Upload
abdulrahman-alamri
View
135
Download
3
Embed Size (px)
Citation preview
The Security and Compliance Plan for Maxistar Medical
Supplies Company
Abdulrahman H. Alamri
Compliance and Legal Issues
Spring 2016
Table of ContentsSummary..............................................................................................................................................2
Known Risks........................................................................................................................................3
Change control process:..........................................................................................................3
Access controls:........................................................................................................................3
Flat network architecture........................................................................................................3
The company has one data center in Puerto Rico.................................................................4
No encryption of the data in the database:............................................................................4
Implementing Risk Management Framework..................................................................................5
The New Security and Compliance Programs...................................................................................7
References..........................................................................................................................................10
Table of Figures Figure 1..................................................................................................................................................5Figure 2..................................................................................................................................................6
1
Summary
Maxistar is dealing with sensitive customers’ data such as credit card and patients’
information which increases the risk for us as security professionals in the company. We have
discovered some problems in the last assessment that IT need to solve as soon as possible for
two reasons. First, Maxistar is a well-known company in the medical industry and the
company needs to be secure to satisfy its customers. Second, the company needs to comply
with the Payment Card Industry (PCI) Data Security Standards (DSS), Health Insurance
Portability and Accountability Act (HIPAA), and NIST 800-53 standards. In this documents
we have identified few known risks and we have organized this documents as the following:
List of Known Risks.
Implementation of a Risk Management Framework.
Overview of the new IT Security and compliance Strategy
2
Known Risks
Change control process:
It is important to set a clear change control process because there is a strong relation
between changing and security. Unplanned changes in the system would involve security
threats. The application development group should have clear plans and processes which also
should be approved by a committee from the risk management, Security and Compliance and
development team. That should answer at least the basic questions “who, what, when, why
and how”.
Access controls:
One of the major security threats is not implementing a strong access control method.
Actually security analysts show that about 80 percent of all malicious activities come from
current or former employees (Hirschhorn, 2007). So no employee should gain privileges
more than what he or she needs. We suggest that Maxistar implement some of the known
control access methods and processes (i.e., ACL, SOD, etc.)
Flat network architecture.
Keeping the network simple as possible is a great thing for the network director. Since
that makes it easier for him to manage and monitor the network. In the other hand, it is an
issue for security because Maxistar has only one firewall between the company’s network
and the internet. So we need a secondary firewall to create a DMZ network. That will
3
increase the security of the network and decrease the threats of unwanted access and traffic in
the network.
The company has one data center in Puerto Rico.
Single consolidating data center is a high risk for the company. Even though Maxistar
would save some money by doing so, they would also lose a lot if anything happened to the
single data center. The acceptable solution for that problem is either create more than one
data center that are geographically separated or operate some functions virtually.
No encryption of the data in the database:
The lack of the data encryption is a dangerous problem that need to be fixed as soon
as possible. A company like Maxistar that deals with health and credit card information
should encrypt their data in the database “data at rest”. This Issue is one of the important
standards of PCI which protect the data more and also help the company legally if any
cybercrime occurred.
4
Implementing Risk Management Framework
The cyber threats are always changing, so any company who wants to be in good
position to face those threats has to have a risk management framework. The risk
management framework would help the businesses to define the risks first. For Maxistar, risk
management framework would enable them to combine the IT security programs with their
risk management programs to meet the desire goal for the company. In this case we have
chosen NIST framework 2014, which is easy to use and officiant to implement Maxistar’s
new programs. There are three approaches in this framework as below:
Figure 1
As we see in the figure (1). the approaches address risk at the: (i)organization level; (ii)
mission/business process level; and (iii) information system level. The risk management will
be procced throughout the three tiers with allowing inter-tier and intra-tier communications
and feedback loop to improve the risk management. (i) the organization level provides a
5
prioritization of organizational missions/business functions. (ii) mission/business process
level defining the mission/business processes needed to support the organizational
mission’s/business functions. While (iii) information system level incorporating information
security requirements into the mission/business processes. As IT professionals our concern at
this point is Tier 3 which is the information system level. In this level we will use The Risk
Management Framework (RMF) as “security life cycle” as below:
Figure 2
Continues feedback is very important to keep assessing and managing risks. Which is what
we are going to implement at Maxistar to enhance our security and compline programs.
6
The New Security and Compliance Programs
Phase 1Need: immediately
This phase has Maxistar's IT Group immediately implement access controls for software and hardware systems based on employee job roles.
Steps:1.) Implement access control to limit the use of equipment, software and systems to employees
on a "least privileged" basis.2.) Updates of the employees’ privileged must be sent monthly from the human resources
monthly.3.) Review the access controls at least quarterly to avoid unwanted accesses.
Phase 2Need: immediately
This phase has Maxistar's IT Group immediately set a clear change control processes and polices.
