IT Security and Compliance Program Plan for Maxistar Medical Supplies Company

IT Security and Compliance Program Plan for Maxistar Medical Supplies Company
IT Security and
Compliance Program
Plan for Maxistar
Medical Supplies
Company
IT Security and Compliance Program for PCI, HIPAA and NIST
standards as applicable to the Maxistar Medical Supplies
Company’s IT operations. This paper was created as part of a case
study for CYBS 6355 in the spring 2015 semester at the University
of Dallas.
James Konderla
3/18/2015
0 | P a g e

Table of Contents
Executive Summary.......................................................................................................................................1
Known Risks and Priorities............................................................................................................................2
Risk 1: Flat Network Topology ..................................................................................................................2
Risk 2: Consolidated Server Functions......................................................................................................3
Risk 3: Database Encryption......................................................................................................................5
Implementing a Risk Management Framework............................................................................................6
The New Security Program ...........................................................................................................................8
Conclusion...................................................................................................................................................13
References ..................................................................................................................................................14
Table of Figures
Figure 1, Bedford Site Topology....................................................................................................................2
Figure 2, Proposed Network Topology for Bedford Site...............................................................................3
Figure 3, Current Server Layout....................................................................................................................4
Figure 4, Virtualized Server Layout...............................................................................................................4
Figure 5, PCI Data Storage Guidelines (PCI, 2008)........................................................................................5
Figure 6, NIST Risk Management Approach..................................................................................................6
Figure 7, Security Life Cycle ..........................................................................................................................7

Executive Summary
As Maxistar Medical Supplies Company grows and expands operations it becomes increasingly
important to keep IT operations secure while also enabling the business to quickly and effectively meet
customer needs. During a recent assessment Maxistar identified several changes that needed to be
implemented to their IT operations to secure their business to align with regulatory and legal
compliance for the Payment Card Industry (PCI), HIPAA, and NIST 800-53 standards. As part of this
assessment, several known risks were identified and 5 areas specifically were targeted as the beginning
of Maxistar’s Security and Compliance program. This document will outline those risks as well as the
guidelines for our plan to bring Maxistar into compliance with these three key standards. We will do this
by addressing the following topics:
• List of Known risks and Major Priorities
• Implementation of a Risk Management Framework
• Overview of the new IT Security Strategy
• Overview and guidelines of the IT Compliance Strategy
1 | P a g e

Known Risks and Priorities
As part of our initial assessment of Maxistar’s current IT Security state we were given exclusive
access to the entire IT Operation. Due to this access we were able to determine that there are 3 major
risk areas that Maxistar must initially address to both align with PCI, HIPAA and NIST standards and to
secure their network in the interim as the compliance program rolls out.
Risk 1: Flat Network Topology
As seen below, Maxistar has a somewhat flat network architecture with only 1 firewall (per site)
protecting the network from external environments. This architecture is not just seen at the Bedford
site, but is repeated at every site and presents an easy target for external entities, allowing them to
traverse the network as easy as the IT group.
Figure 1, Bedford Site Topology
Due to this, we suggest that Maxistar implement a layered topology, also known as “Defense in
Depth”. As seen below, this topology places a secondary firewall between the central network and the

externally-exposed machines. This approach allows the IT assets that need to be accessed externally to
still be accessed but keeps attackers from traversing the corporate network as well, effectively
segregating the systems that should not be accessed externally.
Figure 2, Proposed Network Topology for Bedford Site
As each firewall acts as a router, it is suggested that the Demilitarized Zone (DMZ) between the
2 firewalls be separated from the internal network by a separate Virtual LAN (VLAN) to further
complicate any attempts by external entities to traverse beyond the DMZ. The performance decreases
by implementing this topology should be minimal, if they are even noticed.
Risk 2: Consolidated Server Functions
Maxistar’s current network infrastructure has functioned for many years using a “consolidated”
roles type infrastructure for their servers, as seen below.

Physical Server
First Role
Second Role
Figure 3, Current Server Layout
While this consolidation worked well in the past it presents many potential dangers to the
enterprise: if a server sharing a customer database role and a web server role, for example, is
compromised then a customer’s data may be exposed. Our proposal is to separate the server functions
through virtualization, such as the same physical server represented below:
Physical Server
Virtual Machine
First Role
Virtual Machine
Second Role
Figure 4, Virtualized Server Layout
By separating server functions and limiting them to 1 per machine (or virtual machine) Maxistar
can negate these risks while also coming closer to compliance with PCI, HIPAA and NIST standards, as
each of these standards defines a separation of duties per server.

