devices coming into the workplace and users often
RHEL source and binary code Software documentation Major Releases - Minor Releases Errata Access to the Red Hat Network
HRG Insight: Subscription Services - The concept of Subscription Services in software is not new but has become a front-and-center topic recently. Microsoft s recent announcement that it will bundle the
Penetration Testing Services. Demonstrate Real-World Risk
Penetration Testing Services Demonstrate Real-World Risk Penetration Testing Services The best way to know how intruders will actually approach your network is to simulate a real-world attack under controlled
VMware vcenter Update Manager Administration Guide
VMware vcenter Update Manager Administration Guide vcenter Update Manager 4.0 This document supports the version of each product listed and supports all subsequent versions until the document is replaced
Enhancing Your Network Security
Enhancing Your Network Security Rainer Singer SE Manager Central Europe October 2013 Infoblox Overview & Business Update Founded in 1999 Headquartered in Santa Clara, CA with global operations in 25 countries
Problems and Measures Regarding Waste 1 Management and 3R Era of public health improvement Situation subsequent to the Meiji Restoration
HP Security Assessment Services
HP Security Assessment Services HP Data Center Services Technical data Your corporate information and intellectual property are important assets that you want to protect from unauthorized users. Developing
Why. Control System Cyber Security Sucks. CERN Control Centre. CERN Computer Centre
Why CERN Control Centre Control System Cyber Security Sucks CERN Computer Centre Why Control System Cyber-Security Sucks CERN Business Modell Beam Bunch Proton Why Control System Cyber-Security Sucks
SYMANTEC MANAGED SECURITY SERVICES. Superior information security delivered with exceptional value.
SYMANTEC MANAGED SECURITY SERVICES Superior information security delivered with exceptional value. A strong security posture starts with a smart business decision. In today s complex enterprise environments,
Symantec Client Management Suite 8.0
IT Flexibility. User Freedom. Data Sheet: Endpoint Management Overview of Symantec Client Management Suite Symantec Client Management Suite automates time-consuming and redundant tasks for deploying, managing,
National Cybersecurity Assessment and Technical Services: Capability Brief. Presented by: Sean McAfee Updated: May 5, 2014
National Cybersecurity Assessment and Technical Services: Capability Brief Presented by: Sean McAfee Updated: May 5, 2014 Program Overview Offer Full-Scope Red Team/Penetration Testing Capabilities Services
Dynamic Kernel Module Support. Matt Domsch, Software Architect Dell, Inc.
Dynamic Kernel Module Support Matt Domsch, Software Architect Dell, Inc. Product Timelines v3 v4 v5 Which one(s) are your customers using today? Scheduled Updates / Service Pack 2 Driver Management Challenges
Track 2: Introductory Track PREREQUISITE: BASIC COMPUTER EXPERIENCE
Anne Arundel Community College Tracks Anne Arundel Community College s computer technologies courses have been organized into 10 suggested tracks. The tracks are arranged to ensure that students have the
Chapter 9 Software Evolution
Chapter 9 Software Evolution Summary 1 Topics covered Evolution processes Change processes for software systems Program evolution dynamics Understanding software evolution Software maintenance Making changes
Workshop & Chalk n Talk Catalogue Services Premier Workshop & Chalk n Talk Catalogue
Services Premier Workshop & Chalk n Talk Catalogue The Microsoft Services Premier Workshop & Chalk n Talk Catalogue 2011 is published by Microsoft Services in Ireland. Workshop Schedule Workshop Location