Final Exam Case Study        ITT-1021-01 Principles of Information Security                 Instructor: Scott Simenson  Ka...
Table of Contents1. Introduction2. Job Description and Qualifications3. Policies Descriptions4. Risk Assessment Framework5...
1. IntroductionThe world is a dangerous place, always has been and looks to continue to be that way into the foreseeable f...
2. Job Description/Responsibilities                                                     RLK Products                      ...
Compliance and Enforcement Serve as the company compliance officer with respect to RLK, state and federal information secu...
3. Policy DescriptionPreambleIn compliance with HIPAA, NIST, and FIPS standards, and generally accepted industry best prac...
· Log off of systems (or initiate a password protected screensaver) before leaving a workstation unattended· Use only RLK ...
organization’s insurance carrier. They assist in processing summonses and claims against the facility by working withlegal...
Database Administrators work with data base management software and determine ways to store, organize, analyze,use and pre...
of informational security. Works with administration, legal counsel and other related parties to represent theorganization...
• Ensure the confidentiality, integrity, and availability of EPHI that it creates, receives, maintains, or transmits;• Pro...
The steps listed in the NIST RMF create an effective information security program and can be applied to both new andlegacy...
When talking about risk, it is important that terminology be defined and clearly understood. This section definesimportant...
6. How to Conduct the Risk Assessment:Risk assessments can be conducted using many different methodologies. There is no si...
4. Identify Potential Vulnerabilities.               Often performed simultaneously with step 3, Identify Realistic Threat...
Table 6. Security Objectives and ImpactsSome tangible impacts can be measured quantitatively in terms of lost revenue, the...
Table 7. Sample Risk-Level Matrix8. Recommend Security Controls.                  During this step, security controls that...
Identification and Categorization of Information Types in RLK SystemWe have identified the information types and assigned ...
Selection of Security Controls for SystemDuring the design and implementation life-cycle phase, a set of security controls...
The following specific example shows the criteria for determining control baselines:Implementing and Documentation of the ...
Accreditation (Authorization) of SystemOnce a system has been certified, the security documentation package is reviewed by...
Continuity                          BIA                            Identify                   Develop             policy  ...
Upcoming SlideShare
Loading in …5

Case Study


Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Case Study

  1. 1. Final Exam Case Study ITT-1021-01 Principles of Information Security Instructor: Scott Simenson Kathy Cotterman and Lisa Neuttila December 8, 2010
  2. 2. Table of Contents1. Introduction2. Job Description and Qualifications3. Policies Descriptions4. Risk Assessment Framework5. Risk Assessment Guidelines6. How to Conduct a Risk Assessment7. Ongoing Maintenance8. Proposed Solution 2|Page
  3. 3. 1. IntroductionThe world is a dangerous place, always has been and looks to continue to be that way into the foreseeable future.History shows us that our world has always posited a large element of risk to any attempted enterprise, usually, themore successful the enterprise is, the greater the potential for misadventure to befall it. It is important for RLK Productsto choose and implement appropriate security controls.There are several important questions that should be answered by organizational officials when addressing the securityconsiderations for their information systemsThis proposed security blue print, strongly recommends the implementation of operational and technical safeguards orcountermeasures prescribed for an information system to protect the confidentiality, integrity and availability of thesystem and its information: • What is the desired or required level of assurance (i.e., grounds for confidence) that the selected security controls, as implemented, are effective in their application? • Have the selected security controls been implemented or is there a realistic plan for their implementation? • What security controls are needed to adequately protect the information systems that support the operations and assets of the organization in order for that organization to accomplish its assigned mission, protect its assets, fulfill its legal responsibilities, maintain its day-to-day functions, and protect individuals?It is of paramount importance that responsible officials within the organization understand the risks and other factorsthat could adversely affect organizational operations, organizational assets, or individuals. Moreover, these officialsmust understand the current status of their security programs and the security controls planned or in place to protecttheir information systems in order to make informed judgments and investments that appropriately mitigate risks to anacceptable level. 3|Page
  4. 4. 2. Job Description/Responsibilities RLK Products Office of the Chief Information Officer (CIO) Job DescriptionDEPARTMENT: Office of the CIOJOB TITLE: Information Assurance/Security Officer (IA/SO)POSITION RELATIONSHIPS: Reports to: Chief Information Officer Works with: Risk and Contingency Manager, System Owner, Security Operations Manager External Relationships: IT suppliers/vendors, law enforcementPOSITION SUMMARY:Under the general direction of the CIO, the Information Assurance/Security Officer (IA/SO) is responsible for thedevelopment and delivery of a comprehensive information security and privacy program for RLK Products. The scopeof this program is company-wide, and includes information in electronic, print and other formats. The purposes ofthis program include: to assure that information created, acquired or maintained by RLK and its authorized users, isused in accordance with its intended purpose; to protect RLK information and its infrastructure from external orinternal threats; and to assure that RLK complies with statutory and regulatory requirements regarding informationaccess, security and privacy.POSITION DUTIES, RESPONSIBILITIES AND COMPETENCIESPolicyCoordinate the development of RLK information security policies, standards and procedures. Work with key IT offices,data custodians and governance groups in the development of such policies. Ensure that company policies supportcompliance with external requirements. Oversee the dissemination of policies, standards and procedures to thecompany.Education and TrainingCoordinate the development and delivery of an education and training program on information security and privacymatters for employees, other authorized users. 4|Page
