Health Information Privacy and Security

Please download to get full document.

View again

of 106
24 views
PDF
All materials on our website are shared by users. If you have any questions about copyright issues, please report us to resolve them. We are always happy to assist you.
Document Description
Presented at the Health Informatics and Health Information Technology Course, Doctor of Philosophy and Master of Science Programs in Data Science for Health Care (International Program), Faculty of Medicine Ramathibodi Hospital, Mahidol University on October 17, 2017
Document Share
Documents Related
Document Transcript
  • 1. Health Information Privacy & Security Nawanan Theera-Ampornpunt, M.D., Ph.D. Faculty of Medicine Ramathibodi Hospital Mahidol University For Ramathibodi M.S. & Ph.D. Programs in Data Science for Health Care October 17, 2017 http://www.SlideShare.net/Nawanan
  • 2.  Introduction to Information Privacy & Security  Protecting Information Privacy & Security  User Security  Malware  Security Standards  Privacy & Security Laws Outline
  • 3. Introduction to Information Privacy & Security
  • 4. Malware Threats to Information Security
  • 5. (Top) http://deadline.com/2014/12/sony-hack-timeline-any-pascal-the-interview-north-korea-1201325501/ (Bottom) http://www.bloomberg.com/news/articles/2014-12-07/sony-s-darkseoul-breach-stretched-from-thai-hotel- to-hollywood Security Threats & Thailand
  • 6. http://www.aclu.org/ordering-pizza Privacy Protections: Why?
  • 7. Sources of the Threats  Hackers  Viruses & Malware  Poorly-designed systems  Insiders (Employees)  People’s ignorance & lack of knowledge  Disasters & other incidents affecting information systems
  • 8.  Information risks  Unauthorized access & disclosure of confidential information  Unauthorized addition, deletion, or modification of information  Operational risks  System not functional (Denial of Service - DoS)  System wrongly operated  Personal risks  Identity thefts  Financial losses  Disclosure of information that may affect employment or other personal aspects (e.g. health information)  Physical/psychological harms  Organizational risks  Financial losses  Damage to reputation & trust  Etc. Consequences of Security Attacks
  • 9. Security & Privacy http://en.wikipedia.org/wiki/A._S._Bradford_House Privacy & Security
  • 10.  Privacy: “The ability of an individual or group to seclude themselves or information about themselves and thereby reveal themselves selectively.” (Wikipedia)  Security: “The degree of protection to safeguard ... person against danger, damage, loss, and crime.” (Wikipedia)  Information Security: “Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction” (Wikipedia) Privacy & Security
  • 11. Information Security  Confidentiality  Integrity  Availability
  • 12. Examples of Confidentiality Risks http://usatoday30.usatoday.com/life/people/2007-10-10-clooney_N.htm
  • 13. Examples of Integrity Risks http://www.wired.com/threatlevel/2010/03/source-code-hacks/ http://en.wikipedia.org/wiki/Operation_Aurora “Operation Aurora” Alleged Targets: Google, Adobe, Juniper Networks, Yahoo!, Symantec, Northrop Grumman, Morgan Stanley, Dow Chemical Goal: To gain access to and potentially modify source code repositories at high tech, security & defense contractor companies
  • 14. Examples of Integrity Risks http://news.softpedia.com/news/700-000-InMotion-Websites-Hacked-by-TiGER-M-TE-223607.shtml Web Defacements
  • 15. Examples of Availability Risks http://en.wikipedia.org/wiki/Blaster_worm Viruses/worms that led to instability & system restart (e.g. Blaster worm)
  • 16. Examples of Availability Risks http://en.wikipedia.org/wiki/Ariane_5_Flight_501 Ariane 5 Flight 501 Rocket Launch Failure Cause: Software bug on rocket acceleration due to data conversion from a 64-bit floating point number to a 16-bit signed integer without proper checks, leading to arithmatic overflow
  • 17. บทความใน JAMA เร็วๆ นี้ JAMA. 2015 Apr 14;313(14).
  • 18. Protecting Information Privacy & Security
  • 19.  Attack  An attempt to breach system security  Threat  A scenario that can harm a system  Vulnerability  The “hole” that is used in the attack Common Security Terms
  • 20.  Identify some possible means an attacker could use to conduct a security attack Class Exercise
  • 21. Alice Simplified Attack Scenarios Server Bob Eve/Mallory
  • 22. Alice Simplified Attack Scenarios Server Bob - Physical access to client computer - Electronic access (password) - Tricking user into doing something (malware, phishing & social engineering) Eve/Mallory
  • 23. Alice Simplified Attack Scenarios Server Bob - Intercepting (eavesdropping or “sniffing”) data in transit - Modifying data (“Man-in-the- middle” attacks) - “Replay” attacks Eve/Mallory
  • 24. Alice Simplified Attack Scenarios Server Bob - Unauthorized access to servers through - Physical means - User accounts & privileges - Attacks through software vulnerabilities - Attacks using protocol weaknesses - DoS / DDoS attacks Eve/Mallory
