SECURITY ASSESSMENT & TESTING

Business Case: Local Hospital's data center

Companies spend billions on security each year, yet why is this still an issue? It’s almost 2019 and still, most applications are horribly insecure and security best practices are not followed. Applications are designed for functionality, not security because security is seen as difficult and time-consuming, often blamed for adding delays to product launches and revenue-generating activities. Assume; you are an IT manager at the regional Hospital and answer the following questions.

Where the Local Hospital's parameters are:  600 patients a day, and 250 full-time employees. The hospital has a data cent with all IT assets (Databases, Servers, Data storage, Network devices) to support the Hospital's Business operations. 

Source: https://xypro.com/enterprise-identity-access-management/risk-management-in-the-real-world-today-tomorrow-and-beyond/Links to an external site.Links to an external site.

QUESTION 1: There is a need for a new posture for cybersecurity in a networked world where your hospital is part of it.  What are principles used by some of the world’s leading cybersecurity teams at global companies to archive this goal?

How can you adapt the principles for your hospital case?

Resource: https://www.mckinsey.com/~/media/McKinsey/McKinsey%20Solutions/Cyber%20Solutions/Perspectives%20on%20transforming%20cybersecurity/Transforming%20cybersecurity_March2019.ashxLinks to an external site.Links to an external site.

QUESTION 2: Companies should assess threats and develop controls for the most critical assets.

If the threats against tour Hospital IT System are 

Manipulation of software

Unauthorized installation of software

Misuse of information systems

Denial of service

What would be controls that you should apply to mitigate above listed risks?

Resurce : https://www.mckinsey.com/~/media/McKinsey/McKinsey%20Solutions/Cyber%20Solutions/Perspectives%20on%20transforming%20cybersecurity/Transforming%20cybersecurity_March2019.ashxLinks to an external site.Links to an external site.

QUESTION 3: As an IT manager, you were tasked to develop an information security and risk management (ISRM) strategy which requires a multiphase approach. What are the phases that would should follow to provide recognizable results and value to the Hospital?  

Resources: https://www.isaca.org/resources/isaca-journal/past-issues/2010/developing-an-information-security-and-risk-management-strategy