Difference between revisions of "Information security"

From Clinfowiki
Jump to: navigation, search
m (Information Security Goals)
 
(33 intermediate revisions by 5 users not shown)
Line 1: Line 1:
 +
'''Information security''' is maintaining [[confidentiality]] and availability  simultaneously. Information should be hidden, safe, private, and also ready for immediate use.
  
== '''''Introduction:''''' ==
+
== Introduction ==
  
'''Security''':” state of freedom from danger or risk”.
+
Computer equipment that handles or stores information needs to be protected from harm or unauthorized intrusion.  Computer hardware, software, and tthe data stored on these systems is always potentially at risk. Information, especially medical information that is confidential, non-replaceable, or whose loss of would cost time and money must be protected from a variety of threats. The most common threats are natural disasters and hazards, computer failures, media failures, malicious attacks, and sometimes, ourselves.
  
'''Information Security:'''  
+
If you look up the definition of “Information Security” on the Web, you will find a host of different interpretations (see below), many of them with questionable foundations. Strangely enough, the '''US Code''' probably contains the best definition:
Maintaining:
+
• Confidentiality: Keeping your information:
+
  
1. Hidden
+
'''US Code Title 44, Chapter 35, Subchapter III, § 3542'''<ref name="US Code Title 44,  Chapter 35, Subchapter III, § 3542">US Code, http://www.law.cornell.edu/uscode/text/44/3542/</ref>
  
2. Safe
+
(1) The term “information [[security]]” means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—
 +
   
 +
    (A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;
 +
    (B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and
 +
    (C) availability, which means ensuring timely and reliable access to and use of information.
  
3. Private
+
This definition is based on the concept that a person, business or government will suffer harm if there is a loss of confidentiality, integrity or availability of information and that it is the role of information security to minimize the possibility that such harm will occur. Other commentators have tried to expand on this approach and argued that other elements should be added (see CERT<ref name="CERT"> US CERT WebPage, https://www.us-cert.gov/</ref> and Donn Parker<ref name="Donn Parker"> Donn Parker Biography, http://computer.org/computer-pioneers/pdfs/P/Parker%20Donn.pdf</ref>). These expansive approaches tend to create a confusing definition that detracts the user from focusing on harm or risk. In effect, they over complicate the issue. <ref name="US Code"> US Code Title 44, http://www.law.cornell.edu/uscode/text/44/3542</ref>
  
• Availability: Making sure IT resources are:
+
==Information Security Goals==
 +
The four (4) primary goals of information security are:
  
1. Present
+
#Confidentiality
 +
#Integrity
 +
#Availability
 +
#Non-repudiation.  
 +
(Accomplishing these is a management issue before it's a technical one, as they are essentially business objectives.)
  
2. Ready for immediate use!
 
  
• Integrity: Knowing and using information that is sound and unchanged by anyone who is not authorized.
+
'''Confidentiality''' is about controlling access to files either in storage or in transit. This requires systems configuration or products (a technical job). But the critical definition of the parameters (who should be able to access what) is a business-related process.  
  
'''What do we need to protect?'''
+
'''Integrity''' is a matter of version control - making sure only the right people can change documents. It also requires an audit trail of the changes, and a fallback position in case changes prove detrimental. This meshes with non-repudiation (the change record must include who as well as what and when).
• Hardware
+
  
• Software
+
'''Availability''' is the Cinderella of information security as it is rarely discussed. But however safe from hackers your information is, it is no use if you can't get at it when you need to. So you need to think about data back-ups, bandwidth and standby facilities, which many people still leave out of their security planning.<ref name=”Barwise 2006”> Barwise, M. Four Goals of Security. http://www.computerweekly.com/opinion/Four-goals-of-security</ref>
  
• Data
+
==[[EMR|Electronic medical record]] security==
  
1. Your time
+
===Pros===
2. Your money
+
3. Confidential or non-replaceable information
+
  
      '''From whom?'''
+
EHRs can provide great privacy and security, e.g.,
  
• Natural Hazard
+
* Access controls can be more granular
• Computer Failure / Media Failure
+
* Authentication mechanisms provide audit trails and non-repudiation
• Malicious People
+
* Disaster recovery plans assure greater availability
• Sometimes, yourself
+
* Encryption can provide confidentiality and data integrity
  
'''''Information Security Goals:'''''
+
===Cons===
  
• Data Integrity
+
* Information flows more easily, risk of mishap is greater
 +
* Collection of large volumes of data more feasible and risky
 +
* Sharing of information for treatment, payment, and operations misunderstood
 +
* New methods to attack data are continuously being developed
  
• Data is correct
+
== Flow of information in health care have many points to “leak” ==
  