  5. 5. Compliance and Enforcement Serve as the company compliance officer with respect to RLK, state and federal information security policies and regulations1. Work with the company-designated Records Access and HIPAA-privacy Officers on compliance issues as necessary. Prepare and submit required reports to external agencies. Incident Response Develop and implement an Incident Reporting and Response System to address RLK security incidents (breaches), respond to alleged policy violations, or complaints from external parties. Serve as the official company contact point for information security, privacy and copyright infringement incidents, including relationships with law enforcement entities. Risk Assessment and Incident Prevention Develop and implement an ongoing risk assessment program targeting information security and privacy matters; recommend methods for vulnerability detection and remediation, and oversee vulnerability testing. Official Contact Act as the CIO’s designee representing RLK on Information Security matters; serve as the company contact point for external auditors and agencies, survey requests, etc on security/privacy matters. Maintain Knowledgebase Keep abreast of latest security and privacy legislation, regulations, advisories, alerts and vulnerabilities pertaining to the RLK and its mission. Emergency Preparedness Take part in Disaster Recovery Planning. QUALIFICATIONS: The emphasis of this position is on policy development, program administration and compliance/incident response activities. While technical knowledge of information technology and security issues is highly desirable, technical expertise and resources will be available from units such as Systems Management & Operations, and the Office of Telecommunications to support the information security and privacy program.Education: Bachelor’s degree required. Advanced degree preferred.General Skills and Experience Requirements: • Experienced in the management of both physical and logical information security systems • Strong technical skills (application and operating system hardening, vulnerability assessments, security audits, TCP/IP, intrusion detection systems, firewalls, etc.) • Outstanding interpersonal and communication skills • Must possess a high degree of integrity and trust along with the ability to work independently • Excellent documentation skills • Ability to weigh business risks and enforce appropriate information security measures • In-depth knowledge of the HIPAA Security Rule and other government technology laws • CISSP (Certified Information Systems Security Professional) certification preferred 1 For example, HIPAA, NIST and FIPS Publications, Minnesota Laws and Statutes, USA Patriot Act, et al. 2
  6. 6. 3. Policy DescriptionPreambleIn compliance with HIPAA, NIST, and FIPS standards, and generally accepted industry best practices, RLK Productsprovides for the security and privacy of the data stored on, redirected through, or processed by its technology resources.RLK Products encourages the use of these technology resources; however they remain the property of RLK Products andare offered on a privilege basis only.Throughout this policy, the term “staff” identifies full- and part-time employees, contractors, consultants, temporaries,student assistants, volunteers, retired annuitants, vendors and other users including those affiliated with third partieswho access RLK Products technology resources due to their job responsibilities. Management expects staff to complywith this and other applicable RLK Products policies, procedures, and local, state, federal, and international laws. Failureto abide by these conditions may result in forfeiture of the privilege to use technology resources, disciplinary action,and/or legal action.The IT Policy Review Team regularly modifies this and other IT security related policies to reflect changes in industrystandards, legislation, technology and/or products, services, and processes at RLK Products.PrivacyRLK Products reserves the right to monitor, duplicate, record and/or log all staff use of RLK Products technologyresources with or without notice. This includes but is not limited to e-mail, Internet access, keystrokes, file access, logins,and/or changes to access levels. Staff shall have no expectation of privacy in the use of these technology resources.LiabilityRLK Products makes no warranties of any kind, whether expressed or implied for the services in this policy. In addition,RLK Products is not responsible for any damages which staff may suffer or cause arising from or related to their use ofRLK Products technology resources. Staff must recognize that RLK Products technology resource usage is a privilegeand that the policies implementing said usage are requirements that mandate adherence.Staff Responsibilities and AccountabilityEffective information security requires staff involvement as it relates to their jobs. Staff is accountable for their actionsand therefore they own any events occurring under their user identification code(s). It is staff’s responsibility to abide bypolicies and procedures of all networks and systems with which they communicate. Access of personal or privateInternet Service Providers while using RLK Products provided information technology resources or using non-RLKProducts provided information technology resources to conduct RLK Products business does not indemnify any entityfrom the responsibilities, accountability and/or compliance with this or other RLK Products policies. Staff responsibilitiesinclude but are not limited to:· Access and release only the data for which you have authorized privileges and a need to know (including misdirected e-mail)· Abide by and be aware of all policies and laws (local, state, federal, and international) applicable to computer systemuse· Report information security violations to the Information Security Officer or designee and cooperate fully with allinvestigations regarding the abuse or misuse of state owned information technology resources· Protect assigned user IDs, passwords, and other access keys from disclosure· Secure and maintain confidential printed information, magnetic media or electronic storage mechanisms in approvedstorage containers when not in use and dispose of these items in accordance with RLK Products policy 6|Page
