# Presentation: 098149

## Building a Culture of Confidentiality and Security

*gchristoph@comcast.net*
**June 9, 2005**

**Building a Culture of Confidentiality and Security**

## The Issues

- Identity theft happens
- Budget pressures continue the drive to adopt more and newer technologies
- Network Security is Hard and Expensive
- Consumers expect better of us
- Compliance Mandates (HIPAA, GLBA, SarbOx, CA SB 1386, etc.) are (unfortunately) strong security drivers

**Notes:**
Agenda

## 	How do we inspire trust now?

**We:**
**Deploy new technology without thinking about misuse**
**Deploy shrink wrap software**
**Use complex environments **
**Use bloated codes**
**Rely on people to do the “right thing”**
**Do not write things down**
**Hide our mistakes**

## 	How can we inspire trust?

**Think about the risks we face**
**Develop coherent, enforceable policy**
**Publish our policies and procedures**
**Actually do what we say we are doing**
**Train and educate users and staff**
**Periodically test that it works**
**Report failures**
**KISS**

## Government is reactive, not proactive
Society only moves to protect people after problems become obvious

If a formal mandate exists, it is usually because there is a real problem that needs to be addressed

**Society only moves to protect people after problems become obvious**
**If a formal mandate exists, it is usually because there is a *****real***** problem that needs to be addressed**

**Why do mandates exist:**

**Notes:**
Use of traditional perimeter firewalls to control internal security requires network reengineering, investment, and continued maintenance and management.
The complexity of the environment creates doubts about the protection’s effectiveness with users and managers.
Contemporary solutions may require expensive and disruptive user training, and extensive pre-release testing for compatibility with existing applications and tools.
Existing solutions have lots of management issues—this complex array of point solutions must be managed, sometimes it takes expensive, well-trained network gurus just to keep it running.
Contemporary security controls often interfere with legitimate user actions—get in the way of business.
Contemporary solutions are subject to operating system and application vulnerabilities.  If there is a weak point there, then despite the best, most expensive veneer, the whole structure can be lost.

## Cutting too many corners now can put CEOs in jail
Bad publicity forces action
Consultants aim to make money, not fix the problem (FUD)
People are not good at assessing risk

**Bad publicity forces action**
**Consultants aim to make money, not fix the problem (FUD)**
**People are not good at assessing risk**

**Compliance begets repeatability;****    Repeatability begets trust:**

**Notes:**
Use of traditional perimeter firewalls to control internal security requires network reengineering, investment, and continued maintenance and management.
The complexity of the environment creates doubts about the protection’s effectiveness with users and managers.
Contemporary solutions may require expensive and disruptive user training, and extensive pre-release testing for compatibility with existing applications and tools.
Existing solutions have lots of management issues—this complex array of point solutions must be managed, sometimes it takes expensive, well-trained network gurus just to keep it running.
Contemporary security controls often interfere with legitimate user actions—get in the way of business.
Contemporary solutions are subject to operating system and application vulnerabilities.  If there is a weak point there, then despite the best, most expensive veneer, the whole structure can be lost.

## People are involved
People are neither repeatable nor logical
People on the job make inappropriate assumptions 
Technical Solutions are too complex
Point products do not tile the floor
Management of many solutions is not easy or cheap
Pace of technological change adds new vulnerabilities (e.g., wireless) 
Administrative Solutions that are not solutions
Processes get in the way of work
Controls violated without your knowledge or without consequence

- People are neither repeatable nor logical
- People on the job make inappropriate assumptions
- Technical Solutions are too complex
- Point products do not tile the floor
- Management of many solutions is not easy or cheap
- Pace of technological change adds new vulnerabilities (e.g., wireless)
- Administrative Solutions that are not solutions
- Processes get in the way of work
- Controls violated without your knowledge or without consequence

