Federal Information Security Research Articles

Grayson Insurance Cybersecurity Strategic Plan Part 1

Grayson Insurance, as the name suggests, is an insurance company, which operates in the U.S and all across Europe. In recent weeks, we conducted an assessment on some of the cybersecurity policies that affect our company, including the Federal Information Security Management Act (FISMA) and the General Data Protection Regulation (GDPR). This was followed by conducting a risk assessment on some of the most important information assets that Grayson Insurance uses, including customer data, employee information, patient medical records, and company information. Some of the vulnerabilities that were uncovered from the assessment include phishing attacks, insider threats, data breaches through cyberattacks, and intellectual property theft. The next step is to come up with a Strategic Cybersecurity Plan that is aligned with Grayson Insurance’s business and IT priorities.

Evaluating State Cybersecurity Laws and Regulations in United States

In the United States, cybersecurity laws and regulations are necessary to protect vital infrastructure, sensitive information or individuals' personal privacy. The present state of cybersecurity law and regulation at both national and local levels is assessed in this review paper. The report gives an overview of the key legislation and initiatives, analyses their efficiency, and reveals new trends. The research method comprises a thorough analysis of academic literature, government publications, official websites, legal sources, news items and experts' reports. The paper begins by pointing out the importance of cybersecurity in today's interconnected world, where cyber threats are constantly evolving and posing major risks to individuals, organizations and national governments. The report draws attention to studies which show that businesses have suffered financially and may face disruption in the core infrastructure as a result of cybercrime. Key legislation, such as the Federal Information Security Modernization Act, and the role of agencies such as the Cybersecurity and Infrastructure Security Agency (CISA), and the National Institute of Standards and Technology (NIST), are covered in the overview of federal cybersecurity legislation and regulations. The scope, effectiveness and implications of such national measures to address cyber security challenges shall be assessed in the evaluation. New trends in cybercrime legislation, such as an increase in data breach reporting requirements and a focus on security of essential infrastructures are identified in the review paper. It examines legislative efforts to strengthen cybersecurity capabilities in key sectors such as healthcare. Consideration shall be given to the strengths and weaknesses of the existing legal framework, as well as recommendations for strengthening cybersecurity laws and regulations. Keywords: Cybersecurity Laws, Cybersecurity Regulations, Federal Legislation, State Initiatives, Data Breach Notification, Legislative Efforts. Aims Research Journal Reference Format: Yamcharoen P., Bayewu, A., Ojo, T.P. & Fatoye O.E. (2022): Evaluating State Cybersecurity Laws and Regulations in United States. Advances in Multidisciplinary and Scientific Research. Vol. 8. No. 3, Pp 47–56. www.isteams.net/aimsjournal. dx.doi.org/10.22624/AIMS/V8N3P4

Insights from Adopting a Data Commons Approach for Large-scale Observational Cohort Studies: The California Teachers Study.

Large-scale cancer epidemiology cohorts (CEC) have successfully collected, analyzed, and shared patient-reported data for years. CECs increasingly need to make their data more findable, accessible, interoperable, and reusable, or FAIR. How CECs should approach this transformation is unclear. The California Teachers Study (CTS) is an observational CEC of 133,477 participants followed since 1995-1996. In 2014, we began updating our data storage, management, analysis, and sharing strategy. With the San Diego Supercomputer Center, we deployed a new infrastructure based on a data warehouse to integrate and manage data and a secure and shared workspace with documentation, software, and analytic tools that facilitate collaboration and accelerate analyses. Our new CTS infrastructure includes a data warehouse and data marts, which are focused subsets from the data warehouse designed for efficiency. The secure CTS workspace utilizes a remote desktop service that operates within a Health Insurance Portability and Accountability Act (HIPAA)- and Federal Information Security Management Act (FISMA)-compliant platform. Our infrastructure offers broad access to CTS data, includes statistical analysis and data visualization software and tools, flexibly manages other key data activities (e.g., cleaning, updates, and data sharing), and will continue to evolve to advance FAIR principles. Our scalable infrastructure provides the security, authorization, data model, metadata, and analytic tools needed to manage, share, and analyze CTS data in ways that are consistent with the NCI's Cancer Research Data Commons Framework. The CTS's implementation of new infrastructure in an ongoing CEC demonstrates how population sciences can explore and embrace new cloud-based and analytics infrastructure to accelerate cancer research and translation.See all articles in this CEBP Focus section, "Modernizing Population Science."