  7. 7. · Log off of systems (or initiate a password protected screensaver) before leaving a workstation unattended· Use only RLK Products acquired and licensed software· Attend periodic information security training provided by RLK Products IT Security Branch· Follow all applicable procedures and policies© SANS Institute 2001, Author retains full rightsKey Who IfingerinA27 2F94 998D FDB5 DE3D F8B5 06E4 Risk & Contingency System Architect System Owners Managers S Security System O Operations Administrator Manager Telecommunications Specialist Computer Security Specialist ĂƚĂďĂƐĞ ĚŵŝŶŝƐ ĂƚŽ ƚƌ ƌ t Ğď ĚŵŝŶŝƐ ĂƚŽ ƌ ƚƌWho is Responsible?Risk and Contingency Manager is responsible for administering and managing the facility’s risk management program.They develop and implement the organization’s risk management program in a manner that fulfills the mission andstrategic goals of the organization while complying with state and federal laws and accreditation standards related tosafety and risk management. They develop and implement systems, policies, and procedures for the identification,collection and analysis of risk related information. They educate and train the leadership, staff and business associatesas to the risk management program, and their respective responsibilities in carrying out the risk management program.They lead, facilitate, and advise departments in designing risk management programs within their own departments.They collect, evaluate, and maintain data concerning patient injuries, claims, worker’s compensation, and other risk-related data. They help investigate and analyze root causes, patterns, or trends that could result in compensatory orsentinel events. They help to identify and implement corrective action where appropriate. They provide a quarterlysummary to the Board on incidents, claims, and claim payments. They serve as the organization’s liaison to the 7|Page
  8. 8. organization’s insurance carrier. They assist in processing summonses and claims against the facility by working withlegal counsel to coordinate the investigation, processing, and defense of claims against the organization. They activelyparticipate in or facilitate committees related to risk management, safety, and quality improvement.System Owner serves as the process owner for all ongoing activities related to the availability, integrity, andconfidentiality of patient, provider, employee and business information in compliance with the healthcare organizationsinformation security policies and procedures. Documents for information security policies and procedures instituted bythe organizations Information Security Committee. Implements the organization’s information security policies andprocedures. Provides direct information security training to all employees, contractors, alliances, and other third-parties.Monitors compliance with the organization’s information security policies and procedures among employees,contractors, alliances, and other third parties and refers problems to appropriate department managers oradministrators. Monitors internal control systems to ensure that appropriate information access levels and securityclearances are maintained. Performs information security risk assessment and serves as the internal auditor forinformation security processes. Prepares the organization’s disaster recovery and business continuity plans forinformation systems. Serves as an internal information security consultant to the organization. Monitors advancementin information security technologies. Monitors changes in legislation and accreditation standards that affect informationsecurity. Initiates, facilitates, and promotes activities to foster information security awareness within the organization.Serves as the information security liaison for users of clinical, administrative, and behavioral systems. Reviews allsystem- related information security plans throughout the organizations network.Security Operations Manager provide supervisory oversight for day to day security operations of the site. Ensures allrequired reporting and contract compliance requirements are met by conducting regular performance reviews.Prepares reports or metrics as assigned to track data. Maintains daily contact with patients to solicit feedback regardingperformance, operational requirements, and other issues pertaining to site operations. Building, improving andmaintaining effective relationships with patients, employees and third-parties. Maintains administrative oversight forsite operations including procedural changes, contact information, and works instructions. Assists in operationalplanning, emergency response, and other security related matters. Handles security issues in emergency situations inaccordance with regulations, company policies and contract requirements.Computer Security Specialist plan, Coordinate and maintain an organizations information security. They educate usersabout computer security, install security software, monitor network for security breaches, respond to cyber-attacks and,in some cases, gather data and evidence to be used in prosecuting cyber-crime.Telecommunications Specialist focus on the interaction between computer and communities communicationsequipment. They designed voice, video and data communication systems, supervise the installation of the systems, andprovide maintenance and other services after the systems are installed. They also test lines, oversees equipment repair,and may compile and maintain system records.Web Administrators are responsible for maintaining website. They oversee issues such as availability to users and speedof access, and are responsible for approving the content of the site. Web Administrators also collect and analyze data onweb activity, traffic patterns and other metrics, as well as monitor in respond to user feedback. They are alsoresponsible for the technical aspects of website creation. They use software languages and tools and create applicationsfor the web. They identify the site’s users and oversee its product production and implementation. They determine theinformation that the site will contain and how it will be organized, and may use web development software to integratedatabases and other information systems. 8|Page