**Hard NW Security/Privacy Issues:**

**Notes:**
Uniform implementation of policies
Diversity of the environment means this is administratively and practically hard
Uniform enforcement of policies
People do not always follow the rules
Must rely upon auditing and verification to prove the negative
Heterogeneous environment engenders non-uniform implementation
Technical Controls
Defense-in-depth 
Creates a management burden 
Complexity means holes
Complexity creates further management burden
“Security Perimeter” 
An outmoded concept
Ignores insider threats
Separation of Roles
Hard to achieve
Authentication and Authorization
Associating access limits with the right people is difficult

## Find a simple way to implement new features
Decide what is important to protect
Find a simple way to protect it
Document it
Test it
Act on changing threats
Communicate well

***Decide what is important to protect***
***Find a simple way to protect it***
***Document it***
***Test it***
***Act on changing threats***
***Communicate well***

**A Simple Strategy:**

**Notes:**
Self-explanatory

## The Regs were written to be scalable and technology neutral.         Why?

- Rules have to cover everything from a one-person Dentist’s office in Podunk, Missouri, to Johns Hopkins Hospital
- It economically makes no sense to require everyone to have the same controls
- Technology evolves
**    **

**So:**
**1.****	****The solution must fit the need**
**2.****	****Be better than the average, but no more than that**
**    **

**Notes:**
Self-explanatory

## Technology ONLY Addresses Part of the Problem:

**Administrative**
**Procedures**

**Technical Security Services**

**  ****Not currently required**

**Electronic Signature**

**Physical Safeguards**

**General Rules**

**Limitations**

**Technical Security Mechanisms**

**Transaction**
**Standards**

**Standard**
**Code Sets**

**Unique Health**
**Identifiers**

**Security**

**Privacy**

**Chain of Trust Agreement**
**Certification, **

**  ****Secure Workstation**
**  ****Physical Access Controls,**
**    ****Media Controls, etc.**
**  ****Security Awareness**

**PHI data elements defined**
**Notice of Privacy Practices mandated**

**Consent required for routine use**
**Authorization required for non-routine use**
**Business associate contracts required**
**Designated Privacy Officer**

**	****stored, in any medium (electronic, paper, oral)**

** ****Data Authentication**

**Internal Audit, Training, Written Policies & Procedures, etc.**

**Internal Audit, Training, Written Policies & Procedures, etc.**

** ****Training**

** ****Training**

**Basic Network Safeguards**
**Integrity and Protection**

**Basic Network Safeguards**
**Integrity and Protection**

**  ****Access Controls**
**  ****Authorization**

**  ****Access Controls**
**  ****Authorization**

** ****Entity Authentication**

** ****Entity Authentication**

**Covers Protected Health Information (PHI) transmitted or**

**Covers Protected Health Information (PHI) transmitted or**

**Minimum necessary disclosure/use of data**

**Minimum necessary disclosure/use of data**

**Technology ONLY Addresses Part of the Problem:**

**Notes:**
I am not going to talk in any detail about the many mandates facing us to implement security.  Really, good security is simply good business, and we all know that we should be well protecting our data and systems, like brushing our teeth.  
But I did want to illustrate that many of the drivers that these regulations and mandates cover are ones that Sinic helps to address.  This slide shows the HIPAA regulation.  I have highlighted in green those areas that Sinic helps address.  Note that to have a good security posture, you need to do all of the things you need to do—you need to have security policies written down and followed.  Well, Sinic can help with that.  Sinic can help with most of the technical issues, in fact.  And Sinic can help address things that many other products cannot, like Insider Threats.  
Sinic does not do everything, but, like fortified breakfast cereal, it is a big part of a healthy breakfast.
Because Sinic can operate as fine-grained individual end-point firewalls, that users cannot control or avoid, it even can help reduce the patch-management problem we face.  First, let’s talk about what Sinic does, and how it works.

## The Trust Solution Target

- Want transparency
- Obviousness--Easy for users to comply with
- Easy for admins to enforce
- Want repeatability
- Works the same every time
- Does only what it is supposed to do
- Want universality
- Everywhere same policy enforced the same
- Use technology to reduce administrative controls
- Want simplicity
- Complexity is the enemy
- Want easy to manage
- Want verifiability
- Documentable
- Want cheap
- Do not want to go out of business