Risk 3: Database Encryption
One of the most noticeable shortcomings in Maxistar’s current infrastructure is the lack of
encryption on databases. While some databases, such as product information, are unencrypted with
good reason, others such as sales information, customer data or billing information should be encrypted
immediately. This is also one of the core components of PCI, HIPAA and NIST standards and should be
the primary focus as Maxistar begins converting to their new Security and Compliance program. We
recommend a minimum of 128-bit encryption on systems that contain any Personally Identifiable
Information, store sales or company-sensitive data, or contain payment information. The base
guidelines for which systems require encryption can be found in the chart below, provided by PCI
(2008).
Figure 5, PCI Data Storage Guidelines (PCI, 2008)
Of course this table also provides the guidelines for what data should and should not be stored
for PCI purposes but as PCI is the most strenuous on data storage requirements we recommend that
Maxistar follow their guidelines on both storing and encrypting data.

Implementing a Risk Management Framework
A key factor of success for any Security and Compliance program is a risk management
framework, as risks to a business cannot be properly mitigated without first being defined. A risk
management framework will enable Maxistar to combine their IT security and risk management
programs in a way that aligns to the business needs of the company while also protecting the company’s
IT infrastructure by defining the risks facing Maxistar and standardizing how those risks will be handled.
Due to the continuous changing nature of cyber threats, establishing such a framework as part of the
new security and compliance program now will save time, money and resources for current and future
threats. We have selected the NIST framework (NIST, 2014), which was created for Federal Information
Systems, as it is flexible while also providing a strong foundation for Maxistar’s new program. This
framework has a three-tiered approach to risk management, as seen below.
Figure 6, NIST Risk Management Approach
As can be seen in Figure 4, the NIST framework begins with the organization in mind. Only by
understanding and aligning IT with the business can risks fully be identified and addressed. Once IT has

aligned themselves with the business they can identify the mission and business processes involved with
keeping the business running efficiently and safely before, finally, moving on to securing the information
systems and architecture of the company. Seen below, the 3rd
Tier of the NIST framework focuses on the
“Security Life Cycle”, which guides organizations by using Architecture and Organizational inputs and
implementing a continuous feedback cycle.
Figure 7, Security Life Cycle
Continuous feedback becomes very important, allowing the continuous improvement of the
company’s risk management policies as business or architecture needs change. NIST is a very robust
framework but allows a lot of flexibility for different kinds of businesses and industries and is a perfect
choice for Maxistar.

The New Security Program
By implementing a risk management framework with a “company first” mindset we can see that
Maxistar has many steps on the way to PCI, HIPAA and NIST 800-53 compliance. To aid in this journey
two security plans were proposed and the Maxistar board decided on the later plan, outlined below.
Phase 1
Need: Eventual / Time Length: 1 Months
Overview:
This phase has Maxistar's IT Group immediately establish Encryption and Database
security controls on their databases. This phase also sees the overhaul of access
control for software and hardware systems to match employee job roles.
Steps and Requirements
1.) Immediately implement data encryption to all databases containing customer or payment
information
2.) Conduct an overhaul of access controls and limit the use of equipment, software and systems to
employees on a "least privileged" basis.
3.) Implement Emergency Access Controls to give elevated access in the event of technical or incident-
driven emergencies.
4.) Implement workstation security by increasing patching of business-critical systems to every 2
months and non business-critical systems to once a quarter.
Phase 2
Overview:
This phase sees the creation of Maxistar's Security and Compliance team, a subset of
the IT Group governed by the Chief Security Officer and responsible for auditing and
securing Maxistar's IT systems in compliance with company policies, industry
regulations and international standards in all countries and markets Maxistar
operates in.
1.) Create the IT Security and Compliance team with a minimum of 4 employees (2 domestic and 2
international) with 2 supervisory positions and 2 analyst positions.
2.) Create a standards document for Device and Media Controls with a focus on the disposal, re-use and
resell of retired technologies and media.
3.) Create a security management process with a focus on risk analysis, risk management, system
activity review and a sanction policy.
4.) Create an incident response and reporting program (may require additional employees) that focuses
on security incident response, reporting and disaster recovery procedures.
Phase 3