  9. 9. Database Administrators work with data base management software and determine ways to store, organize, analyze,use and present data. They identify user needs and set up new computer databases. In many cases, databaseadministrators must integrate data from old systems into a new system. They also test and coordinate modifications tothe system when needed, and troubleshoot problems when they occur. They ensure performance of the system,understands the platform on which database runs, and adds new users to the system. They plan and coordinate securitymeasures with network administrators.Systems Architects are the designers of computer networks. They set up, test, and evaluate systems such as local areanetworks (LANs), wide area networks (WANs), the internet, intranets, and other data communications systems.Systems are configured in many ways and can range from a connection between two offices in the same building toglobally distributed networks, voice mail and e-mail systems of a multinational organization. Network architects andengineers perform network modeling, analysis and planning, which often require both hardware and software solutions.For example, setting up a network may involve installation of several pieces of hardware, such as routers and hubs,wireless adapters and cables, as well as the installation and configuration of software, such as network drivers. Theseworkers may also research related products and make necessary hardware and software recommendations, as well asthe address information security issues.System Administrators are responsible for LANs, WANs, network segments, and Internet and intranet systems. They arealso responsible for maintaining system efficiency. They ensure that the design of an organizations computer systemallows all the components, including computers, the network, and software, to work properly together. Administratorsalso troubleshoot problems reported by users in by automated network monitoring systems and makerecommendations for future system upgrades. They maintain network and system security, maintain network hardwareand software, analyze problems, and monitor networks to ensure their availability to users. They gather data toevaluate the systems performance, identify user needs, and determine system and network requirements.Computer Security Specialist oversee all ongoing activities related to development, implementation, maintenance of,and adherence to policies and procedures covering security of and access to protected health information (PH I) incompliance to federal and state laws and health system security practices. The Computer Security Specialist ensures thatperiodic risk assessments and ongoing monitoring of key elements of the security program are monitored. They lead inthe development and enforcement of information security policies and procedures, measures and mechanisms toensure the prevention, detection, containment and correction of security incidents. They ensure that security standardscomply with statutory and regulatory requirements regarding health information. Ensures that security policies aremaintained that include: administrative security, personnel security, physical safeguards, technical security andtransmission security. They provide assurance that appropriate documentation exists of response of the institution ofthe addressable portion of the security rule. Ensures that security procedures are maintained that include: evaluation ofcompliance with security measures; contingency plans for emergency and disaster recovery; security incident responseprocess and protocols; testing of security procedures, measures and mechanisms, and continuous improvement; andsecurity incident reporting mechanisms and sanction policy. Ensures that appropriate security measures andmechanisms are in place to guard against unauthorized access to electronically stored and/or transmitted patient dataand protect against reasonably anticipated threats and hazards, including, when appropriate: integrity controls,authentication controls, access controls, encryption, and abnormal condition alarms, audit trails, entity authenticationand events reporting. They oversee ongoing security monitoring of information systems, including: periodic informationsecurity risk assessment; functionality and gap analyses to determine the extent to which key business areas andinfrastructure comply with statutory and regulatory requirements; and review of new information security technologiesand counter- measures against threats to information or privacy. They oversee training programs, periodic securityawareness reminders, and periodic security audits. This position serves as an instrumental resource regarding matters 9|Page
  10. 10. of informational security. Works with administration, legal counsel and other related parties to represent theorganization information security interests with external parties (state or local government bodies) who undertake toadopt or amend security legislation, regulation, or standard. They coordinate with the appropriate departments andunits to ensure timely development and implementation of corrective action plans in response to monitoringdeficiencies and complaints. 4. Risk Assessment FrameworkRisk Assessment Framework introduces a structured, flexible, extensible, and repeatable process for managingorganizational risk and achieving risk-based protection related to the operation and use of information. RLK Enterprisesis an electronic medical records storage company and is subject to HIPPA Security Rule. The National Institute ofStandards and Technology has created structure, guidelines and procedures that are required to be followed by FederalAgencies when dealing with electronic health information. They have made these available to commercial enterprisesand actually recommend their use by the private sector. So we have decided to adopt most if not all of theirrecommended Risk Assessment Framework, with some scoping and customizing to the specific needs of RLK Enterprises.A Risk Management Policy has been created to: • Protect RLK Enterprises from those risks of significant likelihood and consequence in the pursuit of the company’s stated strategic goals and objectives • Provide a consistent risk management framework in which the risks concerning business processes and functions of the company will be identified, considered and addressed in key approval, review and control processes • Provide assistance to and improve the quality of decision making throughout the company • Meet legal or statutory requirements • Encourage pro-active rather than re-active management • Assist in safeguarding the companys assets -- people, data, property and reputationHealth Insurance Portability and Accountability Act (HIPAA)HIPAA Security RuleThe HIPAA Security Rule specifically focuses on the safeguarding of electronic protected health information (EPHI). AllHIPAA covered entities, which includes some federal agencies, must comply with the Security Rule. The Security Rulespecifically focuses on protecting the confidentiality, integrity, and availability of EPHI, as defined in the Security Rule.The EPHI that a covered entity creates, receives, maintains, or transmits must be protected against reasonablyanticipated threats, hazards, and impermissible uses and/or disclosures. In general, the requirements, standards, andimplementation specifications of the Security Rule apply to any provider of medical or other health services, or supplies,who transmits any health information in electronic form in connection with a transaction for which HHS has adopted astandard.Security Rule Goals and ObjectivesAs required by the “Security standards: General rules” section of the HIPAA Security Rule, each covered entity must: 10 | P a g e
