NewTab Project Profile

Refer to this project profile as you complete the Wk 2 – Security Assessment Plan, the Wk 4 – Incident Response Plan and Penetration Testing Agreement, and the Wk 5 – Strategic Plan assignments.

Scenario

The health care organization is adding a tablet (iPad^® 2, iOS 8.0.1) to its personnel reporting information system, called HI-PHI.  It will be attached to the health care organization ’s secured network infrastructure.

NewTab provides the health care organization with the capability to view and modify Protected Health Information (PHI) from the master registration database on a mobile device (i.e., iPad^®). The PHI is transmitted wirelessly to the iPad^® into HI-PHI.

User Community: 25 users (doctors)

Data: HI-PHI includes protected health information (PHI)

NewTab Suite

·        iPads^®:

o   Model: iPad^® 2, iOS 8.0.1

o   Pre-loaded with standard iOS apps

o   Use standard 6-number passcode to access iPad^®

o   Use VPN client to remotely access health care organization network with user’s network account login

o   Within the network, the iPad^® automatically connects to health care organization ’s wireless network

·        HI-PHI Application:

o   Uses single sign-on (from network account) to log into HI-PHI

o   Accesses PHI from the PHI database

·        PHI Database (protected health information)

Architecture

Security Requirement Control Families

Note: A detailed description of these families can be found in FIPS Publication 200.

1.      AC                   Access Control

2.      AT                    Awareness and Training

3.      AU                   Audit and Accountability

4.      CP                   Contingency Planning

5.      IA                     Identification and Authentication

6.      IR                     Incident Response

7.      MP                   Media Protection

8.      PE                    Physical and Environmental Protection

9.      PS                    Personnel Security

10.   SC                   System and Communications Protection

11.   SI                     System and Information Integrity

List of Vulnerabilities Discovered From a Security Test and Evaluation

Vulnerability #1: Tools for the review of audit records and the reports generated from audit records are not available. Audit records do not include some or all of the mandatory data. The contents of audit trails are not protected against unauthorized access, modification, or deletion.

Vulnerability #2: The authentication required to access the iPads^®, once screen-locks are activated, are not unique to each device. Non-unique authentication for screen unlock is utilized throughout system. All iPads^® are set to the same screensaver unlock password.

Vulnerability #3: No information security personnel training plan has been developed that identifies initial and refresher training and familiarization requirements for assigned information security roles.  

Vulnerability #4: iPads^® are not configured to enforce the password stringency required by NIST Policy. The iPads^® are not configured to enforce the required password strength, complexity, and aging. The health care organization senior leadership has specified that passwords will have a minimum of 12 characters using at least one upper case character, one lower case character, a number, and a special character. The policy will also enforce mandatory changing of passwords after every 90 days.

Vulnerability #5: The iPads^® are not stored and locked in a secured location when employees are not using them. There is no policy for employees to sign out iPads^®.

Vulnerability #6: There is no set of Employee Rules of Behaviors for users to sign holding them accountable for their actions.

Vulnerability #7: There is no mobile device management capability.

Financial Plan for Implementation of the Information Security Organization

1.      Total Annual Infrastructure Budget:              $1.2 million (hardware, software, licenses, spares, etc.)

2.      Total Annual Supplies Budget:                     $0.2 million (user computers, batteries, etc.)

3.      Total Annual Personnel Budget:                   TBD (will be determined in Week 5 financial plan)

4.      Total Training Budget:                                 TBD (will be determined in Week 5 financial plan)

The Total Annual Operating Budget will be the sum of the 4 areas above.

The Infrastructure Budget includes SOC equipment which is to include SIEM servers and software (e.g., vulnerability scanners, log correlation, event monitoring).

Information Security Personnel Resources