Carl F. Allen, CISM, CRISC, MBA Director, Information Systems Security Intermountain Healthcare
Regulatory Compliance External Audit Legal and ediscovery Information Security Architecture Models Access Controls Encryption Considerations Incidents and Response Threats and Risks
Regulatory Compliance FFIEC FISMA GLBA HIPAA/HITECH JCAHO PCI DSS SOX/MAR State Breach Laws
ISO 27001/27002 Risk Assessment X X X X X Security Policy X X X X X Organization of Information X X X X X Asset Management X X X Human Resources Management X X X X X Information Security Incident Reporting X X X X Business Continuity Management X X X X X Compliance X X X X X Communications and Operations Management X X X X X Access Control X X X X X IS Acqusition, Development, Maintenance X X X X Physical and Environmental Security X X X X X HIPAA Security HIPAA Privacy JCAHO GLBA SOX
External Audit SSAE 16 / SAS 70 Right to Audit Cloud Service Provider (CSP) IaaS, PaaS, SaaS and extensions Validate audit results using a controls framework Cloud Security Alliance Cloud Controls Matrix designed to provide fundamental security principles to guide cloud vendors and to assist customers in assessing the overall security risk of a cloud provider
Assessing Security Risk
Legal and ediscovery Contractual language CSP location and laws ediscovery requests End of service Data destruction Data recovery Escrow of data Indemnification Ownership of data Protection of IP
Formal Model Security Reference Architecture
Access Controls Authentication Authorization Administration Assurance
Authentication Simple or strong authentication User ID and password Multi-factor mechanisms Single / simplified sign-on User Device Service (IaaS / PaaS / SaaS) Federated
Authorization Discretionary Mandatory Role based access control Attribute based access control Administrative privileges Application programming interface Provisioning and de-provisioning
Administration Business continuity Disaster recovery Change management Patch management Segregation IaaS / PaaS / SaaS Logical / physical / virtual Personnel management Data destruction
Assurance
Encryption Considerations Secret (symmetric) and public key (asymmetric) Data/message confidentiality, integrity and non-repudiation Key and certificate infrastructure Enabling applications using encryption APIs Performance software vs. hardware
Key and Certificate Infrastructure Policy creation Trust and infrastructure design Proprietary or standards based Scalability and manageability Available services Generation, distribution, revocation and recovery of keys and certificates
Incidents and Response Policy Response plan Monitoring Processes, tools and technologies Notification Incident team Remediation Recovery Training
Threats and Risks The Notorious Nine in 2013 (Source: Cloud Security Alliance Feb 2013) 1. Data Breaches 2. Data Loss 3. Account Hijacking 4. Insecure APIs 5. Denial of Service 6. Malicious Insiders 7. Abuse of Cloud Services 8. Insufficient Due Diligence 9. Shared Technology Issues
Questions? Carl.Allen@imail.org