Difference between revisions of "Information security"

Latest revision as of 20:15, 28 April 2015

Information security is maintaining confidentiality and availability simultaneously. Information should be hidden, safe, private, and also ready for immediate use.

Introduction

Computer equipment that handles or stores information needs to be protected from harm or unauthorized intrusion. Computer hardware, software, and tthe data stored on these systems is always potentially at risk. Information, especially medical information that is confidential, non-replaceable, or whose loss of would cost time and money must be protected from a variety of threats. The most common threats are natural disasters and hazards, computer failures, media failures, malicious attacks, and sometimes, ourselves.

If you look up the definition of “Information Security” on the Web, you will find a host of different interpretations (see below), many of them with questionable foundations. Strangely enough, the US Code probably contains the best definition:

US Code Title 44, Chapter 35, Subchapter III, § 3542^[1]

(1) The term “information security” means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

    (A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity; 
    (B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and 
    (C) availability, which means ensuring timely and reliable access to and use of information.

This definition is based on the concept that a person, business or government will suffer harm if there is a loss of confidentiality, integrity or availability of information and that it is the role of information security to minimize the possibility that such harm will occur. Other commentators have tried to expand on this approach and argued that other elements should be added (see CERT^[2] and Donn Parker^[3]). These expansive approaches tend to create a confusing definition that detracts the user from focusing on harm or risk. In effect, they over complicate the issue. ^[4]

Information Security Goals

The four (4) primary goals of information security are:

1. Confidentiality
2. Integrity
3. Availability
4. Non-repudiation.

(Accomplishing these is a management issue before it's a technical one, as they are essentially business objectives.)

Confidentiality is about controlling access to files either in storage or in transit. This requires systems configuration or products (a technical job). But the critical definition of the parameters (who should be able to access what) is a business-related process.

Integrity is a matter of version control - making sure only the right people can change documents. It also requires an audit trail of the changes, and a fallback position in case changes prove detrimental. This meshes with non-repudiation (the change record must include who as well as what and when).

Availability is the Cinderella of information security as it is rarely discussed. But however safe from hackers your information is, it is no use if you can't get at it when you need to. So you need to think about data back-ups, bandwidth and standby facilities, which many people still leave out of their security planning.^[5]

Electronic medical record security

Pros

EHRs can provide great privacy and security, e.g.,

• Access controls can be more granular
• Authentication mechanisms provide audit trails and non-repudiation
• Disaster recovery plans assure greater availability
• Encryption can provide confidentiality and data integrity

Cons

• Information flows more easily, risk of mishap is greater
• Collection of large volumes of data more feasible and risky
• Sharing of information for treatment, payment, and operations misunderstood
• New methods to attack data are continuously being developed

Flow of information in health care have many points to “leak”

Direct patient care:

• Provider / Primary Care physician
• Clinic Personnel/ Medical Staff
• Hospital Admissions
• Patient
• Insurance company
• Researchers
• Employees / other hospital employees

Support activity:

• Payers
• Quality reviews
• Administration

“Social” uses:

• Insurance eligibility
• Public health
• Medical research

Commercial uses:

• Marketing
• Managed care
• Drug usage

NB: Even de-identified data is not necessarily secure

The Shields:

1-Risk assessment

We should balance :

• risk,
• benefit,
• cost and
• loss of accessibility

2-Access Restriction

• Authentication
• Access Control
• Accounting

Security Policies

We should set documented:

• goals
• procedures
• organization
• responsibilities

Technologies to secure information:

Deterrents

• Alerts
• Audit trails

System management precautions

-Software management

-Analysis of vulnerability

Obstacles

• Authentication
• Authorization
• Integrity management
• Digital signatures
• Encryption
• Firewalls
• Rights management

Conclusion

The threats are real and dangerous and recovery costs are large. We must shield ourselves in as many ways as possible with a reasonable loss of accessibility

References

1. ↑ US Code, http://www.law.cornell.edu/uscode/text/44/3542/
2. ↑ US CERT WebPage, https://www.us-cert.gov/
3. ↑ Donn Parker Biography, http://computer.org/computer-pioneers/pdfs/P/Parker%20Donn.pdf
4. ↑ US Code Title 44, http://www.law.cornell.edu/uscode/text/44/3542
5. ↑ Barwise, M. Four Goals of Security. http://www.computerweekly.com/opinion/Four-goals-of-security

1. Introduction to Biomedical Informatics, William Hersh; 2007
2. EHRs/NHII: HIPAA Security and EHRs, a Near Perfect Match by: Margret Amatayakul, RHIA, CHPS, FHIMSS Steven S. Lazarus, PhD, FHIMSS
3. Privacy, information technology, and health care, Thomas C. Rindfleisch;1997.