# Presentation: 660286

## Information Security and Privacy

*[the Agency]**** Manager Briefing***

- [presenter’s name]
- [title]
- [phone]

## “[the Agency’s] mission states that “We assure health care security for beneficiaries.” As we are the trusted custodian of one of the largest repositories of individual health care data in the world, [the Agency] must protect these most valuable assets, its information and its information systems.  This is true of all [the Agency] information, regardless of how it is created, distributed, or stored and whether it is typed, electronic, handwritten, printed, filmed, computer generated, or spoken.”

[CIO name]
Chief Information Officer
Office of Information Services, [the Agency] 

*[CIO name]*
*Chief Information Officer*
*Office of Information Services, **[the Agency]*

**Notes:**
[the Agency’s] Information Security Policy, as stated by [the CIO], is in place to protect [the Agency’s] information resources from unauthorized access, disclosure, duplication, modification...loss, misuse, or theft – whether accidental or intentional.  

## The Way We Do BusinessIs Changing

- Seamless interconnectivity of our internal and external systems
- Increased amount of information handled by *[the Agency]*
- Increased focus on privacy and security

**Notes:**
You are here today we all need to work towards meeting this mission and because the way we do business is changing.  
We have increased our number of business partners, reliance on networked systems, the Internet, and electronic commerce.  There is almost a seamless interconnectivity between our internal and external systems and business partners.
We are processing more and more information.  Do you realize that we handle over 22 Terabytes of in-house data?  Just six months ago it was at 20 Terabytes. Just think where we will be in 1 year or 5 years?
There are new requirements that place an increased focus on security and privacy, such as FISMA and HIPAA.  There are more and more audits.

## Congressional Investigation

- “Audit after audit, even the most recent, continue to reveal significant computer security problems at *[the Agency]* and its [business] contractors – vulnerabilities that continue to place personally identifiable medical information at risk of unauthorized access, disclosure, misuse, or destruction...”
*Congressman James Greenwood*
*Chairman, Subcommittee on Oversight and Investigations*

**Notes:**
At recent hearings on “How Secure is Private Medical Information?”  Computer security at [the Agency’s] and our [business] contractors was reviewed.  Overall [the Agency] faired well in the hearing; however, we came under scrutiny for several policies and procedures not in place or implemented properly.  Protecting beneficiary data is our main concern, in one way or another we all need to work towards that goal.  

## Congressional Action Items

- Implement the outstanding corrective actions necessary to address known vulnerabilities in our systems;
- Demand the independent testing of our contractor’s systems;
- Carry out our plan to upgrade computer security for our [business] contractors;
- Integrate into our security management a vigorous process of scanning networks for vulnerabilities, improper configuration, and weak passwords; and
- Evaluate the security of our remote and dial-up capabilities.

**Notes:**
The hearing identified the following:  review points on slide

As managers, it is our responsibility to respond.

## Enterprise Security Threats

**Threats**

**Potential Damage**

**Public,**
**Partner,**
**Legislative Trust**
**Lost**

**Sensitive**
**Data **
**Disclosed**

**Integrity of**
*[the Agency]* **Data**
**& Reports**
**Corrupted**

**Critical**
**Operations**
**Halted**

**Services &**
**Benefits**
**Interrupted**

**Assets**
**Lost**

*[the Agency’s]*** Systems**

**Failed **
**Audits**

**Natural **
**Disaster**

**User **
**Error**

**Malicious**
**Acts**

**Business**
**Espionage**

**Unauthorized**
**Access to**
**Sensitive Info **

**Notes:**
The threats to [the Agency’s] systems are real.  The recent terrorists attacks caused several companies to halt operations or temporarily interrupt service.   In some cases, the assets lost are immeasurable.  These malicious acts have placed our Nation on high alert.  As stated in a recent article from InformationWeek.com, Attorney General John Ashcroft advised “thousands of CIOs, Chief Technology Officers, and IT Managers that their systems may be targeted in retaliatory terrorist attacks – or used to launch them.”  
How prepared are we? 

And this is only the beginning, Internet and network access is growing and there will be more and more access to our electronic data.  Also in light of recent events, we can expect to see an increase in cyber terrorism.  This could lead to people and systems gaining access to information they should not have access to.  