Overview:
This phase sees the education of Maxistar employees on the new standards and
access controls, as well as compliance and punishments for non-compliance, of the
new IT security program.
1.) Create a training program and implement training classes for the new program. This step includes
the publishing of documents on the company's intranet or in easily-accessible locations for all
employees' review.
2.) Provide notification to customers and any other required entities (state, federal or regulatory) of the
new security program.
3.) Establish a continued audit program and set schedule for the audit to occur through the new
Security and Compliance team.
Phase 4
Overview:
For the software group, this phase sees the introduction of code revision and quality
control to the group. For the hardware group this phase sees a change in the network
topology to account for an additional firewall layer and a small testing infrastructure
for both groups.
1.) SOFTWARE - Implement version control standards through GitHub Enterprise to allow easier
backout of errors and expedited documentation of changes between software patches and revisions.
2.) SOFTWARE - Implement a code review internal to the company prior to implementing code changes
to existing products or publishing new products.
3.) HARDWARE - Implement a secondary firewall with the current remaining at the perimiter (internet-
facing) infrastructure. Move the web and (optional) email servers to the zone between the two
firewalls, creating a demilitarized zone for internet-facing traffic.
4.) HARDWARE - Implement a testing infrastructure that shares access controls and a baseline with the
current infrastructure.
Phase 5
Need: Eventual / Time Length: 3-4 Months
Overview:
This phase will see the implementation of a shared knowledgebase, service catalog
and ticket tracking system in accordance with ITIL and ITSM standards.
1.) Implement a service management solution (for example HP Service Management) to allow the
access of a shared knowledgebase, service catalog and trouble/issue tracking system.
2.) Create a service catalog and corresponding website for the ordering and cataloging of IT Assets and
services.
As can be seen, this plan is aggressive and will take 10 months to roll out. This plan will focus
mainly on the implementation of the new security group, which will establish the security standards and

policies for Maxistar using the NIST risk management framework for guidance. Once this program rolls
out, the new security team will focus first on PCI compliance with HIPAA and NIST compliance also in
mind. To aide in this endeavor the security group’s first major task will be to take a baseline of
Maxistar’s current security using the PCI DSS D questionnaire for Merchants to assess how close
Maxistar is to PCI compliance. Using the answers to the questionnaire, the security group will then move
on to actually developing the new policies using the “Common Authorities on Information Assurance”
(CAIA) spreadsheet (Cloud Audit Controls, 2012). By using this spreadsheet we can see that there are
many common elements to each program and, as Maxistar moves closer to PCI compliance these
common elements can be assessed as well. Here are a few examples of how these standards can be
assessed using the CAIA to note the corresponding HIPAA and NIST standards.
Assessment Procedure
ASSESSMENT OBJECTIVE:
Pertaining to firewalls and routers: Restrict Inbound and outbound traffic to that which is
necessary for the cardholder data environment, and specifically deny all other traffic.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Examine Firewall Configurations To verify that all inbound and
outbound traffic necessary for the cardholder agreement is identifiable, that inbound
and outbound traffic is limited to that which is necessary for the cardholder data
environment, that all non-necessary inbound and outbound traffic is specifically denied
either by an explicit "deny all" rule or implicit deny after allow statement]
Compliance Elements:
NIST 800-53: SC-7
PCI DSS: 1.2.1
ASSESSMENT OBJECTIVE: Verify that file-integrity monitoring or change-detection
software has been implemented on system logs to ensure that existing log data cannot
be changed without generating alerts.

