Database security assessment. Overview for the Vendors
As a security architect and cryptography specialist for Superior Health Care, you're familiar with the information systems throughout the company and the ranges of sensitivity in the information that is used, stored and transmitted. You're also expected to understand health care regulations and guidelines because you're responsible for advising the chief information security officer, or CISO, on a range of patient services, including the confidentiality and integrity of billing, payments, and insurance claims processing, as well as the security of patient information covered under the Health Insurance Portability and Accountability Act, or HIPAA.
You also have a team of security engineers, SEs, that help implements new cryptographic plans and policies and collaborates with the IT deployment and operations department during migrations to new technology initiatives. This week, the CISO calls you into his office to let you know about the company's latest initiative.
"We're implementing eFi, web-based electronic health care, and that means we need to modernize our enterprise key management system during the migration,” he says. The CISO asks for an enterprise key management plan that identifies the top components, possible solutions, comparisons of each solution, risks and benefits, and proposed risk mitigations.
Step 1: Provide an Overview for Vendors
As the contracting officer's technical representative (COTR), you are the liaison between your hospital and potential vendors. It is your duty to provide vendors with an overview of your organization. To do so, identify information about your hospital. Conduct independent research on hospital database management. Think about the hospital's different organizational needs. What departments or individuals will use the Security Concerns Common to All RDBMS, and for what purposes?
Step 2: Provide Context for the Work
Now that you have provided vendors with an overview of your hospital's needs, you will provide the vendors with a context for the work needed.
Since you are familiar with the application and implementation, give guidance to the vendors by explaining the attributes of the database and by describing the environment in which it will operate.
It is important to understand the vulnerability of a relational database management system (RDBMS). Read the following resources about RDBMSs.
error handling and information leakage
insecure handling
cross-site scripting (XSS/CSRF) flaws
SQL injections
memory leakage
insecure configuration management
Provide an overview including the types of data that may be stored in the system and the importance of keeping these data secure. Include this information in the RFP.
Step 3: Provide Vendor Security Standards
In the previous step, you added context for the needed work. Now, provide a set of internationally recognized standards that competing vendors will incorporate into the database. These standards will also serve as a checklist to measure security performance and security processes.
Read the following resources to prepare:
Database Models
Common Criteria (CC) for information technology security evaluation
evaluated assurance levels (EALs)
continuity of service
Address the concepts and issues with respect to disasters and disaster recovery, mission continuity, threats, and cyberattacks.
Include these security standards in the RFP.
Step 4: Describe Defense Models
Now that you have established security standards for the RFP, you will define the use of defense models. This information is important since the networking environment will have numerous users with different levels of access.
Provide requirements in the RFP for the vendor to state its overall strategy for defensive principles. Explain the importance of understanding these principles. To further your understanding, click the link and read about defensive principles.
Read these resources on enclave computing environment:
enclave/computing environment
cyber operations in DoD policy and plans
Explain how enclave computing relates to defensive principles. The network domains should be at different security levels, have different levels of access, and different read and write permissions.
Define enclave computing boundary defense.
Include enclave firewalls to separate databases and networks.
Define the different environments you expect the databases to be working in and the security policies applicable.
Provide this information in the RFP.
Step 5: Provide a Requirement Statement for System Structure
In the previous step, you identified defense requirements for the vendor. In this step of the RFP, you will focus on the structure of the system.
Provide requirement statements for a web interface to:
Allow patients and other healthcare providers to view, modify, and update the database.
Allow integrated access across multiple systems.
Prevent data exfiltration through external media.
State these requirements in the context of the medical database. Include this information in the RFP.
Step 6: Provide Operating System Security Components
In the previous step, you composed requirement statements regarding the system setup. In this step, you will provide the operating system security components that will support the database and the security protection mechanisms.
Read these resources on operating system security. Then:
Provide requirements for segmentation by operating system rings to ensure processes do not affect each other.
Provide one example of a process that could violate the segmentation mechanism. Ensure your requirement statements prevent such a violation from occurring.
Specify requirement statements that include a trusted platform module (TPM), in which a cryptographic key is supplied at the chip level. In those specifications:
Describe the expected security gain from incorporating TPM.
Provide requirement statements that adhere to the trusted computing base (TCB) standard.
Provide examples of components to consider in the TCB.
Provide requirements of how to ensure the protection of these components, such as authentication procedures and malware protection.
Read the following resources to familiarize yourself with these concepts:
trusted computing
trusted computing base
Include this information in the RFP.
In the following step, you will write requirements for levels of security.