## Slide 7

**Notes:**
The important thing to realize that that each of the threats we mentioned are perpetrated by people.
Just consider Robert Hansen.  While working for the FBI, he was feeding information to the Soviet Union for years.  Do you think at any point in time his supervisor did a review to determine if he still needed that level of access?  Even though we do not deal with National Security or Classified information, the protection of personally identifiable beneficiary information is no less important to our customers.

## Why are you here?

- Protect the privacy, integrity and availability of our information
- Support anti-fraud and abuse efforts
- Provide *[the Agency]* business continuity
- Provide accessibility of information
- Protect our credibility

***Each One Of Us Is Accountable***

**Notes:**
You are here because we at [the Agency] are required by law to protect personally identifiable beneficiary data. Everything comes down to our mission “to assure health care security for our beneficiaries”.

To do this we need to protect our processes and corporate assets against damage or unauthorized use, as well as protect the privacy and integrity of our information.  We need to support anti-fraud and abuse efforts.
To provide for business continuity and contingency of services.  A disruption of services affects the interests of [the Agency’s] beneficiaries and providers.
To provide accessibility of information. We need to ensure that customers and beneficiaries have prompt access to the information they need.   

Doing these things protects our credibility. Also, It is a prudent business practice to reduce risks to [the Agency] .  It is also less-costly (and less embarrassing) if we take a proactive approach to security and “prevent, deter, and detect” as opposed to “correct and recover.”

## What are we doing?

- Standardized Systems Security Plan (SSP) Methodology
- SSP Methodology Training Course
- Reviewed more than 30 SSPs
- Published *[the Agency]* AIS Security Policies, Standards, and Guidelines Handbook
- Conducted 3rd Party Penetration Testing
- Published Volume 6, Security Architecture
- Implementing Intrusion Detection
- Conducted Security Briefings for Managers
- Created End-User Computer Based Training (CBT)

**Notes:**
We are taking action.  Recently we’ve:
Submitted the Systems Security Plan Methodology to the IT Council for review and acceptance as a [the Agency] standard. Prepared a 6-hour Systems Security Plan Methodology course and conducted 6 classes. We have also reviewed more than 30 System Security Plans and recommended 8 for accreditation (all 8 have been accredited).  Although this is significant, we are not finished yet.
Published the [the Agency] AIS Security Policies, Standards and Guidelines Handbook.
Conducted third party penetration tests of the [the Agency] internal network.
Published Volume 6, Security Architecture, of the CMS IT Architecture.
Developed strategy for Intrusion Detection and prepared Statement of Work to obtain Intrusion Detection services
And finally, this Manager’s briefing.  We have presented 4 briefings to date.  Today is part of [the Agency’s] action plan.  We are all here because we have to ensure the security of our resources, which includes; personnel, systems, and data.  

## Legislative, Regulatory, and Business Drivers

- Computer Security Act of 1987
- Presidential Decision Directive 63 (PDD 63)
- OMB A-130, Appendix III, Revised
- Federal Information Security Management Act of 2002 (FISMA)
- Health Insurance Portability and Accountability Act (HIPAA)

**Notes:**
Our Information Security Program is driven by several laws, regulations, and business directives.  

For example: E-Gov.   Some might say that E-Gov works in opposition of information security; however, a push for E-Gov means to assume the risk associated with doing business electronically or do something about it. 

The Computer Security Act of 1987 requires all Federal agencies to identify computer systems that contain or process sensitive information, develop system security plans for those systems, and conduct mandatory computer security awareness training for all uses.

OMB A-130 establishes a minimum set of controls to be included in Federal Automated Information Systems and assigns Federal agencies responsibilities for information security.

PDD 63 calls for a national effort to assure the security of the infrastructures within the United States.  These infrastructures include telecommunications, banking and finance, energy, transportation, and essential government services. PDD 63 requires immediate Federal government action including risk assessment and planning to reduce exposure to attack. 

## FISMA

- FISMA analyzes existing controls in a 5-Level Framework
- Policies
- Procedures
- Implementation
- Testing
- Integration

**Notes:**
GISRA codifies existing regulations and examines management, operational, and technical controls and analyzes them in a 5-level framework: policy, procedures, implementation, testing, and integration. 
GISRA compliance requires that:
Policies been developed to require the appropriate security controls and if so 
Have procedures been developed to implement the control
Have the controls been implemented
Have implemented controls been tested and if so 
Have the results been integrated back in to the system so that identified vulnerabilities are mitigated or have unmitigated risks been accepted and monitored. 