  • 25. Alice Simplified Attack Scenarios Server Bob Other & newer forms of attacks possible Eve/Mallory
  • 26. Alice Safeguarding Against Attacks Server Bob Administrative Security - Security & privacy policy - Governance of security risk management & response - Uniform enforcement of policy & monitoring - Disaster recovery planning (DRP) & Business continuity planning/management (BCP/BCM) - Legal obligations, requirements & disclaimers
  • 27. Alice Safeguarding Against Attacks Server Bob Physical Security - Protecting physical access of clients & servers - Locks & chains, locked rooms, security cameras - Mobile device security - Secure storage & secure disposition of storage devices
  • 28. Alice Safeguarding Against Attacks Server Bob User Security - User account management - Strong p/w policy (length, complexity, expiry, no meaning) - Principle of Least Privilege - “Clear desk, clear screen policy” - Audit trails - Education, awareness building & policy enforcement - Alerts & education about phishing & social engineering
  • 29. Alice Safeguarding Against Attacks Server Bob System Security - Antivirus, antispyware, personal firewall, intrusion detection/prevention system (IDS/IPS), log files, monitoring - Updates, patches, fixes of operating system vulnerabilities & application vulnerabilities - Redundancy (avoid “Single Point of Failure”) - Honeypots
  • 30. Alice Safeguarding Against Attacks Server Bob Software Security - Software (clients & servers) that is secure by design - Software testing against failures, bugs, invalid inputs, performance issues & attacks - Updates to patch vulnerabilities
  • 31. Alice Safeguarding Against Attacks Server Bob Network Security - Access control (physical & electronic) to network devices - Use of secure network protocols if possible - Data encryption during transit if possible - Bandwidth monitoring & control
  • 32. Alice Safeguarding Against Attacks Server Bob Database Security - Access control to databases & storage devices - Encryption of data stored in databases if necessary - Secure destruction of data after use - Access control to queries/reports - Security features of database management systems (DBMS)
  • 33. Privacy Safeguards Image: http://www.nurseweek.com/news/images/privacy.jpg  Security safeguards  Informed consent  Privacy culture  User awareness building & education  Organizational policy & regulations  Enforcement  Ongoing privacy & security assessments, monitoring, and protection
  • 34. User Security
  • 35. https://www.thaicert.or.th/downloads/files/BROCHURE_security_awareness.png
  • 36.  Access control  Selective restriction of access to the system  Role-based access control  Access control based on the person’s role (rather than identity)  Audit trails  Logs/records that provide evidence of sequence of activities User Security
  • 37.  Identification  Identifying who you are  Usually done by user IDs or some other unique codes  Authentication  Confirming that you truly are who you identify  Usually done by keys, PIN, passwords or biometrics  Authorization  Specifying/verifying how much you have access  Determined based on system owner’s policy & system configurations  “Principle of Least Privilege” User Security
  • 38.  Nonrepudiation  Proving integrity, origin, & performer of an activity without the person’s ability to refute his actions  Most common form: signatures  Electronic signatures offer varying degrees of nonrepudiation  PIN/password vs. biometrics  Digital certificates (in public key infrastructure - PKI) often used to ascertain nonrepudiation User Security
  • 39.  Multiple-Factor Authentication  Two-Factor Authentication  Use of multiple means (“factors”) for authentication  Types of Authentication Factors  Something you know  Password, PIN, etc.  Something you have  Keys, cards, tokens, devices (e.g. mobile phones)  Something you are  Biometrics User Security
  • 40. Need for Strong Password Policy So, two informaticians walk into a bar... The bouncer says, "What's the password." One says, "Password?" The bouncer lets them in. Credits: @RossMartin & AMIA (2012)
  • 41. Recommended Password Policy  Length  8 characters or more (to slow down brute-force attacks)  Complexity (to slow down brute-force attacks)  Consists of 3 of 4 categories of characters  Uppercase letters  Lowercase letters  Numbers  Symbols (except symbols that have special uses by the system or that can be used to hack system, e.g. SQL Injection)  No meaning (“Dictionary Attacks”)  Not simple patterns (12345678, 11111111) (to slow down brute- force attacks & prevent dictionary attacks)  Not easy to guess (birthday, family names, etc.) (to prevent unknown & known persons from guessing) Personal opinion. No legal responsibility assumed.
