revise this too, see attachment

1

Project 1 - Information Systems and Identity Management

Technical Report

Donnell Clark

CST 610 3131 Cyberspace and Cybersecurity Foundations (2178)

University of Maryland University College

November 12, 2017

Student

2

Purpose

HIPAA is a Security Rule that outlines a national set of security standards for preserving

and protecting patients’ health records held or transmitted digitally (Centers for Disease Control

and Prevention, 2003). As healthcare providers, we are obliged to apply the Security Rule that

additionally specifies both the technical and non-technical safeguards to be put in place to secure

electronically protected health information. Our healthcare facility is in search of efficiencies and

improved care to our customers amid the rising concerns of cyber-attack in healthcare

organizations.

Information System Infrastructure

According to Jayaram, Vickey & Droge (2000), Information Infrastructure is the hub of

any health care facility that attempts to manage their organizational problems and issues. Most

progress involved in information technology have been established through the application of

healthcare information system to organizational issues through the establishment of an

environment. The environment is therefore characterized by a distributed processing,

heterogeneous networks, and improved user interface.

a. Organizational Structure and Business Units

The figure below illustrates the organizational structure of our healthcare facility, Freedom of

Pain Hospital. The hospital is made up of diverse departments, each executing various tasks. All

these departments, working differently with the aim of contributing significantly to the success of

the hospital. The organizational information structure is set up of two key components; the

information center and information utility. The information center establishes the organizational

unit that ensures the transmission of information that the managerial, professional and support staff

3

can utilize to mitigate the dilemmas. The information utility ensures coordination and support

between the business units and corporate strategy within the hospital.

Health Care Information System

Admission

or discharge

Medical

Records

Laboratory

Information

Pharmacy

Information

Financial Information

b. Mission Critical System

(i) System description

1. Hardware

The organizational security measure highly depends on the configurations set forward by

the information systems. The systems servers ought to be considered as a serious mission area as

a complete. Besides, additional generators for back up ought to be accessible anytime in case of

Information Utility

Business Units Corporate Strategy

Information Centre

Managerial Professional Support Staff

4

power blackout. Our physical servers and virtual ones within are important to the hospital’s

aptitude to function in the course of a tragedy. Disaster Recovery Plans are always on standby to

beef up security in case any unanticipated event arises.

However, as detailed by Bradner (1991), it is not that only our network devices regarded

more critical than others, our mechanical and electrical systems to have a substantial influence on

our business endurance during a tragedy. Our HVAC systems guarantee suitable temperatures are

fixed and measured all over the facility. The guarantee is especially important to house patients

and medicines that require controlled temperatures at all times. Our nurse call system and fire

alarm systems should also remain in working order during emergencies. According to Bradner

(1991), these measures are essential in recognizing life-threatening circumstances and informing

staff members of disasters.

2. Software

Our facility is configured with Open Systems Interconnection of applications, which entails

how the systems within the organization are incorporated to easily transfer information with each

other (Bradner, 1991). The applications are designed to offer dual performance that is, switching

and routing. The applications are also made of servers that transfer information, thus, providing

efficient services to both the physicians and other technicians. With the incorporated Open

Systems Interconnection and Transmission Control Protocol and Internet Protocol, the entire

system is capable of ensuring a maintained networking of system.

5

3. Network

The figure above shows our facility recommended network topology with broad covers

that range from the Integrated Practice Units (IPUs) to the internet technology platform. The

network topology enhances the increase in innovation significance across various facets of our

facility. The topology offers a foundation that ensures a wide range family of applications and

related healthcare practices.

6

(ii) CIA of PHI

With our strong emphasis on security concern, we developed a Corporate Integrity

Agreements (CIA) program that has enhanced a substantial and reliable integrity, confidentiality

and availability of patients’ information, in this instance, Protected Health Information (PHI).

Patients’ information is safeguarded by our system’s right to use controls. To gain access, the

system authorizes the appropriate users and deny those not authorized through enhancement of

strong encryption strategy. According to the HIPAA Security Rule, we are obliged to encrypt our

PHI in the transfer of information to alleviate the interception. With the set rule, our facility has

emphasized to our employees to handle PHI recurrently. By making this information continually

accessible, we are enforcing the CIA program.