Step 7: Write Requirements for Multiple Independent Levels of Security
The previous step required you to identify operating system security components to support the database. For this step, you will focus on identification, authentication, and access. Access to the data is accomplished using security concepts and security models that ensure the confidentiality and integrity of the data. Refer to access control and authentication to refresh your knowledge.
Step 8: Include Access Control Concepts, Capabilities
In the previous step, you wrote requirements for multiple levels of security, including the topics of identification, authentication, and access. In this step, you will focus on access control. The vendor will need to demonstrate capabilities to enforce identification, authentication, access, and authorization to the database management systems.
Include requirement statements in the RFP that the vendor must identify, the types of access control capabilities, and how they execute access control.
Provide requirement statements for the vendor regarding access control concepts, authentication, and direct object access.
Include the requirement statements in the RFP.
In the next step, you will incorporate additional security requirements and request vendors to provide a test plan.
The healthcare database should be able to incorporate multiple independent levels of security (MILS) because the organization plans to expand the number of users.
Write requirement statements for MILS for your database in the RFP.
Include the definitions and stipulations for cybersecurity models, including the Biba Integrity Model, Bell-LaPadula Model, and the Chinese Wall Model.
Indicate any limitations for the application of these models.
Read the following resources and note which cybersecurity models are most beneficial to your database:
multiple independent levels of security (MILS)
cybersecurity models
insecure handling
Include requirement statements for addressing insecure handling of data.
Include this information in your RFP.
Step 9: Include Test Plan Requirements
In the previous step, you defined access control requirements. Here, you will define test plan requirements for vendors.
Incorporate a short paragraph requiring the vendor to propose a test plan after reviewing these guidelines for a test and remediation results (TPRR) report.
Provide requirements for the vendor to supply an approximate timeline for the delivery of technology.
Note: In text-citation, end product and time of delivery is very important for this paper. Thank you
Database Security Assessment
Institution Affiliation
Students Name
Course
Date
Database Security Assessment
Overview for the Vendors
The National Military Hospital is an American based academic health center and also the leader for the military medical readiness. The mission of the National Military Hospital is providing care for those that are privileged to serve and supports military beneficiaries and lead the world through transforming the teaching and practices of military medicine. The National Military Hospital cannot continue to provide excellence and quality care to their patients if they cannot ensure the security and availability of their patient’s Protected Health Information (PHI) (Snell, 2016). NMH in collaboration with their System Security Engineers (SSEs) Team is seeking proposals to transition all health records to a new medical healthcare database management system to maintain Electronic Health Records (EHR). There is an urgent need to transition all health records to Electronic Health Records (EHR) due to the recent cyber-attacks on the Healthcare Industry.
Database are usually considered to be the foundation to any use of information and this Request for Proposal (RFP) will represent a request for estimates on performing, delivering the tech, and giving service. The RFP will tailor to each endeavor and is imperative in the world of IT contracting and acquisitions. The SSEs will determine the security specifications for the medical healthcare database management systems. The RFP will outline the requirements for the system and give a standard applied in weighing the performance of the vendors. The research will be done by the Security System Engineers to discover the different methods of attack, prevention and what the potential vendors require.
The overall data on the medical healthcare database management system will be confidential and sensitive and contain Personal Identifiable Information (PII) and PHI. It is incredibly important for this data to be protected through compliance requirements, so it remains confidential and available to authorized personnel. Also, PHI data is considered more valuable to cybercriminals than PII and therefore it needs to be safeguarded due to it being highly sought after and the sensitive nature of the data to patients. Patients need to be able to rely on the National Military Hospital ensuring the confidentiality, availability, and integrity of their PHI (Snell, 2016). The National Military Hospital is determined to prevent a cyber-attack or data loss and will continue to make it their highest mission to help their patients.
The context for the work
The hospital information system (HIS) will maintain databases for patient registration, centralized storage of patient information, order entry, management of charges and billing, patient arrivals and procedure management, and will maintain the master patient index (MPI). The database attributes will include data fields for patient name, date of birth, ethnicity, gender, address, alias, SSN, service type. The functional requirements are detailed below.
The Health Insurance Portability need the care givers and any of their business associate which transmits the health data in electronic form to protect it from any reasonably anticipated threat to the security or integrity of the data. Security insurance means that the level of confidence which the security requires of a system are met and can be met by using one of the seven Evaluation Assurance Levels for functional security requirements.
