IT Security and Compliance Program Plan for Maxistar Medical Supplies Company

IT Security and Compliance Program Plan for Maxistar Medical Supplies Company IT Security and Compliance Program Plan for Maxistar Medical Supplies Company IT Security and Compliance Program for PCI, HIPAA and NIST standards as applicable to the Maxistar Medical Supplies Company s IT operations. This paper was created as part of a case study for CYBS 6355 in the spring 2015 semester at the University of Dallas. James Konderla 3/18/2015 0 P age

Table of Contents Executive Summary... 1 Known Risks and Priorities... 2 Risk 1: Flat Network Topology... 2 Risk 2: Consolidated Server Functions... 3 Risk 3: Database Encryption... 5 Implementing a Risk Management Framework... 6 The New Security Program... 8 Conclusion... 13 References... 14 Table of Figures Figure 1, Bedford Site Topology... 2 Figure 2, Proposed Network Topology for Bedford Site... 3 Figure 3, Current Server Layout... 4 Figure 4, Virtualized Server Layout... 4 Figure 5, PCI Data Storage Guidelines (PCI, 2008)... 5 Figure 6, NIST Risk Management Approach... 6 Figure 7, Security Life Cycle... 7

IT Security and Compliance Program Plan for Maxistar Medical Supplies Company Executive Summary As Maxistar Medical Supplies Company grows and expands operations it becomes increasingly important to keep IT operations secure while also enabling the business to quickly and effectively meet customer needs. During a recent assessment Maxistar identified several changes that needed to be implemented to their IT operations to secure their business to align with regulatory and legal compliance for the Payment Card Industry (PCI), HIPAA, and NIST 800-53 standards. As part of this assessment, several known risks were identified and 5 areas specifically were targeted as the beginning of Maxistar s Security and Compliance program. This document will outline those risks as well as the guidelines for our plan to bring Maxistar into compliance with these three key standards. We will do this by addressing the following topics: List of Known risks and Major Priorities Implementation of a Risk Management Framework Overview of the new IT Security Strategy Overview and guidelines of the IT Compliance Strategy 1 P age

Known Risks and Priorities As part of our initial assessment of Maxistar s current IT Security state we were given exclusive access to the entire IT Operation. Due to this access we were able to determine that there are 3 major risk areas that Maxistar must initially address to both align with PCI, HIPAA and NIST standards and to secure their network in the interim as the compliance program rolls out. Risk 1: Flat Network Topology As seen below, Maxistar has a somewhat flat network architecture with only 1 firewall (per site) protecting the network from external environments. This architecture is not just seen at the Bedford site, but is repeated at every site and presents an easy target for external entities, allowing them to traverse the network as easy as the IT group. Figure 1, Bedford Site Topology Due to this, we suggest that Maxistar implement a layered topology, also known as Defense in Depth. As seen below, this topology places a secondary firewall between the central network and the

externally-exposed machines. This approach allows the IT assets that need to be accessed externally to still be accessed but keeps attackers from traversing the corporate network as well, effectively segregating the systems that should not be accessed externally. Figure 2, Proposed Network Topology for Bedford Site As each firewall acts as a router, it is suggested that the Demilitarized Zone (DMZ) between the 2 firewalls be separated from the internal network by a separate Virtual LAN (VLAN) to further complicate any attempts by external entities to traverse beyond the DMZ. The performance decreases by implementing this topology should be minimal, if they are even noticed. Risk 2: Consolidated Server Functions Maxistar s current network infrastructure has functioned for many years using a consolidated roles type infrastructure for their servers, as seen below.

Physical Server First Role Second Role Figure 3, Current Server Layout While this consolidation worked well in the past it presents many potential dangers to the enterprise: if a server sharing a customer database role and a web server role, for example, is compromised then a customer s data may be exposed. Our proposal is to separate the server functions through virtualization, such as the same physical server represented below: Physical Server Virtual Machine Virtual Machine First Role Second Role Figure 4, Virtualized Server Layout By separating server functions and limiting them to 1 per machine (or virtual machine) Maxistar can negate these risks while also coming closer to compliance with PCI, HIPAA and NIST standards, as each of these standards defines a separation of duties per server.