Threats

Every information system tends to be vulnerable to threats. Therefore, the technical team

that designs the information system should make it responsible enough for the system to uphold

the integrity and safety of the entire system resources. Networks have a lot of threats lurking behind

the users. For instance, unauthorized access has been jeopardized the safety of many information

systems. Data theft is one thing the medical facility should be aware of data theft from within the

facility. Such threats include:

a. Web security

Web security in network security should be regarded compulsory and inevitable. Obligating

such a measure reduces the chances for the hackers to gain access to our network (Verdon &

McGraw, 2004). Though, network security should be a constant approach. It is difficult to enforce

7

certain protocols as it is to presume that nothing could ever affect the system. Constant updates to

the organizational systems entail the urge of patch management. Patch management is essential in

fixing or budding identified threats within systems. Manufacturers of patches develop them

monthly and more regularly when the system detects any latest threat. Configuring the newly

developed patches ensures that our facility technicians are up to date, as well as sustaining the

systems to protect us from hackers.

Additionally, to reduce the risk of hacking, the facility will have to use Virtual Private Network

(VPN) as an intermediary when one is surfing. By doing so, the data will be encrypted. The

encryption would, therefore, minimize the chances of which our information is being sniffed by

an intruder.

b. Insider Threats

According to research by Hammond (2002) (cited in Bhattacharya, 2011), many

organizations incur a lot of money due to insider cybercrimes than external. Hospitals are not of

an exception when it comes to data theft. Insider threats are rampant in a hospital setting due to

certain aspects of either competition or revenge. A fellow physician or even a member of the

technical staff can access information which they should not be allowed to access at all. They can

as well do it for their gain. It is said that information is power and once another facility gets the

secrets of the hospital, they will work hard in a bid to surpass them and use their ideas in achieving

that. Whoever with that intention will sell the information they got in exchange for a huge pay.

They can as well take information of a patient and share it within themselves which is not one of

the professional ethics deeds.

The threats will forever lurk. Therefore, it is the work of the facility to curb that from ever

happening. They can do so by increasing the security level to ensure proper authentication,

8

authorization and restricting access control. Beefing security can be achieved by the use of

personal computers for every physician. Each should be having a profile which will require a

username and a password before being granted access to the server.

c. Intrusion Motives

External data access has again been an issue for many facilities worldwide. Information

technology experts can use their technical knowledge to manipulate the information system and

gain unauthorized access to the system. This is what hacking entails. It is one significant threat

that affects almost every institution on the planet, whether a company, small businesses,

government facilities and even the military. The hospital is as well facing a threat from hackers,

and, thus, there progress is also been threatened. The hackers may also run a virus into the system

which clears everything from it or crumbles the system, and no data may eventually be accessible.

Identity Management

Access Control Management

i. Access control lists

This list identifies the right people authorized to gain access to any organizational network. As

chances comes up through open ports, the lists may deny access against any unauthorized

personnel.

ii. Mobile phones access control

With the advancement in the usage of mobile devices, the hospital has developed a more

productive approach to curb any unauthorized access to the network. However, with the easier

9

access for the users poses easier access for the hackers. The hospital developed an encrypted PHI

capable of securing any patient’s information privacy and confidentiality.

Identity Management Protection

Password Cracking Tools

i. Benefits

A password is a secret phrase or word which is used in authenticating process in different

applications. It helps in granting access to accounts and resources. It is used in protecting accounts.

Password cracking is the process of recovering a password by either guessing or using passwords

cracking tools. Technology can be used to our rescue when passwords are lost. The software can

be used for cracking accounts or retrieving forgotten passwords. For our facility, we use two

different password cracking products, such as Cain and Abel, and Ophcrack in checking the

strength, complexity and complete validation.

ii. Risks

As new software are developed, passwords become simple to crack. Technology knows no

limits in various aspects which is why securing our networks, strengthening our physical and

logical security, and mitigating every risk is our core purpose. Risk identification ensures extreme

significance in this technology-oriented world.

10

Product Comparative Analysis

a) Compare/Contrast

The two password cracking products, Cain and Abel, and Ophcrack, are considered both

vital and hazardous at the same time. Cain and Abel offer the ability to use predefined character

sets. Both of them, Cain and Abel, and Ophcrack supports a method called cryptanalysis.

Cryptanalysis refers to the transfer of data files to carry out its attack. Whereas we can discover

any fault with these products, so can our adversaries. In accommodating these products into our

system, to test our password strengths we can anticipate vulnerabilities that we possibly may have

unnoticed.

i. Types of attack

• Dictionary attack: Dictionary attacks are usually more refined than brute-force attack

because they are difficult to attempt combining all words, letters, or symbols but rather

focus on a list of most likely used words. Dictionary attack enables the adversaries to

attempt to login to accounts by trying all possible passwords until they figure out the right

one. A dictionary attack requires access to huge compilations of regularly used words and

symbols, mostly in the form of a text document (Patil & Meshram, 2016).

• Brute-force attack: Brute-force attack is less efficient than dictionary attack because they

are blindly attempting all combinations of letters, numbers, and symbols to depend heavily

on the possibility of deciding regularly used words and phrases. In general, a brute-force

attack is a method that uses all possible combinations of keys just to discover a password.