  11. 11. • Ensure the confidentiality, integrity, and availability of EPHI that it creates, receives, maintains, or transmits;• Protect against any reasonably anticipated threats and hazards to the security or integrity of EPHI; and• Protect against reasonably anticipated uses or disclosures of such information that are not permitted by the PrivacyRule.In complying with this section of the Security Rule, covered entities must be aware of the definitions provided forconfidentiality, integrity, and availability as given by § 164.304:• Confidentiality is “the property that data or information is not made available or disclosed to unauthorized persons orprocesses.”• Integrity is “the property that data or information have not been altered or destroyed in an unauthorized manner.”• Availability is “the property that data or information is accessible and useable upon demand by an authorized person.”NIST Risk Management Framework (RMF)The NIST RMF, illustrated in Figure 1, provides a disciplined, structured, extensible, and repeatable process for achievingrisk-based protection related to the operation and use of information systems and the protection of EPHI. It representsan information security life cycle that facilitates continuous monitoring and improvement in the security state of theinformation systems within the organization.Figure 1 11 | P a g e
  12. 12. The steps listed in the NIST RMF create an effective information security program and can be applied to both new andlegacy information systems within the context of a system development life cycle. A risk-based approach to securitycontrol selection and specification considers effectiveness, efficiency, and constraints due to applicable laws, policies,standards, or regulations. The flexible nature of the NIST RMF allows other communities of interest, such as privatesector entities, to use the framework voluntarily either with the NIST security standards and guidelines or with industry-specific standards and guidelines. The RMF provides organizations with the flexibility needed to apply the right securitycontrols to the right information systems at the right time to adequately protect the critical and sensitive information,missions, and business functions of the organization.1Categorize the information system and the information resident within that system based on a FIPS 199 impactanalysis.2Select an initial set of security controls (i.e., security control baseline from Appendix D) for the information systembased on the FIPS 199 security categorization and the minimum security requirements defined in FIPS 200; applytailoring guidance from Section 3.3 as appropriate, to obtain the control set used as the starting point for theassessment of risk associated with the use of the system.1Supplement the initial set of tailored security controls based on an assessment of risk and local conditions includingorganization-specific security requirements, specific threat information, cost-benefit analyses, or special circumstances.2Document the agreed-upon set of security controls in the system security plan including the organization’s rationale forany refinements or adjustments to the initial set of controls.3Implement the security controls in the information system. For legacy systems, some or all of the security controlsselected may already be in place.4Assess the security controls using appropriate methods and procedures to determine the extent to which the controlsare implemented correctly, operating as intended, and producing the desired outcome with respect to meeting thesecurity requirements for the system.5Authorize information system operation based upon a determination of the risk to organizational operations,organizational assets, or to individuals resulting from the operation of the information system and the decision that thisrisk is acceptable.6Monitor and assess selected security controls in the information system on a continuous basis including documentingchanges to the system, conducting security impact analyses of the associated changes, and reporting the security statusof the system to appropriate organizational officials on a regular basis. 5. Risk Assessment GuidelinesThis appendix incorporates risk assessment concepts and processes described in NIST SP 800-30 Revision 1, Effective Useof Risk Assessments in Managing Enterprise Risk, the NIST Risk Management Framework, and the HIPAA Security Series:Basics of Risk Analysis and Risk Management. It is intended to assist covered entities in identifying and mitigating risks toacceptable levels.The purpose of a risk assessment is to identify conditions where EPHI could be disclosed without proper authorization,improperly modified, or made unavailable when needed. This information is then used to make risk managementdecisions on whether the HIPAA-required implementation specifications are sufficient or what additional addressableimplementation specifications are needed to reduce risk to an acceptable level.Key Terms Defined 12 | P a g e
  13. 13. When talking about risk, it is important that terminology be defined and clearly understood. This section definesimportant terms associated with risk assessment and management.• Risk is the potential impact that a threat can have on the confidentiality, integrity, and availability on EPHI byexploiting a vulnerability.• Threats are anything that can have a negative impact on EPHI. Threats are: • Intentional (e.g., malicious intent); or • Unintentional (e.g., misconfigured server, data entry error).• Threat sources are: • Natural (e.g., floods, earthquakes, storms, tornados); • Human (e.g., intentional such as identity thieves, hackers, spyware authors; unintentional such as data entry error, accidental deletions); or • Environmental (e.g., power surges and spikes, hazmat contamination, environmental pollution).• Vulnerabilities are a flaw or weakness in a system security procedure, design, implementation, or control that could beintentionally or unintentionally exercised by a threat.