Risk 3: Database Encryption One of the most noticeable shortcomings in Maxistar s current infrastructure is the lack of encryption on databases. While some databases, such as product information, are unencrypted with good reason, others such as sales information, customer data or billing information should be encrypted immediately. This is also one of the core components of PCI, HIPAA and NIST standards and should be the primary focus as Maxistar begins converting to their new Security and Compliance program. We recommend a minimum of 128-bit encryption on systems that contain any Personally Identifiable Information, store sales or company-sensitive data, or contain payment information. The base guidelines for which systems require encryption can be found in the chart below, provided by PCI (2008). Figure 5, PCI Data Storage Guidelines (PCI, 2008) Of course this table also provides the guidelines for what data should and should not be stored for PCI purposes but as PCI is the most strenuous on data storage requirements we recommend that Maxistar follow their guidelines on both storing and encrypting data.

Implementing a Risk Management Framework A key factor of success for any Security and Compliance program is a risk management framework, as risks to a business cannot be properly mitigated without first being defined. A risk management framework will enable Maxistar to combine their IT security and risk management programs in a way that aligns to the business needs of the company while also protecting the company s IT infrastructure by defining the risks facing Maxistar and standardizing how those risks will be handled. Due to the continuous changing nature of cyber threats, establishing such a framework as part of the new security and compliance program now will save time, money and resources for current and future threats. We have selected the NIST framework (NIST, 2014), which was created for Federal Information Systems, as it is flexible while also providing a strong foundation for Maxistar s new program. This framework has a three-tiered approach to risk management, as seen below. Figure 6, NIST Risk Management Approach As can be seen in Figure 4, the NIST framework begins with the organization in mind. Only by understanding and aligning IT with the business can risks fully be identified and addressed. Once IT has

aligned themselves with the business they can identify the mission and business processes involved with keeping the business running efficiently and safely before, finally, moving on to securing the information systems and architecture of the company. Seen below, the 3 rd Tier of the NIST framework focuses on the Security Life Cycle, which guides organizations by using Architecture and Organizational inputs and implementing a continuous feedback cycle. Figure 7, Security Life Cycle Continuous feedback becomes very important, allowing the continuous improvement of the company s risk management policies as business or architecture needs change. NIST is a very robust framework but allows a lot of flexibility for different kinds of businesses and industries and is a perfect choice for Maxistar.

The New Security Program By implementing a risk management framework with a company first mindset we can see that Maxistar has many steps on the way to PCI, HIPAA and NIST 800-53 compliance. To aid in this journey two security plans were proposed and the Maxistar board decided on the later plan, outlined below. Phase 1 Need: Eventual / Time Length: 1 Months Overview: This phase has Maxistar's IT Group immediately establish Encryption and Database security controls on their databases. This phase also sees the overhaul of access control for software and hardware systems to match employee job roles. Steps and Requirements 1.) Immediately implement data encryption to all databases containing customer or payment information 2.) Conduct an overhaul of access controls and limit the use of equipment, software and systems to employees on a "least privileged" basis. 3.) Implement Emergency Access Controls to give elevated access in the event of technical or incidentdriven emergencies. 4.) Implement workstation security by increasing patching of business-critical systems to every 2 months and non business-critical systems to once a quarter. Overview: Phase 2 Need: Eventual / Time Length: 2 Months This phase sees the creation of Maxistar's Security and Compliance team, a subset of the IT Group governed by the Chief Security Officer and responsible for auditing and securing Maxistar's IT systems in compliance with company policies, industry regulations and international standards in all countries and markets Maxistar operates in. Steps and Requirements 1.) Create the IT Security and Compliance team with a minimum of 4 employees (2 domestic and 2 international) with 2 supervisory positions and 2 analyst positions. 2.) Create a standards document for Device and Media Controls with a focus on the disposal, re-use and resell of retired technologies and media. 3.) Create a security management process with a focus on risk analysis, risk management, system activity review and a sanction policy. 4.) Create an incident response and reporting program (may require additional employees) that focuses on security incident response, reporting and disaster recovery procedures. Phase 3