11

ii. Speed

Cain and Abel offer the aptitude to use predefined character sets and establishes the minimum

and maximum password length. The more complex the set of characters, the longer it takes the

software to operate the distinct combinations during an attack.

However, for Ophrack tool, it does not utilize a lot of characteristics as Cain and Abel and thus

makes it difficult to break the passwords that are however longer than 15 characters.

iii. Precision

Cain and Abel is considered to use the majority of attack. Therefore, the speed to crack

passwords is also regarded very impressive. However, such simple passwords like M00n and

xmen, both products instantly recovers them.

Ophrack tool is an appropriate tool for users in case they have little experience in password

recovery that contains nearly 15 characters. Patil and Meshram (2016) regarded the tool as the

easiest to use in password recovery for Windows.

Handling Risk

a. Accept Risk

A negligible degree of risk has to be accepted as nothing will ever be to a full perfection. To

ensure secure networks, it should be considered that technology advances and improved tools are

developed. Therefore, the vulnerabilities concerns keep hiking and posing threats to our systems.

b. Transfer Risk

Reasoning from the fact that our department shall utilize the cracking products, it, therefore,

means that the risk is still within our facility. The risk, therefore, offers us the chance to take the

12

concern into our own hands and ensure our security networks are appropriately secured from any

unauthorized entry.

c. Mitigate Risk

Utilizing the cracking products enable us to establish vulnerabilities in our systems thus

enhancing more encrypted passwords to mitigate risks either inside or outside of our facility easily.

Administrators should supervise testing tools to ensure suitability and precision.

d. Eliminate Risk

Risk elimination is the core aspect of ensuring that our facility is protected from unauthorized

entry into our systems. As much as total elimination is never simple, mitigating the threats closes

the niche in our security systems thus ensuring protection.

Recommendations

I would recommend that the password cracking products be installed on the users’ PC with

their consent and under an administrative role in the system. The installation consent emanates

from the fact that the software does not perform any data accessing or performing any other tasks

sternly without the users’ knowledge. Whereas the software can be used to recover other user’s

passwords on the system, it will only perform this efficiently as requested by the user. This makes

it hard for third-party entry into the system.

Our facility usually has various datasets that manage confidential: financial data, employees

files, patients’ health information. I would, therefore, recommend that every dataset should be

regarded corporate assets and, thus, users should acknowledge that their disclosure or manipulation

might result in a severe financial drawback. The physicians and other support staff should,

therefore, ensure that health data are qualitatively distinct from proprietary corporate data.

13

I would also recommend the installation of firewalls into the system. Firewall installation will

help in minimizing the chances of unauthorized access from an unknown end. Anyone with an

Internet Protocol (IP) address that is not recognized by the facility network should be denied and

probably automatically blocked by the system. Each end user should have a unique IP address that

the network uses for transmitting and accessing information to and from the central server.

Conclusion

Executing Cain and Abel, and Ophrack cracking tools in the facility network systems will

substantially reduce the degree at which hackers intrude into the network with ease. To easily

eliminate the opportunities of forged positives in our systems, we should sustain our hardware and

software tools offline until they are in good position for function. The organizational anti-virus

software will standard these hardware and software tools provisionally, although when

disconnected, the machines shall be in the ability to notice authentic malware except what is

acknowledged by the care facility. The aptitude to recognize what the unauthorized people might

do or where faults depend upon might reinforce our security system to enhance our capability.

Moreover, most significantly, reinforcement might entail our customers the detail that we care

about keeping their information and records at the highest privacy and confidentiality degree.

14

References

Bhattacharya, D. (2011). Leadership Styles and Information Security in Small Businesses.

Information Management & Computer Security, 19(5), 300-312.

Bradner, S. (1991). Benchmarking Terminology for Network Interconnection Devices (No. RFC

1242).

Centers for Disease Control and Prevention. (2003). HIPAA Privacy Rule and Public Health.

Guidance from CDC and the US Department of Health and Human Services. MMWR:

Morbidity and Mortality Weekly Report, 52(Suppl. 1), 1-17.

Jayaram, J., Vickery, S. K., & Droge, C. (2000). The effects of information system infrastructure

and process improvements on supply-chain time performance. International Journal of

Physical Distribution & Logistics Management, 30(3/4), 314-330.

Patil, D. N., & Meshram, B. B. (2016). Windows Password Vulnerability and Preventive

Measures. Indian Journal of Computer Science• September-October, 13.

Verdon, D., & McGraw, G. (2004). Risk Analysis in Software Design. IEEE Security & Privacy,

2(4), 79-84.