• Impact is a negative quantitative and/or qualitative assessment of a vulnerability being exercised on theconfidentiality, integrity, and availability of EPHI.It can be easy to confuse vulnerabilities and threats. An organization may be vulnerable to damage from power spikes.The threats that could exploit this vulnerability may be overloaded circuits, faulty building wiring, dirty street power, ortoo much load on the local grid. It is important to separate these two terms in order to assist in proper security controlselection. In this example, security controls could range from installing UPS systems, additional fuse boxes, or standbygenerators, or rewiring the office. These additional security controls may help to mitigate the vulnerability but notnecessarily for each threat.HIPAA Risk Assessment RequirementsStandard 164.308(a)(1)(i), Security Management Process, requires covered entities to: Implement policies andprocedures to prevent, detect, contain, and correct security violations. The Security Management Process standardincludes four required implementation specifications. Two of these specifications deal directly with risk analysis and riskmanagement.1. Risk Analysis (R123) – 164.308(a)(1)(ii)(A): Conduct an accurate and thorough assessment of the potential risks andvulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by thecovered entity.2. Risk Management (R) – 163.308(a)(1)(ii)(B): Implement security measures sufficient to reduce risks and vulnerabilitiesto a reasonable and appropriate level to comply with Section 164.306(a). 13 | P a g e
  14. 14. 6. How to Conduct the Risk Assessment:Risk assessments can be conducted using many different methodologies. There is no single methodology that will workfor all organizations and all situations. The following steps represent key elements in a comprehensive risk assessmentprogram, and provide an example of the risk assessment methodology described in NIST SP 800-30. It is expected thatthese steps will be customized to most effectively identify risk for an organization based on its own uniqueness. Eventhough these items are listed as steps, they are not prescriptive in the order that they should be conducted. Some stepscan be conducted simultaneously rather than sequentially.1. Scope the Assessment. The first step in assessing risk is to define the scope of the effort, resulting in ageneral characterization of the information system, its operating environment, and its boundary. To do this, it isnecessary to identify where EPHI is created, received, maintained, processed, or transmitted.The scope of a risk assessment should include both the physical boundaries of a covered entity’s location as well as alogical boundary covering the media containing EPHI, regardless of its location. Ensure that the risk assessment scopetakes into consideration the remote work force and telecommuters, and removable media and portable computingdevices (e.g., laptops, removable media, and backup media).2. Gather Information. During this step, the covered entity should identify:• The conditions under which EPHI is created, received, maintained, processed, or transmitted by the covered entity;and• The security controls currently being used to protect the EPHI.This step is essential to ensure that vulnerabilities and threats are correctly identified. For example, an invalidated beliefthat a policy is being followed can miss a potential vulnerability, and not knowing about portable media containing EPHIcan miss a threat to that environment. The level of effort needed to gather the necessary information depends heavilyon the scope of the assessment and the size of the covered entity.3. Identify Realistic Threats. Often performed simultaneously with step 4, Identify Potential Vulnerabilities, thegoal of this step is to identify the potential threat sources and compile a threat statement listing potential threat-sourcesthat are applicable to the covered entity and its operating environment. The listing of threat sources should includerealistic and probable human and natural incidents that can have a negative impact on an organizations ability to protectEPHI.Threats can be easily identified by examining the environments where EPHI is being used. Many external sources can beused for threat identification. Internet searches, vendor information, insurance data, and crime statistics are all viablesources of threat data. Examples of some common threat sources are listed in Table 5 below.Table 5. Common Threat Sources 14 | P a g e
  15. 15. 4. Identify Potential Vulnerabilities. Often performed simultaneously with step 3, Identify Realistic Threats,the goal of this step is to develop a list of vulnerabilities (flaws or weaknesses) that could be exploited by potentialthreat sources. This list should focus on realistic technical and nontechnical areas where EPHI can be disclosed withoutproper authorization, improperly modified, or made unavailable when needed.Covered entities should use internal and external sources to identify potential vulnerabilities. Internal sources mayinclude previous risk assessments, vulnerability scan and system security test results, and audit reports. Externalsources may include Internet searches, vendor information, insurance data, and vulnerability databases such as theNational Vulnerability Database ( Assess Current Security Controls. Often performed simultaneously with step 2, Gather Information, thepurpose of this step is to determine if the implemented or planned security controls will minimize or eliminate risks toEPHI. A thorough understanding of the actual security controls in place for a covered entity will reduce the list ofvulnerabilities, as well as the realistic probability, of a threat attacking (intentionally or unintentionally) EPHI. Coveredentities should evaluate technical and nontechnical security controls at all places where EPHI is created, received,maintained, processed, or transmitted. This evaluation should determine whether the security measures implementedor planned are adequate to protect EPHI, and whether those measures required by the Security Rule are in place,configured, and used properly. The appropriateness and adequacy of security measures may vary depending on thestructure, size, and geographical dispersion of the covered entity.6. Determine the Likelihood and the Impact of a Threat Exercising a Vulnerability. The nextmajor step in measuring the level of risk is to determine the likelihood and the adverse impact resulting from a threatsuccessfully exploiting a vulnerability. This information can be obtained from existing organizational documentation,such as business impact and asset criticality assessments. A business impact assessment prioritizes the impact levelsassociated with the compromise of an organization’s information assets based on a qualitative or quantitativeassessment of the sensitivity and criticality of those assets. An asset criticality assessment identifies and prioritizes thesensitive and critical organization information assets (e.g., hardware, software, systems, services, and related technologyassets) that support the organization’s critical missions. If these organizational documents do not exist, the system anddata sensitivity can be determined based on the level of protection required to maintain the EPHI’s confidentiality,integrity, and availability. The adverse impact of a security event can be described in terms of loss or degradation ofany, or a combination of any, of the following three security objectives: integrity, availability, and confidentiality. Table6 provides a brief description of each security objective and the consequence (or impact) of its not being met. 15 | P a g e