• No unauthorized modification
+
==Direct patient care:==
  
• Data Confidentiality
+
* Provider / Primary Care physician
 +
* Clinic Personnel/ Medical Staff
 +
* Hospital Admissions
 +
* Patient
 +
* Insurance company
 +
* Researchers
 +
* Employees / other hospital employees
  
• Only authorized parties can view
+
==Support activity:==
  
• Data Accessibility
+
* Payers
 +
* Quality reviews
 +
* Administration
  
• Authorized parties can easily and quickly access
+
==“Social” uses:==
  
• Often a casualty of information security
+
* Insurance eligibility
 +
* Public health
 +
* Medical research
  
'''''EHR security:'''''
+
==Commercial uses:==
  
'''Pros:'''
+
* Marketing
 +
* Managed care
 +
* Drug usage
  
EHRs can provide great privacy and security, e.g.,
+
NB: Even [[Identifiable Health Data|de-identified]] data is not necessarily secure
  
o Access controls can be more granular
 
  
o Authentication mechanisms provide audit trails and non-repudiation
+
==The Shields:==
  
o Disaster recovery plans assure greater availability
+
==1-Risk assessment==
  
o Encryption can provide confidentiality and data integrity
+
We should balance :
  
'''Cons:'''
+
* risk,
 +
* benefit,
 +
* cost and
 +
* loss of accessibility
  
o Information flows more easily, risk of mishap is greater
+
==2-Access Restriction==
  
o Collection of large volumes of data more feasible and risky
+
* Authentication
 +
* Access Control
 +
* Accounting
  
o Sharing of information for treatment, payment, and operations misunderstood
+
== Security Policies==
  
o New methods to attack data are continuously being developed
+
We should set documented:
  
  '''''Flow of information in health care have many points to “leak”:'''''
+
* goals
 +
* procedures
 +
* organization
 +
* responsibilities
  
'''Direct patient care:'''
+
==Technologies to secure information:==
• Provider
+
• Clinic
+
• Hospital
+
  
'''Support activity:'''
 
• Payers
 
• Quality reviews
 
• Administration
 
  
'''“Social” uses:'''
+
== Deterrents==
• Insurance eligibility
+
• Public health
+
• Medical research
+
  
'''Commercial uses:'''
+
* Alerts
• Marketing
+
* [[Audit trails]]
• Managed care
+
• Drug usage
+
  
NB: Even “de-identified” data is not necessarily secure
+
== System management precautions==
  
'''''The Shields:'''''
+
-Software management
  
'''1-Risk assessment'''
 
We should balance :
 
• risk,
 
• benefit,
 
• cost and
 
• loss of accessibility
 
 
'''2-Access Restriction'''
 
• Authentication
 
• Access Control
 
• Accounting
 
 
'''3-Security Policies'''
 
We should set documented:
 
• goals
 
• procedures
 
• organization
 
• responsibilities
 
 
'''''Technologies to secure information:'''''
 
 
'''• Deterrents'''
 
– Alerts
 
– Audit trails
 
 
'''• System management precautions'''
 
-Software management
 
 
-Analysis of vulnerability
 
-Analysis of vulnerability
  
'''• Obstacles'''
+
== Obstacles==
– Authentication
+
– Authorization
+
– Integrity management
+
– Digital signatures
+
– Encryption
+
– Firewalls
+
– Rights management
+
 
+
'''''Conclusion:'''''
+
 
+
• The threats are real and dangerous
+
 
+
• Recovery cost large
+
  
• We must shield ourselves in as many ways as possible with a reasonable loss of accessibility
+
* [[Authentication]]
 +
* Authorization
 +
* Integrity management
 +
* Digital signatures
 +
* [[Encryption]]
 +
* Firewalls
 +
* Rights management
  
'''References:'''
+
==Conclusion==
  
Introduction to Biomedical Informatics, William Hersh; 2007
+
The threats are real and dangerous and recovery costs are large. We must shield ourselves in as many ways as possible with a reasonable loss of accessibility
  
EHRs/NHII: HIPAA Security and EHRs, a Near Perfect Match by:
+
==References==
Margret Amatayakul, RHIA, CHPS, FHIMSS
+
<references/>
Steven S. Lazarus, PhD, FHIMSS
+
  
Privacy, information technology, and health care, Thomas C. Rindfleisch;1997.
+
# Introduction to Biomedical Informatics, William Hersh; 2007
+
# EHRs/NHII: HIPAA Security and EHRs, a Near Perfect Match by: Margret Amatayakul, RHIA, CHPS, FHIMSS Steven S. Lazarus, PhD, FHIMSS
Submitted by Dahlia Abd-Ellatif
+
# Privacy, information technology, and health care, Thomas C. Rindfleisch;1997.
[[category:BMI-512-W-08]]
+

Latest revision as of 20:15, 28 April 2015

Information security is maintaining confidentiality and availability simultaneously. Information should be hidden, safe, private, and also ready for immediate use.