  • 42. Recommended Password Policy  Expiration (to make brute-force attacks not possible)  6-8 months  Decreasing over time because of increasing computer’s speed  But be careful! Too short duration will force users to write passwords down  Secure password storage in database or system (encrypted or store only password hashes)  Secure password confirmation  Secure “forget password” policy  Different password for each account. Create variations to help remember. If not possible, have different sets of accounts for differing security needs (e.g., bank accounts vs. social media sites) Personal opinion. No legal responsibility assumed.
  • 43. { Dictionary Attack: A story from a computer security course
  • 44. Techniques to Remember Passwords  http://www.wikihow.com/Create-a-Password-You-Can- Remember  Note that some of the techniques are less secure!  One easy & secure way: password mnemonic  Think of a full sentence that you can remember  Ideally the sentence should have 8 or more words, with numbers and symbols  Use first character of each word as password  Sentence: I love reading all 7 Harry Potter books!  Password: Ilra7HPb!  Voila! Personal opinion. No legal responsibility assumed.
  • 45. Phishing E-mail
  • 46. Phishing E-mail
  • 47. Phishing E-mail
  • 48.  Poor grammar  Lots of typos  Trying very hard to convince you to open attachment, click on link, or reply without enough detail  May appear to be from known person (rely on trust & innocence) Signs of a Phishing Attack
  • 49.  Don’t be too trusting of people  Always be suspicious & alert  An e-mail with your friend’s name & info doesn’t have to come from him/her  Look for signs of phishing attacks  Don’t open attachments unless you expect them  Scan for viruses before opening attachments  Don’t click links in e-mail. Directly type in browser using known & trusted URLs  Especially cautioned if ask for passwords, bank accounts, credit card numbers, social security numbers, etc. Ways to Protect against Phishing
  • 50. Ransomware
  • 51. The Day We All WannaCry’ed http://www.mirror.co.uk/news/uk-news/ransomware-nhs-cyber-attack-live-10409420
  • 52. Infected with WannaCry https://cdn.securelist.com/files/2017/05/wannacry_05.png
  • 53. WannaCry: Infection Flow http://blog.trendmicro.com/trendlabs-security-intelligence/files/2017/05/WannaCry-infection-flow02.jpg
  • 54. WannaCry WannaCry & Medical Devices
  • 55. Petya/Petwrap/NotPetya https://www.bleepstatic.com/images/news/ransomware/p/notpetya/mbr-ransom-note.jpg
  • 56. Software Security
  • 57.  Consider a log-in form on a web page Example of Weak Input Checking: SQL Injection  Source code would look something like this: statement = "SELECT * FROM users WHERE name = '" + userName + "';"  Attacker would enter as username: ' or '1'='1  Which leads to this always-true query:  statement = "SELECT * FROM users WHERE name = '" + "' or '1'='1" + "';" statement = "SELECT * FROM users WHERE name = '' or '1'='1';" http://en.wikipedia.org/wiki/SQL_injection
  • 58.  Defense in Depth  Multiple layers of security defense are placed throughout a system to provide redundancy in the event a security control fails  Secure the weakest link  Promote privacy  Trust no one Some Security Principles Saltzer & Schroeder (1975), Viega & McGraw (2000) Adapted from Nicholas Hopper’s teaching slides for UMN Computer Security Class Fall 2006 CSCI 5271 http://en.wikipedia.org/wiki/Defense_in_depth_(computing)
  • 59.  Modular design  Check error conditions on return values  Validate inputs (whitelist vs. blacklist)  Avoid infinite loops, memory leaks  Check for integer overflows  Language/library choices  Development processes Secure Software Best Practices Adapted from Nicholas Hopper’s teaching slides for UMN Computer Security Class Fall 2006 CSCI 5271
  • 60. Malware
  • 61.  Malicious software - Any code with intentional, undesirable side effects  Virus  Worm  Trojan  Spyware  Logic Bomb/Time Bomb  Backdoor/Trapdoor  Rootkit  Botnet Malware
  • 62.  Virus  Propagating malware that requires user action to propagate  Infects executable files, data files with executable contents (e.g. Macro), boot sectors  Worm  Self-propagating malware  Trojan  A legitimate program with additional, hidden functionality Malware
  • 63.  Spyware  Trojan that spies for & steals personal information  Logic Bomb/Time Bomb  Malware that triggers under certain conditions  Backdoor/Trapdoor  A hole left behind by malware for future access Malware
  • 64.  Rogue Antispyware (Ransomware)  Software that tricks or forces users to pay before fixing (real or hoax) spyware detected  Rootkit  A stealth program designed to hide existence of certain processes or programs from detection  Botnet  A collection of Internet-connected computers that have been compromised (bots) which controller of the botnet can use to do something (e.g. do DDoS attacks) Malware
