Panel Cyber Security and Privacy without Carrie Waggoner

Security & Privacy PanelModerator: Jeff Livesay

MiHIN Associate Director

Security – by the numbers - redux

• Same as last year: I say a number and the person who guesses what the number refers to receives a door prize….

43 39 33 18This year’s numbers are:

The percentage of ALL 2011 security breaches in

ALL industries globally that began in healthcare

43

Source: Symantec 2012

The percentage of healthcare security breaches that begin in practices of size 1-10 providers

39

Source: HITRUST U.S. Healthcare Data Breach Trends Dec 2012

$1.50 per CC#

(PCI)

$3 per SS#

(PII)

$50 per medical record

(PHI)Source: Digital Health Conference Panel, NYC 2012

33The Black Market value ratio of Personal Health Information (PHI) to Personal Credit Information (PCI)

• The number of prioritized recommendations made in the Cyber-Security White Paper to:• Michigan’s Health Information Technology

Commission in February 2013 • Governor Snyder’s Cyber Initiative Task Force in

March 2013

18 MiHINWhite Paper

Half of these recommendations already have efforts underway in Michigan

Why are Security and Privacy so important in healthcare?

Ensuring the Security of Electronic Health Records:

http://www.youtube.com/watch?feature=player_embedded&v=BxSFS9faxI4#

http://www.youtube.com/watch?feature=player_embedded&v=BxSFS9faxI4



Introducing today’s panelists

• Dan Lohrmann, Michigan Chief Security Officer, Deputy Director, Michigan Dept. of Technology, Management & Budget Cybersecurity & Infrastructure Protection

• Brian Seggie, Chief Security Officer, MiHIN• Carrie Waggoner: Privacy Specialist, Office of Legal

Affairs, Michigan Dept. of Community Health• Allan Foster, President, Kantara Initiative; Community

VP, ForgeRock• Jeremy Rowley, Associate General Counsel, Digicert

Use of material by permission only.

Michigan Department of Technology, Management & Budget

Healthcare InformationProtecting Your Data

Dan Lohrmann, Michigan Chief Security OfficerJune 6, 2013


Global Cyber Threats . . .

10


DHS Open Source Report(www.dhs.gov/national-infrastructure-protection-plan)

11


For Example . . .

12


New Targets


Healthcare Information – Insider Threat

Louisiana . . . 7 Arrested for creating fake IDs using patient information

Florida . . . ER Clerk accessed records to sell for profit

Texas . . . State employee used immunization information to apply for credit cards

Source: Health Info Security January 2013


4 Critical Errors

#1 – Presuming that HIPAA Compliance is Security

#2 – Basing Security on Systems Rather than the Critical Data

#3 – Ineffective Awareness Program

#4 – Failure to Control Access to Information

Source: IT World, June 2009


Top 3 Threats to Healthcare Security

#1 – Malware: Computers need to be hardened with appropriate security configurations. Anti-virus and anti-spyware are not enough!

#2 – Automatic Log-off: Workers leave workstations without logging off, often in public areas. Automated log-off procedure a must!

#3 – Removable Media: USB devices enable removal of sensitive information with the click of a mouse. Know what’s on your network!

Source: Information Management Magazine Feb 2006

Trust Frameworks: Our communities shape the future of Digital Identity

Allan Foster (ForgeRock), Board of Trustee PresidentMiNIH 2013

18

Kantara Initiative: OverviewValues

Kantara Initiative - Trust Frameworks: A Global Context

Organizations, Industry and Governments join Kantara because we value:

• TrustOperating Accreditation, Approval and Certification programs

• PrivacyDeveloping privacy respecting solutions.

• SecurityDeveloping high security solutions and practices

• CommunityBridging technology and policy requirements

Trustees:

Trustees At Large:

• Government of Canada

• Terena

19

Kantara Initiative: OverviewFederation, Compliance, and Interoperability


Members join Kantara because we build trust and harmonization by developing compliance criteria based on requirements of end-users, relying parties and identity providers.

Organizations become APPROVED because we operate compliance programs for multiple solutions that fit a variety of requirements and jurisdictions.

Kantara Builds Bridges

*Non-Profit 501c6

20

Kantara Initiative: ReviewLandscape


Healthcare organizations join Kantara to leverage our community and Approval services (NIST, ICAM , etc) to advance their organizational goals.

• Healthcare provider’s identity is tied to each clinical and administrative system they use.

• Single sign-on solutions exist for some large organizations. These solutions do not necessarily scale beyond the walls of the organization.

• ‘Extended’ environment, point-to-point integration and agreements must exist between organizations in order to provide system access to individuals.

• Traditional fee-for-service healthcare delivery had little or no need for a nation wide interoperable, federated identity ecosystem.

• Incentive models are changing with the advent of Accountable Care Organizations and Community-based healthcare delivery.

21

Kantara Initiative: Overview What does a Trust Framework look like?


Trust

Input Requirements in to Kantara

Kantara and end-user

stakeholders develop criteria for assessment

Kantara Accredited Assessors

perform assessments

Relying Parties&

End-Users

Criteria for IdP / CSP Assessment

to verify Trust

22

Trust Framework Model


Registration

Verification

Assessment

Certification Process

Trust Status Listing Service

Interested Parties

Trust Status Listing Service, Registry, White List

Kantara Trust Framework:Component Services

23Kantara Initiative - Trust Frameworks: A Global Context

Credential Service Provider

Identity Proofing /

Verification

Organizational Trust

Credential Issuance /

Management

Responding to industry experts Kantara members create path to component service recognition.