Another legislative driver is HIPAA.  Provisions under HIPAA ensure the integrity and confidentiality of electronic health information.

## HIPAA

- Ensures that those who maintain or transmit health information maintain reasonable and appropriate administrative, technical, and physical safeguards.
- To ensure the integrity and confidentiality of the information.
- To protect against any reasonably anticipated threats or hazards to the security or integrity of the information; and unauthorized uses or disclosures of the information.

**Notes:**
HIPAA requires the protection of health information against any reasonably anticipated threats or hazards to the security or integrity of the information or its unauthorized use or disclosure.  This regulation requires that [the Agency] and the health care industry have adequate security in place to protect health information.  This law has a far reaching impact on our information systems, our health care partners, as well as private health systems.  We are expected to be a leader in implementing this regulation.

[the Agency’s] business survives on having accurate confidential records.  It is [the Agency’s] promise to the beneficiary that we keep this record accurate, safe, and confidential.  Privacy and security go hand in hand.  We need security in order to ensure privacy and confidentiality.

## Information Security Program

- Four Pillars
- Policies and Procedures
- Training and Awareness
- Security Architecture
- Certification & Accreditation
- Information Security Organization

**Notes:**
Now that we’ve established why you are here, what [the Agency] is currently doing for information security, and what drives our program.  Let’s discuss the components of our Information Security Program.

There are four pillars that make up the program:  Policies and procedures provide a foundation and common understanding of expectations.  The [the Agency] Information Security Policy, Standards, and Guidelines Handbook is a resource available to you so that you are aware of the security policies in place.

[the Agency’s] Training and Awareness Program involves several events and activities such as, Annual Information Security Awareness Days, Annual Information Security Conferences, New Employee Orientation sessions, End-user Computer-Based Training, Manager’s briefings, ISSO training and specialized training.

Management and oversight involves the penetration testing we are currently conducting, SSP accreditation, SSP verification and validation, Integrated security into the systems development life cycle, and IRS and CFO Audits.

Technical Engineering involves protecting against, preventing, and detecting threats and vulnerabilities to our systems.  We protect our systems with routers, firewalls, virus scanning, user ids, and passwords. We can prevent threats and vulnerabilities with Risk Assessments, System Security Plans, and penetration testing. We detect threat and vulnerabilities with Intrusion Detection Systems, audit trails, and system logs.

Our Information Security Organization is what implements and supports these pillars.

## [the Agency] Information Security Organization

*[the Agency]* Information Security Organization

*[the Agency]*** Administrator**

**Director, SSG**

**Office Directors**

**Center Directors**

**Director, DCES**

**Senior Systems Security Advisor**

**Component ISSO’s**

**Component ISSO’s**

**Senior ISSO**

**(Information exchange)**

**(Information**
**exchange)**

**Notes:**
Discuss the organizational components of the program.

## OIS-SSG

- OIS-SSG is responsible for implementing the Information Security Program.
- Senior Systems Security Advisor serves as principal advisor and technical authority to the *[the Agency]* CIO.
- Senior ISSO evaluates and provides information about the *[the Agency]* Information Security Program to management and personnel.
**Information Security staff support.**

- CMS Information Security Handbook Chapter 2

## Privacy Resources 

- Interpret Privacy Act requirements and rules.
- Coordinate with all System Owners / Managers to ensure that they understand the Privacy Act requirements and their related responsibilities.
-     The Beneficiary Confidentiality Board (BCB) mission is to provide executive leadership and establish and enforce the guiding principles for *[the Agency’s]* management and oversight of privacy and confidentiality.

*[the Agency’* Information Security Handbook Chapter 2

**Notes:**
The Privacy Officer is the principal authority on maintenance and release of Privacy Act protected data from the Privacy Act System of Records (SOR).  The Privacy Officer is responsible for the following:

Review points on slide.

## Responsibilities of Your ISSOs

- Ensure component compliance with *[the Agency’s]* Information Security Program requirements.
- Act as the primary point of contact for systems security issues.
- Participate in the technical certification and development of component SSPs.
- Assist [access control application] administrators with security matters.

*[the Agency]* Information Security Handbook Chapter 2

**Notes:**
The key role of your ISSOs are to be the key point of contact for all security issues within your component.  As the [the Agency] security program continues to mature, their role will also change and they will gain additional responsibilities.