Steps:1.) Create a team of four (at least) to manage the change control processes and polices.2.) Set up monthly meetings to review and approve the suggested changes. 3.) The team is responsible for setting up an emergency change plan.
Phase 3Need: Eventual
This phase has Maxistar's network team overhaul the network architecture to make it more complex and also secondary firewall.
Steps:1.) Implement a secondary firewall and separate DMZ. 2.) Move the web and email servers to the zone between the two firewalls, creating a
demilitarized zone for internet-facing traffic.3.) Implement a testing infrastructure that shares access controls and a baseline with the current
infrastructure.Phase 4
Need: Eventual
This phase Maxistar's IT Group immediately establish Encryption and Database security controls on their databases. The security and compliance team must run penetration tests and vulnerability scans
Steps:1.) Encrypt all the databases (data at rest) which include sensitive customers’ information
immediately. 2.) Run different type of tests and scans to make sure that the system is vulnerability free. 3.) Based on the test the team has to report any vulnerability or weaknesses in the system to the
management to make a decisions based on that.
7
Overview:
Overview:
Overview:
Overview:
This plan above is mainly focus on the implementation of the new security group. They are using the
NIST risk management framework to do this job based on NIST 800-53, PCI and HIPPA standards. In
order to be compliant with the NIST 800-53, PCI and HIPPA, we have chosen the following five
slandered (as required) using the “Common Authorities on Information Assurance” (CAIA)
spreadsheet. From the spreadsheet we were able to choose the common elements between NIST
800-53, PCI and HIPPA. The table below shows the chosen five that Maxistar’s needs to meet in its
journey to be compliant:
ASSESSMENT OBJECTIVE: Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Verify that access to privileged user IDs is: Assigned only to roles that specifically require such privileged access, and restricted to least privileges necessary to perform job responsibilities.].
Interview: [SELECT FROM: Interview personnel responsible for assigning access].
Compliance Elements:NIST 800-53: AC-6(4).1
PCI DSS: 7.1.1
HIPAA: 164.308(a)(3)(i)
164.308(a)(4)(i)
164.308(a)(4)(ii)(A)
164.312(a)(1)
8
ASSESSMENT OBJECTIVE: (i) Use IDS/IPS to detect and/or prevent intrusions into the network. (ii) Monitor all traffic at the perimeter of the cardholder data environment as well as at critical points in the cardholder data environment, and alert personnel to suspected compromises. (iii) Keep all intrusion-detection and prevention engines, baselines, and signatures up to date.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Examine (i) System configurations and network diagrams to make sure that IDS/IPS are in place to monitor all traffic: at the perimeter of the cardholder data environment, and at critical points in the cardholder data environment; and(ii) Vendor documentation to verify IDS/IPS techniques are configured, maintained, and updated per vendor instructions to ensure optimal protection].
Interview: [SELECT FROM: Responsible personnel to confirm techniques IDS/IPS alert personnel of suspected compromises].
Compliance Elements :
NIST 800-53 : AC-2, AC-13, AU-, 2, AU-6
PCI DSS: 4.11
HIPAA: 164.308(a)(5)(ii)(C)
ASSESSMENT OBJECTIVE: Implement a formal security awareness program to make all personnel aware of the importance of cardholder data security.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Review the security awareness program to verify it provides awareness to all personnel about the importance of cardholder data security].
Interview: [SELECT FROM: Random personnel in the organization to verify if they are aware of the importance of cardholder data security].
Compliance Elements:
NIST 800-53: AT-1
PCI DSS: 12.6
HIPAA: 164.308 (a)(5)(i)
164.308 (a)(5)(ii)(A)
9
ASSESSMENT OBJECTIVE: The organization establishes an alternate storage site including necessary agreements to permit the storage and recovery of information system backup information
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: The organization identifies an alternate storage site that is separated from the primary storage site so as not to be susceptible to the same hazards, the organization configures the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives, and the organization identifies potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
Compliance elements:NIST 800-53: CP-6
HIPAA: 164.310(a)(2)(i)
ASSESSMENT OBJECTIVE: Verify that security alerts and information are monitored, analyzed and distributed toappropriate personnel.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Verify that responsibility for monitoring and analyzing security alerts and distributing information to appropriate information security and business unit management personnel is formally assigned.]
Compliance elements:
NIST 800-53: IR-2, IR-6, IR-7
PCI DSS: 12.5.2
HIPAA: 164.312(a)(6)(ii), 318.3(a)(New), 318.5(a)(New)
10
References
An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule . (2018 , October ). Retrieved from http://csrc.nist.gov/publications/nistpubs/800-66-Rev1/SP-800-66-Revision1.pdf
Assessing Security and Privacy Controls in Federal Information Systems and Organizations. (2014 December 4). Retrieved March 11, 2016, from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf
Data Security Standard - Requirements and Security Assessment Procedures. (2013, November ). Retrieved from https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf
11