Need: Eventual / Time Length: 1 Months Overview: This phase sees the education of Maxistar employees on the new standards and access controls, as well as compliance and punishments for non-compliance, of the new IT security program. Steps and Requirements 1.) Create a training program and implement training classes for the new program. This step includes the publishing of documents on the company's intranet or in easily-accessible locations for all employees' review. 2.) Provide notification to customers and any other required entities (state, federal or regulatory) of the new security program. 3.) Establish a continued audit program and set schedule for the audit to occur through the new Security and Compliance team. Phase 4 Need: Eventual / Time Length: 2 Months Overview: For the software group, this phase sees the introduction of code revision and quality control to the group. For the hardware group this phase sees a change in the network topology to account for an additional firewall layer and a small testing infrastructure for both groups. Steps and Requirements 1.) SOFTWARE - Implement version control standards through GitHub Enterprise to allow easier backout of errors and expedited documentation of changes between software patches and revisions. 2.) SOFTWARE - Implement a code review internal to the company prior to implementing code changes to existing products or publishing new products. 3.) HARDWARE - Implement a secondary firewall with the current remaining at the perimiter (internetfacing) infrastructure. Move the web and (optional) email servers to the zone between the two firewalls, creating a demilitarized zone for internet-facing traffic. 4.) HARDWARE - Implement a testing infrastructure that shares access controls and a baseline with the current infrastructure. Phase 5 Overview: Need: Eventual / Time Length: 3-4 Months This phase will see the implementation of a shared knowledgebase, service catalog and ticket tracking system in accordance with ITIL and ITSM standards. Steps and Requirements 1.) Implement a service management solution (for example HP Service Management) to allow the access of a shared knowledgebase, service catalog and trouble/issue tracking system. 2.) Create a service catalog and corresponding website for the ordering and cataloging of IT Assets and services. As can be seen, this plan is aggressive and will take 10 months to roll out. This plan will focus mainly on the implementation of the new security group, which will establish the security standards and

policies for Maxistar using the NIST risk management framework for guidance. Once this program rolls out, the new security team will focus first on PCI compliance with HIPAA and NIST compliance also in mind. To aide in this endeavor the security group s first major task will be to take a baseline of Maxistar s current security using the PCI DSS D questionnaire for Merchants to assess how close Maxistar is to PCI compliance. Using the answers to the questionnaire, the security group will then move on to actually developing the new policies using the Common Authorities on Information Assurance (CAIA) spreadsheet (Cloud Audit Controls, 2012). By using this spreadsheet we can see that there are many common elements to each program and, as Maxistar moves closer to PCI compliance these common elements can be assessed as well. Here are a few examples of how these standards can be assessed using the CAIA to note the corresponding HIPAA and NIST standards. Assessment Procedure ASSESSMENT OBJECTIVE: Pertaining to firewalls and routers: Restrict Inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Examine Firewall Configurations To verify that all inbound and outbound traffic necessary for the cardholder agreement is identifiable, that inbound and outbound traffic is limited to that which is necessary for the cardholder data environment, that all non-necessary inbound and outbound traffic is specifically denied either by an explicit "deny all" rule or implicit deny after allow statement] Compliance Elements: NIST 800-53: SC-7 PCI DSS: 1.2.1 ASSESSMENT OBJECTIVE: Verify that file-integrity monitoring or change-detection software has been implemented on system logs to ensure that existing log data cannot be changed without generating alerts. POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: system settings, monitored files, results from file monitoring/change-detection activies/applications] Compliance Elements: NIST 800-53: AU-9, AU-11, AU-14 PCI DSS: 10.5.5 ASSESSMENT OBJECTIVE: Verify that quarterly internal vulnerability scans have been performed by qualified personnel. This includes rescans performed until all "high-risk" vulnerabilities are resolved. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT ALL: review scan reports and verify that four quarterly internal scans occurred in the most recent 12-month periods; Review scan reports and verify that scan process includes rescans until all "high-risk" vulnerabilities as defined in PCI DSS Requirement 6.1 are resolved.] Compliance Elements: NIST 800-53: CM-3, CM-4, CP-10, RA-5, SA-7, SI-1, SI-2, SI-5 PCI DSS: 11.2.1 HIPAA: 164.308(A)(1)(I)(II)(A), 164.308(a)(1)(i)(ii)(B), 164.308(a)(5)(i)(ii)(B) ASSESSMENT OBJECTIVE: Verify that security alerts and information are monitored, analyzed and distributed to appropriate personnel. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Verify that responsibility for monitoring and analyzing security alerts and distributing information to appriate information security and business unit management personnel is formally assigned.] Compliance Elements: NIST 800-53: IR-2, IR-6, IR-7 PCI DSS: 12.5.2 HIPAA: 164.312(a)(6)(ii), 318.3(a)(New), 318.5(a)(New)