  • 65.  Installed & updated antivirus, antispyware, & personal firewall  Check for known signatures  Check for improper file changes (integrity failures)  Check for generic patterns of malware (for unknown malware): “Heuristics scan”  Firewall: Block certain network traffic in and out  Sandboxing  Network monitoring & containment  User education  Software patches, more secure protocols Defense Against Malware
  • 66.  Social media spams/scams/clickjacking  Social media privacy issues  User privacy settings  Location services  Mobile device malware & other privacy risks  Stuxnet (advanced malware targeting certain countries)  Advanced persistent threats (APT) by governments & corporations against specific targets Newer Threats
  • 67. Security Standards
  • 68. • ISO/IEC 27000 — Information security management systems — Overview and vocabulary • ISO/IEC 27001 — Information security management systems — Requirements • ISO/IEC 27002 — Code of practice for information security management • ISO/IEC 27003 — Information security management system implementation guidance • ISO/IEC 27004 — Information security management — Measurement • ISO/IEC 27005 — Information security risk management • ISO/IEC 27031 — Guidelines for information and communications technology readiness for business continuity • ISO/IEC 27032 — Guideline for cybersecurity (essentially, 'being a good neighbor' on the Internet) • ISO/IEC 27033-1 — Network security overview and concepts • ISO/IEC 27033-2 — Guidelines for the design and implementation of network security • ISO/IEC 27033-3:2010 — Reference networking scenarios - Threats, design techniques and control issues • ISO/IEC 27034 — Guideline for application security • ISO/IEC 27035 — Security incident management • ISO 27799 — Information security management in health using ISO/IEC 27002 Some Information Security Standards
  • 69.  US-CERT  U.S. Computer Emergency Readiness Team  http://www.us-cert.gov/  Subscribe to alerts & news  Microsoft Security Resources  http://technet.microsoft.com/en-us/security  http://technet.microsoft.com/en- us/security/bulletin  Common Vulnerabilities & Exposures  http://cve.mitre.org/ More Information
  • 70. Privacy & Security Laws
  • 71.  Respect for Persons (Autonomy)  Beneficence  Justice  Non-maleficence Ethical Principles in Bioethics
  • 72. Hippocratic Oath ... What I may see or hear in the course of treatment or even outside of the treatment in regard to the life of men, which on no account one must spread abroad, I will keep myself holding such things shameful to be spoken about. ... http://en.wikipedia.org/wiki/Hippocratic_Oath
  • 73. Privacy Safeguards Image: http://www.nurseweek.com/news/images/privacy.jpg  Security safeguards  Informed consent  Privacy culture  User awareness building & education  Organizational policy & regulations  Enforcement  Ongoing privacy & security assessments, monitoring, and protection
  • 74. HIPAA
  • 75.  Health Insurance Portability and Accountability Act of 1996 http://www.gpo.gov/fdsys/pkg/PLAW- 104publ191/pdf/PLAW-104publ191.pdf  More stringent state privacy laws apply  HIPAA Goals  To protect health insurance coverage for workers & families when they change or lose jobs (Title I)  To require establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers (Title II: “Administrative Simplification” provisions)  Administrative Simplification provisions also address security & privacy of health data U.S. Health Information Privacy Law http://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act
  • 76.  Title I: Health Care Access, Portability, and Renewability  Title II: Preventing Health Care Fraud and Abuse; Administrative Simplification; Medical Liability Reform  Requires Department of Health & Human Services (HHS) to draft rules aimed at increasing efficiency of health care system by creating standards for use and dissemination of health care information HIPAA (U.S.)
  • 77.  Title III: Tax-Related Health Provisions  Title IV: Application and Enforcement of Group Health Plan Requirements  Title V: Revenue Offsets HIPAA (U.S.)
  • 78.  HHS promulgated 5 Administrative Simplification rules  Privacy Rule  Transactions and Code Sets Rule  Security Rule  Unique Identifiers Rule  Enforcement Rule HIPAA (U.S.)
  • 79.  Covered Entities  A health plan  A health care clearinghouse  A healthcare provider who transmits any health information in electronic form in connection with a transaction to enable heal
  • Search Related
    We Need Your Support
    Thank you for visiting our website and your interest in our free products and services. We are nonprofit website to share and download documents. To the running of this website, we need your help to support us.

    Thanks to everyone for your continued support.

    No, Thanks
    SAVE OUR EARTH

    We need your sign to support Project to invent "SMART AND CONTROLLABLE REFLECTIVE BALLOONS" to cover the Sun and Save Our Earth.

    More details...

    Sign Now!

    We are very appreciated for your Prompt Action!

    x