Issues of the Culture of Information Security under the Conditions of the Digital Economy

Abstract—A contradiction has been revealed between world trends in the development of human competencies (an organization employee in the field of information security and a citizen), reflected in international law and in foreign social science and practice, and the content of the tasks of the federal project Information Security of the national program Digital Economy of the Russian Federation (2018) The limited implementation of the literacy system in the field of cybersecurity as a planned result of this program is shown. The active subjective role of the user of digital resources in ensuring information security in a culture of digital society and the digital economy is substantiated. The requirements of the culturological approach to this role are described. The content of the concept of information security culture, factors affecting its level, as well as the problem of its development in the new conditions are revealed.

Blockchain Compliance With Federal Cryptographic Information-Processing Standards

Under current Federal Information Security Management Act of 2002 (FISMA) requirements, all new federal IT programs and modernization efforts using blockchain must meet National Institute of Standards and Technology (NIST) cryptographic standards. This article evaluates four major blockchain technologies-Ethereum, Hyperledger Fabric, R3's Corda, and Multichain-to determine their level of NIST compliance.

Blockchain Compliance with Federal Cryptographic Information Processing Standards

Under current Federal Information Security Management Act of 2002 (FISMA) requirements, all new Federal information technology (IT) programs and modernization efforts using blockchain must meet National Institute of Standards and Technology (NIST) cryptographic standards. This report evaluates four major blockchain technologies – Ethereum, Hyperledger Fabric, R3's Corda, and Multichain – to determine their level of NIST compliance. The intent is to provide Federal IT managers with the critical information they need to determine which blockchain platforms may be used in their projects.

Implementing Practical Risk Control Using U.S. Government Standards

This article presents the standard basis for implementing the information security control structures recommended by the U.S. Federal Government for compliance with the Federal Information Security Management Act of 2002 (FISMA). The process recommendations contained here create a detailed baseline of practical controls for any information security application in both government and industry.

Information security for compliance with select agent regulations.

The past decade has seen a significant rise in research on high-consequence human and animal pathogens, many now known as "select agents." While physical security around these agents is tightly regulated, information security standards are still lagging. The understanding of the threats unique to the academic and research environment is still evolving, in part due to poor communication between the various stakeholders. Perhaps as a result, information security guidelines published by select agent regulators lack the critical details and directives needed to achieve even the lowest security level of the Federal Information Security Management Act (FISMA). While only government agencies are currently required to abide by the provisions of FISMA (unless specified as preconditions for obtaining government grants or contracts--still a relatively rare or narrowly scoped occurrence), the same strategies were recently recommended by executive order for others. We propose that information security guidelines for select agent research be updated to promulgate and detail FISMA standards and processes and that the latter be ultimately incorporated into select agent regulations. We also suggest that information security in academic and research institutions would greatly benefit from active efforts to improve communication among the biosecurity, security, and information technology communities, and from a secure venue for exchange of timely information on emerging threats and solutions in the research environment.

Cybersecurity: What About U.S. Policy?