Vendor Security Standards
Every vendor is required to address the areas of Database and system Security and is also needed to abide with the federal regulations so that they can incorporate the Federal Information Security Modernization Act (Cobb, 2013). FISMA needs that every federal agency to come up with, document and make implementation of an agency-wide program to provide data information security for the information security and the systems which support the operations. Because this is a medical facility for the military it falls under the common criteria and evaluated assurance level.
The common criteria are considered to be an international standard for the computer security set up to evaluate IT systems and determine the level at which the system and resources are protected. Common Criteria was created by six countries to help engineers in evaluating a specific system against a set of already defined security requirements. Vendors must complete a Security Target description to get a product evaluated. A Security Target may claim that the target product conforms to one or many of the Protection Profiles. The target will be evaluated through the Security Functional Requirements in its Security Target. The process gives the vendor of the product to tailor it to the intended capabilities. In the Evaluated assurance level, it is the process through which the Security Assurance Requirements try to come up with a level of confidence for their products (Dark & Andrrews, 2012). The Evaluated Assurance Level is the part of the CC method of ranking the IT product or systems and determining at which level they are being tested. The ranking is done on a scale of 1-7, with 1 as the lowest and 7 the highest. The higher the level, the more confidence the consumer can have in the product and that its functional security needs have been achieved.
Defense Models
The following list provides several examples of best practices for hardening the physical and logical security of databases (Dark & Andrrews, 2012). Maintaining database hardening best practices will help the healthcare organization store HIPAA data, as well as prevent general loss data or unauthorized access to the database.
Physical database Security
The first line of defense, when properly securing a database, is improving the physical security of the database hardware. The hardware should be stored in a secured, locked and monitored space. By doing so, database administrators (DBAs) can control access to the hardware; preventing unauthorized entry to space, theft, or physical damage. The database server should also be partitioned from any application or web servers the organization may be running on the network.
Firewalls
Databases must also be protected on the logical network. Industry best practices call for database servers to be located behind a firewall. No one other than DBAs should have access to the database server (Hamidovic, 2012). As such, the firewall’s rules should be set to deny all non-DBA traffic by default. If the server is needed for daily operations, such as an established connection between the database and a web server, then the DBA must maintain a whitelist of devices and users with approved access.
Database Software
Often overlooked, the database software must always be updated. Software updates contain security patches and bug fixed that are identified by the developers as potential sources for network vulnerabilities (Dark & Andrrews, 2012). Additionally, all unused functions of the software must be removed or turned off. Limiting the database to only what is necessary for operations prevents unwanted misuse of the database. Password security is also of vital importance to database security. It is the responsibility of the DBA to change all default passwords stored in the database, as well as maintain a password log.
Application/Web Servers
Should the database be used in daily operations, such as by establishing and maintaining a secure connection to a web server, all endpoint systems must meet the minimum-security threshold maintained on the database server. Should the endpoint system become compromised, there can be no means by which an attacker can hop from an application or web server to the database server. Particularly in the healthcare industry, such an event would be catastrophic and expose thousands of sensitive patient medical records to the attack.
Requirement Statement for System Structure
Requirement Statement for System Structure will help to explain better the database and its web input interface, which health care providers and patients will use to take a look at the data, obtain, modify and update the information in the data that is in the database. This document is directed to all the participants within the hospital sector staff, patients, doctors, and developers. The main objective of the software is to take in information that is provided by patients and keeps its hospital database (Cobb, 2013). The stored data is to be used to keep track of the interaction of doctors with their patients who are affiliated to that hospital. After a unique patient number is generated for the patient at the end of the process, it is then used in for future visits from that individual. The system will also keep track of the count of the patients, and also giving a current up to date state of how the organization is running. Financial experts to create a budget for the upcoming years will then use the information gathered from that. Requirements statement will then include the results of both system and business analysis efforts. Further detail will now be provided for the user characteristics, general constraints, description of the product, as well any assumptions for the system.
This system will perform multiple functions related to the healthcare services that are being provided by the hospital (Cardon, 2018). It gives patients the ability to contact the authorities, find a suitable doctor, and make appointments as well as provide services for someone seeking a job at th...
👀 Other Visitors are Viewing These APA Essay Samples:
-
A risk management cost benefit analysis (SAR). IT Research Paper
12 pages/≈3300 words | 10 Sources | APA | IT & Computer Science | Research Paper |
-
Cyber security Incident Report, Executive Briefing and Summary
11 pages/≈3025 words | 7 Sources | APA | IT & Computer Science | Research Paper |
-
Enterprise Network security. Executive summary. Research Paper
12 pages/≈3300 words | 8 Sources | APA | IT & Computer Science | Research Paper |