  16. 16. Table 6. Security Objectives and ImpactsSome tangible impacts can be measured quantitatively in terms of lost revenue, the cost of repairing the system, or thelevel of effort required to correct problems caused by a successful threat action. Other impacts, such as the loss ofpublic confidence, the loss of credibility, or damage to an organization’s interest, cannot be measured in specific unitsbut can be qualified or described in terms of high, medium, and low impacts. Qualitative and quantitative methods canbe used to measure the impact of a threat occurring7. Determine the Level of Risk. The purpose of this step is to assess the level of risk to the IT system. Thedetermination of risk takes into account the information gathered and determinations made during the previous steps.The level of risk is determined by analyzing the values assigned to the likelihood of threat occurrence and resultingimpact of threat occurrence. The risk-level determination may be performed by assigning a risk level based on theaverage of the assigned likelihood and impact levels. A risk-level matrix, such as the sample depicted in Table 7, can beused to assist in determining risk levels. 16 | P a g e
  17. 17. Table 7. Sample Risk-Level Matrix8. Recommend Security Controls. During this step, security controls that could mitigate the identified risks, asappropriate to the organization’s operations, are recommended. The goal of the recommended controls is to reducethe level of risk to the IT system and its data to an acceptable level. Security control recommendations provide input tothe risk mitigation process, during which the recommended security controls are evaluated, prioritized, andimplemented.It should be noted that not all possible recommended security controls can be implemented to reduce loss. Todetermine which ones are required and appropriate for a specific organization, a cost-benefit analysis should beconducted for the proposed recommended controls, to demonstrate that the costs of implementing the controls can bejustified by the reduction in the level of risk.In addition to cost, organizations should consider the operational impact and feasibility of introducing therecommended security controls into the operating environment.9. Document the Risk Assessment Results. Once the risk assessment has been completed (threat sourcesand vulnerabilities identified, risks assessed, and security controls recommended), the results of each step in the riskassessment should be documented. NIST SP 800-30 provides a sample risk assessment report outline that may proveuseful to covered entities.Risk Assessment Results Affect Risk ManagementThe results of a risk assessment play a significant role in executing an organization’s risk management strategy. In thecontext of the HIPAA Security Rule, the security control baseline, which consists of the standards and requiredimplementation specifications, should be viewed as the foundation or starting point in the selection of adequatesecurity controls necessary to protect EPHI. In many cases, additional security controls or control enhancements will beneeded to protect EPHI or to satisfy the requirements of applicable laws, policies, standards, or regulations.The risk assessment provides important inputs to determine the sufficiency of the security control baseline. The riskassessment results, coupled with the security control baseline, should be used to identify which addressableimplementation specifications should be implemented to adequately mitigate identified risks. 17 | P a g e
  18. 18. Identification and Categorization of Information Types in RLK SystemWe have identified the information types and assigned a category number on a scale of 1 to 5 according to themagnitude of harm resulting were the system to suffer a compromise of Confidentiality, Integrity, or Availability. NIST SP800-60 provides a catalog of information types, and FIPS-199 provides a rating methodology and a definition of thethree criteria. The overall FIPS-199 system categorization is the high water mark of the impact rating of all the criteria ofall information types resident in the system.Category 0-1 -- The potential impact is LOW if—− The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizationaloperations, organizational assets, or individuals.AMPLIFICATION: A limited adverse effect means that, for example, the loss of confidentiality, integrity, or availabilitymight: (i) cause a degradation in mission capability to an extent and duration that the organization is able to perform itsprimary functions, but the effectiveness of the functions is noticeably reduced; (ii) result in minor damage toorganizational assets; (iii) result in minor financial loss; or (iv) result in minor harm to individuals.Category 2-3 -- The potential impact is MODERATE if—− The loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizationaloperations, organizational assets, or individuals.AMPLIFICATION: A serious adverse effect means that, for example, the loss of confidentiality, integrity, or availabilitymight: (i) cause a significant degradation in mission capability to an extent and duration that the organization is able toperform its primary functions, but the effectiveness of the functions is significantly reduced; (ii) result in significantdamage to organizational assets; (iii) result in significant financial loss; or (iv) result in significant harm to individuals thatdoes not involve loss of life or serious life threatening injuries.Adverse effects on individuals may include, but are not limited to, loss of the privacy to which individuals are entitledunder law.FIPS Publication 199 Standards for Security Categorization of Federal Information and Information SystemsCategory 4-5 -- The potential impact is HIGH if—− The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effecton organizational operations, organizational assets, or individuals.AMPLIFICATION: A severe or catastrophic adverse effect means that, for example, the loss of confidentiality, integrity, oravailability might: (i) cause a severe degradation in or loss of mission capability to an extent and duration that theorganization is not able to perform one or more of its primary functions; (ii) result in major damage to organizationalassets; (iii) result in major financial loss; or (iv) result in severe or catastrophic harm to individuals involving loss of life orserious life threatening injuries 18 | P a g e