During December 2014, just hours before the holiday recess, the U.S. Congress passed five major legislative proposals designed to enhance U.S. cybersecurity. Following signature by the President, these became the first cybersecurity laws to be enacted in over a decade, since passage of the Federal Information Security Management Act of 2002. My goal is to explore the unusually complex subject of cybersecurity policy in a highly readable manner. An analogy with the recent deadly and global Ebola epidemic is used to illustrate policy challenges, and hopefully will assist in transforming the technological language of cybersecurity into a more easily understandable story. Much like Ebola, cyberthreat has the ability to bring our cities to a standstill. Many cybersecurity policy implications are strikingly similar to those occasioned by Ebola.First, a brief recital of the grave danger and potential consequences of cyberattack is provided. Second, I comment on the policy impact resulting from rapid changes in technological complexity and the relative lack of computer familiarity on the part of many senior business and governmental leaders. Third, the characteristics of selected competing cybersecurity constituency groups are discussed: consumers; investors; law enforcement; business; federal, state and local government; and national security interests. By exploring the perceived needs and sometimes conflicting actions of these various constituencies, I hope to make a worthwhile contribution to the national conversation about cyber policy and make meaningful progress toward dealing with the new pandemic of technological virus. Next, is an examination of recent policy development milestones achieved during the past decade or so, including passage of several major legislative proposals designed to enhance U.S. cybersecurity during the waning hours of 2014: The National Cybersecurity Protection Act of 2014; The Federal Information Security Modernization Act of 2014; The Cybersecurity Workforce Assessment Act; The Homeland Security Workforce Assessment Act; and The Cybersecurity Enhancement Act of 2014. Finally, given the critical need for an immediate and effective coordinated approach to cybersecurity, a few thoughts about crafting policy goals and strategies are offered. Hopefully this essay will assist in the conversation being had today by policy makers on this important topic.

Analysis of the Security and Privacy Requirements of Cloud-Based Electronic Health Records Systems

BackgroundThe Cloud Computing paradigm offers eHealth systems the opportunity to enhance the features and functionality that they offer. However, moving patients’ medical information to the Cloud implies several risks in terms of the security and privacy of sensitive health records. In this paper, the risks of hosting Electronic Health Records (EHRs) on the servers of third-party Cloud service providers are reviewed. To protect the confidentiality of patient information and facilitate the process, some suggestions for health care providers are made. Moreover, security issues that Cloud service providers should address in their platforms are considered.ObjectiveTo show that, before moving patient health records to the Cloud, security and privacy concerns must be considered by both health care providers and Cloud service providers. Security requirements of a generic Cloud service provider are analyzed.MethodsTo study the latest in Cloud-based computing solutions, bibliographic material was obtained mainly from Medline sources. Furthermore, direct contact was made with several Cloud service providers.ResultsSome of the security issues that should be considered by both Cloud service providers and their health care customers are role-based access, network security mechanisms, data encryption, digital signatures, and access monitoring. Furthermore, to guarantee the safety of the information and comply with privacy policies, the Cloud service provider must be compliant with various certifications and third-party requirements, such as SAS70 Type II, PCI DSS Level 1, ISO 27001, and the US Federal Information Security Management Act (FISMA).ConclusionsStoring sensitive information such as EHRs in the Cloud means that precautions must be taken to ensure the safety and confidentiality of the data. A relationship built on trust with the Cloud service provider is essential to ensure a transparent process. Cloud service providers must make certain that all security mechanisms are in place to avoid unauthorized access and data breaches. Patients must be kept informed about how their data are being managed.

PS1-46: HMORNnet: Shared Infrastructure for Distributed Querying by HMORN Collaboratives

Background/Aims The HMO Research Network (HMORN) is at the forefront of the development and operation of distributed research networks for secondary use of routinely collected health information. PopMedNetTM is a distributed querying platform developed by HMORN investigators to meet HMORN and other large-scale distributed networks needs. PopMedNet is serving as the distributed querying platform for several large multi-site projects, including the FDA Mini-Sentinel and the Scalable PArtnering Network for CER: Across Lifespan, Conditions, and Settings. The substantial overhead costs associated with use of PopMedNet for HMORN activities would be best shared across projects. The ability to share secure infrastructure while maintaining compliance with national security and privacy standards such as those embodied in the Federal Information Security Management Act and those required by HMORN health plans was uncertain.

Frontlines: Are You Secure?