At the present time, ISSO’s do not have position descriptions - ISSO duties are collateral duties.  You may need to appoint more than one if needed.  SSG will provide them training, but you need to support your ISSOs.  We need to be realistic on how much time they need in order to do their jobs.  It may take a year or so for them to get involved in each of these activities.

The more people that we have active in a security role, the better it is for [the Agency] and for us.

## Responsibilities of Your [access control application] Administrators

- Control user system access, revoking access when appropriate and defining & modifying profiles to [access control application] privileges and access.
- Liaison with *[the Agency]* operations support.
- Assist users in determining proper level of protection.
- Reset user passwords.

*[the Agency]* Information Security Handbook Chapter 2

**Notes:**
Each organization has a RACF Administrator to handle mainframe access 
RACF GA’s are responsible for controlling user system access to include modifying and revoking system access when necessary, defining user profiles, monitoring access to ensure proper protection of sensitive data, assisting users in determining the proper level of protection and resetting user passwords when users forget them.

## [the Agency] InformationSecurity ProgramImplementation

- Parallel Tracks
*[the Agency]* Internal
*[the Agency]* External Business Partners
- Funding

**Notes:**
This section will serve as an advertisement.

## [the Agency] Internal

- Conduct vulnerability assessments and develop tracking system to ensure they are closed.
- Develop and conduct role-based training
- Developing policy and information security minimum standards.
- Implementing Intrusion Detection and Incident Response Procedures
- Working with business owners to design secure e-government capabilities

## [the Agency] External Business Partners

- Published Business Partners Systems Security Manual
- Completed CAST Reviews at some 90 [business] contractors
- Next steps: develop SSPs for [business] operations

## [the Agency] Information Security Integration

- Key Manager Responsibilities
- Systems Development Process
- Investment Management
- Business Case Analysis
- System Security Planning

**Notes:**
Information security must be integrated into every facet at [the Agency] , not just OIS.  Auditors look for this, they want information security practices integrated throughout the Agency.  This is also one of the drivers of GISRA.
You all may manage different resources.  For example, some of you may manage only personnel, while others may only manage systems; however, they are one of the same.  If you only manage personnel, more than likely they use systems and access data, therefore you are managing systems as well or at least their activity on those systems.  The same thing goes for systems managers...you have people working at those systems correct?  My point is that regardless of who or what you manage, it’s all considered [the Agency] resources and that’s why we’re here today.  We have to protect [the Agency’s] resources so we can accomplish our mission.

## [the Agency] Master SSP

**Infrastructure Components**

- CMS’s System Security Plan
- 3-Tier Architecture

*[the Agency]*** Master SSP**
**Enterprise – Wide Systems Security Controls**

**General Support Systems (GSSs)**
**Infrastructure Components**

**Campus Area Network**

**Web Content**

**Middleware**

**Regional Offices**

**Network Mgmt**

*[the Agency]*** Data Center**

**Desktop**

**Databases**

**Security Mgmt**

**Mainframe**

**DSRDS**

**Other GSSs**

**Medicare Data Centers**

**E-mail**

**AGNS MDCN**

**AGNS Web Hosting**

**PRO Network**

**Major Applications (MAs)**

**MA**
**EDB**

**Other**
**MA(s)**

**MA**
**CWF**

**“****Other” Systems**

**Medicare (External Partners) MA(s)**

## Conclusions

- Security is an enabling technology
- As managers, we are owners and custodians of information resources – we are responsible!

**Notes:**
House security analogy

## We ask you to:

- Support the Training & Awareness program!
- Take ownership of System Security Plans!
- Protect your USERID!
- Lock your workstation
- Protect data at all times

**Notes:**
We ask that leave here today with a few things in mind....
Encourage your staff to comply with security policies and procedures. 
In order to make [the Agency’s] systems and data safe and secure, it takes the efforts of everyone.  But in order to do this, everyone needs to understand their  security responsibilities.  This can only be done through security awareness and training.  
Essentially, YOU are the deciding factor in whether or not [the Agency] has an effective enterprise security program.  Therefore, when training comes.. set an example by attending and encouraging your employees and contractors to attend security awareness and training program events.   
Security is an integral part of [the Agency’s] mission, and we need YOU to be proactive and ensure that security is included as an on-going function within your organizations.  We need to look at security as an enabler, not as an impediment.  People are the most critical part of effective security.  

## [intranet information security web page address]

**Notes:**
Thank you for your time and cooperation.  

Are there any questions or comments?