Examine: [SELECT FROM: system settings, monitored files, results from file
monitoring/change-detection activies/applications]
NIST 800-53: AU-9, AU-11, AU-14
PCI DSS: 10.5.5
ASSESSMENT OBJECTIVE: Verify that quarterly internal vulnerability scans have been
performed by qualified personnel. This includes rescans performed until all "high-risk"
vulnerabilities are resolved.
Examine: [SELECT ALL: review scan reports and verify that four quarterly internal scans
occurred in the most recent 12-month periods; Review scan reports and verify that scan
process includes rescans until all "high-risk" vulnerabilities as defined in PCI DSS
Requirement 6.1 are resolved.]
NIST 800-53: CM-3, CM-4, CP-10, RA-5, SA-7, SI-1, SI-2, SI-5
PCI DSS: 11.2.1
HIPAA: 164.308(A)(1)(I)(II)(A), 164.308(a)(1)(i)(ii)(B), 164.308(a)(5)(i)(ii)(B)
ASSESSMENT OBJECTIVE: Verify that security alerts and information are monitored,
analyzed and distributed to appropriate personnel.
Examine: [SELECT FROM: Verify that responsibility for monitoring and analyzing security
alerts and distributing information to appriate information security and business unit
management personnel is formally assigned.]
NIST 800-53: IR-2, IR-6, IR-7
PCI DSS: 12.5.2
HIPAA: 164.312(a)(6)(ii), 318.3(a)(New), 318.5(a)(New)

ASSESSMENT OBJECTIVE: Verify that all personnel are trained in a security awareness
program upon hire and at least once annually.
Examine: [SELECT FROM: Verify that the program provides multiple methods of
communicating awareness and educating personnel; verify that personnel attend
security awareness training upon hire and at least once annually]
Interview: [SELECT FROM: randomly sample personnel to verify they have completed
awareness training and are aware of the importance of cardholder security.]
NIST 800-53: AT-1, AT-2, AT-3, AT-4
PCI DSS: 12.6.1
HIPAA: 164,308(a)(5)(i), 164.308(a)(5)(ii)(A)
By using this same technique we can match the compliance elements for all 3 frameworks (PCI,
NIST and HIPAA) into a common framework to make implementation easier. Once PCI compliance has
been achieved we should have a better security posture and also be closer to meeting HIPAA and NIST
compliance as well. By using the HIPAA security risk assessment tool (HHS, 2014) we can more onto
meeting HIPAA compliance first and then finish the implementation of our security and compliance
program by qualifying for NIST certification as our last step. We plan on dedicating 1 person as the lead
on this project, who will work full time and lead the compliance efforts with the remaining security and
IT staff dedicating 20% of their time to the program with the remaining 80% focused on their normal
jobs.

Conclusion
As can be seen, Maxistar has a ways to go before they are PCI, HIPAA and NIST compliant. This
road, however, will be shorter by relying on NIST as the risk management framework for Maxistar’s new
Security and Compliance Program. After the initial 10 month rollout Maxistar’s infrastructure will run
smoother and more secure for the remaining rollout. Over the course of the final rollout, which should
take an estimated year, Maxistar will see themselves moved completely into compliance with all 3
standards. Although ideally compliance would be done at a faster rate, we must keep in mind that
Maxistar has limited resources, like every other company, and the main resources, people, will be
devoted to their own jobs. With 1 person leading the efforts and an 80/20 split between their normal
jobs and work on the compliance program Maxistar’s journey towards compliance should be smoother
than many other companies but, unlike most other companies, Maxistar will be in complete alignment
with PCI, HIPAA and NIST 800-53 standards.

References
Data Security Standard - Requirements and Security Assessment Procedures. (2013, November 1).
Retrieved March 19, 2015, from
https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf
Guide for Assessing the Security Controls in Federal Information Systems and Organizations. (2010, June
1). Retrieved March 19, 2015, from http://csrc.nist.gov/publications/nistpubs/800-53A-
rev1/sp800-53A-rev1-final.pdf
PCI Data Storage Do’s and Don'ts. (2008). Retrieved April 9, 2015, from
https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf
NIST SP800-53 R3. (2014). Retrieved April 9, 2015, from http://www.nist.gov/cyberframework/
Cloud Audit Controls. (2012). Retrieved April 9, 2015, from
http://www.cloudauditcontrols.com/2012/05/spreadsheet-iso-pci-hipaa-800-53.html
News. (2014). Retrieved April 9, 2015, from
http://www.hhs.gov/news/press/2014pres/03/20140328a.html
14 | P a g e

IT Security and Compliance Program Plan for Maxistar Medical Supplies Company

Recommended

Recommended

More Related Content

What's hot

What's hot (17)

Similar to IT Security and Compliance Program Plan for Maxistar Medical Supplies Company

Similar to IT Security and Compliance Program Plan for Maxistar Medical Supplies Company (20)

IT Security and Compliance Program Plan for Maxistar Medical Supplies Company