Component Services: • Identity Proofing /

Verification • Credential Issuance

and Management

Kantara Trust Framework:Accredited Assessors and Approved CSPs

Kantara Accredited to LoA 1-4


Kantara Approved to LoA 3 non-crpyto

Verizon Universal Identity Service (VUIS)** ICAM Trust Framework Approval

IDPV Component RecognitionNorton Credential Service Provider *ICAM Trust Framework Approval (Conditional)

Shaping the Future of Digital Identity

Thanks!!• @kantaranews• kantarainitiative.org• kantarainitiative.org/membership/• kantarainitiative.org/listinfo/community• bit.ly/Kantara_Assurance• [email protected]


The Other Side of Security

Brian Seggie MiHIN Chief Security Officer

With all of the investments in Security…

• Technical solutions have been deployed Firewalls, Intrusion Prevention Systems, Data Loss Prevention

• Standards have been developed FIPS 140, NIST 800, ISO 27001/2

• Compliance structures have been built ISC, SANS, COBIT

• Regulations have been passed HIPAA/HITECH, PCI-DSS, SOX, GLBA

why are we still insecure?

The Other Side of Security

• Attitude• Confusion• Important data not identified• Complexity• Understaffing

Attitude – Denial of the Threat

“There are only two types of companies: those that have been hacked, and those that will be.” - FBI Director Robert Mueller, 2012

“There are only two categories of companies … those that know they’ve been compromised and those that don’t know it yet.” - US Attorney General, 2013

and more recently…

Confusion

IT staff and other users do not know what is expected of them

Identify what is important

Where should you focus your limited resources?

Complexity

Too many dissimilar systems and security policies

of organizations use network security devices from multiple vendors

reported a security breach, system outage, or both, due to complex policies

Source: Algosec 2012 survey

95%

50%

Understaffed IT Departments

• Shortcuts taken to just “keep the lights on”

• Hit-and-miss management of infrastructure

“More than two-thirds of the world's CSOs report that their current information security operations are understaffed, and that it's compromising their company's security.”Source: Frost & Sullivan for ISC(2) 2012

Thank you

Everyone here has or will be compromised, how will you respond

when it does?

Direct, Privacy, and Interstate Communication

Presented by Jeremy RowleyDigiCert, Inc.

Report to Congress on Foreign Economic Collection and Industrial Espionage from the Office of the National Counterintelligence Executive Office: “The massive R&D costs for new [Healthcare] products in these sectors, up to $1 billion for a single drug, the possibility of earning monopoly profits from a popular new pharmaceutical, and the growing need for medical care by aging populations in China, Russia, and elsewhere are likely to drive interest in collecting valuable US healthcare, pharmaceutical, and related information.”

The HIMSS Privacy and Security Committee goal: "By 2014, all entities who use, send, or store health information meet requirements for confidentiality, integrity, availability and accountability based on sound risk management practices, using recognized standards and protocols."

NHIN Project Statement: “A project to create the set of standards and services that, with a policy framework, enable simple, directed, routed, scalable transport over the Internet to be used for secure and meaningful exchange between known participants in support of meaningful use”

36

DirectTrust Project

http://www.himss.org/get-involved/committees/privacy-and-security?navItemNumber=12537

37

DirectTrust Communication Single solution that secures communication to patients, public health, and other

providers Built on existing PKI and uses existing systems

• Identity, Digital Signatures, Encryption• Widely used and nationwide adoption by the HISPs

Athena, Cerner, McKesson, covisint, eClincalWorks, MiHIN ONC endorsed and compliant with guidance released in May 2013

Meets Direct requirements• Simple – Push-based transport system• Secure – Encrypted and verifiable messages• Scalable – No need for a central network authority• Standards-based – uses s/MIME established protocols

Uses HISPs to handle infrastructure and provide communication• Arranges identity verification• Manages digital certificates• Maintains integrity of trust and security framework• Responsible for complying with regulations

38

DirectTrust Interstate ParticipantsCA

• Cross-certification with FBCA• Accredited trust anchor• Certificate Issuance

RA

• Identity Verification to NIST LOA3/Medium• Accredited practices

HISP

• Gatekeeper for participation• Certificate management and facilitation of communication between the parties• Verified individual and organizational ientity

HCO

• Transacts health care information• Verified representative responsible for certificates and communication

Patients

• Provides health care information• Communication with the HCO

• Organization verified using government documents

• In-person or remote proofing using a government ID

• Address verification• FBCA medium assurance verification

NIST LOA3

• Organization verified using government documents

• In-person proofing using government IDs• Declaration of Identity• 30 days of issuance

Medium

39

Verification Requirements

40

Interstate Direct Exchange

41

Tools Single portals are already available and easy to implement

Founding member, co-chair of Certificate Policies & Practices Working Group, DirectTrust

First CA to issue Direct-compliant FBCA certificates Direct Med CA included in Transitional Trust Anchor Bundle Already supporting HISPs, HIEs and HCOs Feel free to contact me at [email protected]

42

DigiCert

mailto:[email protected]

Questions?

Contact Us:

Jeff Livesay

Associate Director

[email protected]

Brian Seggie

Security Director and Chief Security Officer

[email protected]

For more information:[email protected]




Health & Medicine

Panel Cyber Security and Privacy without Carrie Waggoner