Introduction

Computer equipment that handles or stores information needs to be protected from harm or unauthorized intrusion. Computer hardware, software, and tthe data stored on these systems is always potentially at risk. Information, especially medical information that is confidential, non-replaceable, or whose loss of would cost time and money must be protected from a variety of threats. The most common threats are natural disasters and hazards, computer failures, media failures, malicious attacks, and sometimes, ourselves.

If you look up the definition of “Information Security” on the Web, you will find a host of different interpretations (see below), many of them with questionable foundations. Strangely enough, the US Code probably contains the best definition:

US Code Title 44, Chapter 35, Subchapter III, § 3542[1]

(1) The term “information security” means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

    (A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity; 
    (B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and 
    (C) availability, which means ensuring timely and reliable access to and use of information.

This definition is based on the concept that a person, business or government will suffer harm if there is a loss of confidentiality, integrity or availability of information and that it is the role of information security to minimize the possibility that such harm will occur. Other commentators have tried to expand on this approach and argued that other elements should be added (see CERT[2] and Donn Parker[3]). These expansive approaches tend to create a confusing definition that detracts the user from focusing on harm or risk. In effect, they over complicate the issue. [4]

Information Security Goals

The four (4) primary goals of information security are:

  1. Confidentiality
  2. Integrity
  3. Availability
  4. Non-repudiation.

(Accomplishing these is a management issue before it's a technical one, as they are essentially business objectives.)


Confidentiality is about controlling access to files either in storage or in transit. This requires systems configuration or products (a technical job). But the critical definition of the parameters (who should be able to access what) is a business-related process.

Integrity is a matter of version control - making sure only the right people can change documents. It also requires an audit trail of the changes, and a fallback position in case changes prove detrimental. This meshes with non-repudiation (the change record must include who as well as what and when).

Availability is the Cinderella of information security as it is rarely discussed. But however safe from hackers your information is, it is no use if you can't get at it when you need to. So you need to think about data back-ups, bandwidth and standby facilities, which many people still leave out of their security planning.[5]

Electronic medical record security

Pros

EHRs can provide great privacy and security, e.g.,

  • Access controls can be more granular
  • Authentication mechanisms provide audit trails and non-repudiation
  • Disaster recovery plans assure greater availability
  • Encryption can provide confidentiality and data integrity

Cons

  • Information flows more easily, risk of mishap is greater
  • Collection of large volumes of data more feasible and risky
  • Sharing of information for treatment, payment, and operations misunderstood
  • New methods to attack data are continuously being developed

Flow of information in health care have many points to “leak”

Direct patient care:

  • Provider / Primary Care physician
  • Clinic Personnel/ Medical Staff
  • Hospital Admissions
  • Patient
  • Insurance company
  • Researchers
  • Employees / other hospital employees

Support activity:

  • Payers
  • Quality reviews
  • Administration

“Social” uses:

  • Insurance eligibility
  • Public health
  • Medical research

Commercial uses:

  • Marketing
  • Managed care
  • Drug usage

NB: Even de-identified data is not necessarily secure


The Shields:

1-Risk assessment

We should balance :

  • risk,
  • benefit,
  • cost and
  • loss of accessibility

2-Access Restriction

  • Authentication
  • Access Control
  • Accounting

Security Policies

We should set documented:

  • goals
  • procedures
  • organization
  • responsibilities

Technologies to secure information:

Deterrents

System management precautions

-Software management

-Analysis of vulnerability

Obstacles

Conclusion

The threats are real and dangerous and recovery costs are large. We must shield ourselves in as many ways as possible with a reasonable loss of accessibility

References

  1. US Code, http://www.law.cornell.edu/uscode/text/44/3542/
  2. US CERT WebPage, https://www.us-cert.gov/
  3. Donn Parker Biography, http://computer.org/computer-pioneers/pdfs/P/Parker%20Donn.pdf
  4. US Code Title 44, http://www.law.cornell.edu/uscode/text/44/3542
  5. Barwise, M. Four Goals of Security. http://www.computerweekly.com/opinion/Four-goals-of-security
  1. Introduction to Biomedical Informatics, William Hersh; 2007
  2. EHRs/NHII: HIPAA Security and EHRs, a Near Perfect Match by: Margret Amatayakul, RHIA, CHPS, FHIMSS Steven S. Lazarus, PhD, FHIMSS
  3. Privacy, information technology, and health care, Thomas C. Rindfleisch;1997.