  19. 19. Selection of Security Controls for SystemDuring the design and implementation life-cycle phase, a set of security controls must be selected and incorporated intothe system implementation. NIST SP 800-53 provides a catalog of security controls in Special Publication 800-53,Revision 2 the following chart is a small sample of the security controls recommended, along with the control baselines. 19 | P a g e
  20. 20. The following specific example shows the criteria for determining control baselines:Implementing and Documentation of the SystemPertinent system information such as system boundaries, information types, constituent components, responsibleindividuals, description of user communities, interconnections with other systems and implementation details for eachsecurity control need to be documented in the system security plan. NIST SP 800-18 Rev 1 gives guidance ondocumentation standards. Additional documentation such as a contingency plan for the system also needs to beprepared at this stage. Guidance on contingency planning can be found in NIST SP 800-34.Performing Risk AssessmentOnce the controls implementation are documented, a risk assessment can be performed. A risk assessments starts byidentifying potential threats and vulnerabilities, and maps implemented controls to individual vulnerabilities. One thendetermines risk by calculating the likelihood and impact of any given vulnerability being exploited, taking into accountexisting controls. The culmination of the risk assessment shows the calculated risk for all vulnerabilities, and describeswhether the risk is to accepted or mitigated. If mitigated, one needs to describe what additional SP 800-53 controls willbe added to the system. NIST SP 800-30 provides guidance on the risk assessment process.Certification of SystemOnce the system documentation and risk assessment is complete, the system needs to have its controls assessed andcertified to be functioning appropriately. For systems with a FIPS-199 categorization of Low, a self-assessment issufficient for certification. For systems categorized at higher FIPS-199 levels, a certification performed by anindependent 3rd party is required. NIST SP 800-26 provides guidance on the self-assessment process. NIST SP 800-53Aprovides guidance on the assessment methods applicable to individual controls. 20 | P a g e
  21. 21. Accreditation (Authorization) of SystemOnce a system has been certified, the security documentation package is reviewed by an accrediting official, who, ifsatisfied with the documentation and the results of certification, accredits the system by issuing an authorization tooperate. This authorization is usually for a 3 year period, and may be contingent on additional controls or processesbeing implemented. NIST SP 800-37 provides guidance on the certification and accreditation of systems.7. Ongoing Maintenance All accredited systems are required to monitor a selected set of security controls for efficacy, and the system documentation is updated to reflect changes and modifications to the system. Significant changes to the security profile of the system should trigger an updated risk assessment, and controls that are significantly modified may need to be re-certified. Guidance on continuous monitoring can be found in NIST SP 800-37 and SP 800-53A.The security controls defined in Special Publication 800-53 (as amended) and recommended for use by organizations inprotecting their information systems should be employed in conjunction with and as part of a well-defined anddocumented information security program. An effective information security program should include:Periodic assessments of risk, including the magnitude of harm that could result from the unauthorized access, use,disclosure, disruption, modification, or destruction of information and information systems that support the operationsand assets of the organization;Policies and procedures that are based on risk assessments, cost-effectively reduce information security risks to anacceptable level and address information security throughout the life cycle of each organizational information system;Plans for providing adequate information security for networks, facilities, information systems, or groups ofinformation systems, as appropriate;Security awareness training to inform personnel (including contractors and other users of information systems thatsupport the operations and assets of the organization) of the information security risks associated with their activitiesand their responsibilities in complying with organizational policies and procedures designed to reduce these risks;Periodic testing and evaluation of the effectiveness of information security policies, procedures, practices, and securitycontrols to be performed with a frequency depending on risk, but no less than annually;A process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in theinformation security policies, procedures, and practices of the organization;Procedures for detecting, reporting, and responding to security incidents; andPlans and procedures for continuity of operations/disaster recovery for information systems that support theoperations and assets of the organization. A plan will be developed using the following process: 21 | P a g e
  22. 22. Continuity BIA Identify Develop policy Preventative recovery Controls strategies -Identify critical functions -Business process -Integrate law and regulation -Identify critical resources -Implement -Facility requirements controls -Calculate MTD -Supply and -Define the scope, for resources technology goals, and roles -Mitigate risk -Identify threats -User and user -Management environment approves policy -Calculate risks -Data -Identify backup solutions Develop Exercise test Maintain BCP drill BCP -Integrate into change control Document process -Procedures -Test plan -Recovery -Assign solutions -Improve plan responsibility -Roles and tasks -Train employees -Emergency -Update plan response -Distribute after updating 8. Proposed SolutionThe above Framework of risk identification, security controls and mitigation procedures, when scoped to the particularneeds and applied to the specific operation of RLK Products, is designed to provide an acceptable level of data assuranceas well as meeting Federal Government and HIPAA requirements and guidelines. 22 | P a g e