ASSESSMENT OBJECTIVE: Verify that all personnel are trained in a security awareness program upon hire and at least once annually. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Verify that the program provides multiple methods of communicating awareness and educating personnel; verify that personnel attend security awareness training upon hire and at least once annually] Interview: [SELECT FROM: randomly sample personnel to verify they have completed awareness training and are aware of the importance of cardholder security.] Compliance Elements: NIST 800-53: AT-1, AT-2, AT-3, AT-4 PCI DSS: 12.6.1 HIPAA: 164,308(a)(5)(i), 164.308(a)(5)(ii)(A) By using this same technique we can match the compliance elements for all 3 frameworks (PCI, NIST and HIPAA) into a common framework to make implementation easier. Once PCI compliance has been achieved we should have a better security posture and also be closer to meeting HIPAA and NIST compliance as well. By using the HIPAA security risk assessment tool (HHS, 2014) we can more onto meeting HIPAA compliance first and then finish the implementation of our security and compliance program by qualifying for NIST certification as our last step. We plan on dedicating 1 person as the lead on this project, who will work full time and lead the compliance efforts with the remaining security and IT staff dedicating 20% of their time to the program with the remaining 80% focused on their normal jobs.

Conclusion As can be seen, Maxistar has a ways to go before they are PCI, HIPAA and NIST compliant. This road, however, will be shorter by relying on NIST as the risk management framework for Maxistar s new Security and Compliance Program. After the initial 10 month rollout Maxistar s infrastructure will run smoother and more secure for the remaining rollout. Over the course of the final rollout, which should take an estimated year, Maxistar will see themselves moved completely into compliance with all 3 standards. Although ideally compliance would be done at a faster rate, we must keep in mind that Maxistar has limited resources, like every other company, and the main resources, people, will be devoted to their own jobs. With 1 person leading the efforts and an 80/20 split between their normal jobs and work on the compliance program Maxistar s journey towards compliance should be smoother than many other companies but, unlike most other companies, Maxistar will be in complete alignment with PCI, HIPAA and NIST 800-53 standards.

IT Security and Compliance Program Plan for Maxistar Medical Supplies Company References Data Security Standard - Requirements and Security Assessment Procedures. (2013, November 1). Retrieved March 19, 2015, from https://www.pcisecuritystandards.org/documents/pci_dss_v3.pdf Guide for Assessing the Security Controls in Federal Information Systems and Organizations. (2010, June 1). Retrieved March 19, 2015, from http://csrc.nist.gov/publications/nistpubs/800-53arev1/sp800-53a-rev1-final.pdf PCI Data Storage Do s and Don'ts. (2008). Retrieved April 9, 2015, from https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf NIST SP800-53 R3. (2014). Retrieved April 9, 2015, from http://www.nist.gov/cyberframework/ Cloud Audit Controls. (2012). Retrieved April 9, 2015, from http://www.cloudauditcontrols.com/2012/05/spreadsheet-iso-pci-hipaa-800-53.html News. (2014). Retrieved April 9, 2015, from http://www.hhs.gov/news/press/2014pres/03/20140328a.html 14 P age