As most of my friends would tell you, I'm not the world's most tech-savvy guy. The clock on my VCR (remember those?) always seemed to be blinking, and for the longest time my home computer teetered on the verge of a complete breakdown. I won't tell you how long I had dial-up service.One evening, my home computer crashed, likely done in by virus or worm that I had neglected to protect against. A friend was able to resurrect my computer, clean it up, and install new firewalls and virus protection. I've since gotten a new laptop and am far more diligent about keeping it secure and bug-free.The crash was a valuable lesson learned but, in truth, it came at little cost to me. Sure, I was out of a home computer for a few days, but it was little more than a hassle.Can anyone say the same about the potential threats posed to healthcare in an increasingly “networked” world, that any disruption of service would be a mere hassle? I think not.There's a whole new world of healthcare because of the incredible advances in technology. Medical devices are doing things today—in some cases virtually talking to one another—that might have seemed pure fantasy only 10 years ago. But with that great potential come new risks to patient safety.The federal Information Security and Privacy Advisory Board recently put it this way: “With increasing connectivity comes greater functionality and manageability, but also increased risks of both unintentional interference and malicious tampering via these communication channels.”Of more concern, says the board, is that there is a “diffusion of responsibility” when it comes to the cybersecurity of medical devices, making it harder to tackle the issue.Our cover story examines the functional risks to medical devices and the vulnerability of patient information. The article provides some tips on what healthcare technology management professionals can do to help their facilities move forward in protecting their devices—and their patients.Do you have tips or other ideas to share? Please write. Your colleagues want to know.

Information system security compliance to FISMA standard: a quantitative measure

To ensure that safeguards are implemented to protect against a majority of known threats, industry leaders are requiring information processing systems to comply with security standards. The National Institute of Standards and Technology Federal Information Risk Management Framework (RMF) and the associated suite of guidance documents describe the minimum security requirements (controls) for non-national-security federal information systems mandated by the Federal Information Security Management Act (FISMA), enacted into law on December 17, 2002, as Title III of the E-Government Act of 2002. The subjective compliance assessment approach described in the RMF guidance, though thorough and repeatable, lacks the clarity of a standard quantitative metric to describe for an information system the level of compliance with the FISMA-required standard. Given subjective RMF assessment data, this article suggests the use of Pathfinder networks to generate a quantitative metric suitable to measure, manage, and track the status of information system compliance with FISMA.

Challenges in Certification and Accreditation

As the threat of malicious activity through the Internet increased, the US government began reviewing protection requirements for national and international security systems. Legislation resulting from this review included the Federal Information Security Management Act (FISMA), the Paperwork Reduction Act of 1995, and the Information Technology Management Reform Act of 1996 (also known as the Clinger-Cohen Act). This legislation sought to foster trust between the government and the public through significant security improvements in these systems. To this end, it the government established a peer-review process we've come to know as certification and accreditation, or C&A.

Managing The Legal Risks Related to Information Security

Information security has become a critical issue. The risks of computer hackers, computer viruses ana worms, identity theft, denial of service attacks, theft, terrorist attacks, sabotage, surveillance and intrusion by competitors and malicious acts by disgruntled employees, among other vulnerabilities, are increasing at an alarming exponential rate. Managing the risks from these unprecedented threats to the enterprise has become a vital risk management concern for the company's board of directors and top management, with the result that effective security programs have become a necessity. Prudent risk management and due care with respect to security programs are necessary to avoid potential liability. Information security is a risk management process to protect the confidentiality, integrity and availability of systems and content. The federal Information Security Act of 2002 (44 U.S.C. § 3542) defines Security as ... protecting and systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide - (A) integrity, which means guarding against improper modification or destruction and includes ensuring nonrepudiation and authenticity; (B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and (C) availability, which means ensuring timely and reliable access to and use of information. This article examines the evolving standard in the United States to provide reasonable security requiring a risk-based process to develop and maintain a comprehensive security program. This process is based upon recent Federal Trade Commission (FTC) consent orders relating to security. The FTC has significantly broadened the scope of its enforcement actions by asserting that a failure to provide appropriate security was, itself, an unfair trade practice in violation of Section 5 of the FTC Act. These information security FTC cases are very instructive in defining the scope and extent of a company's legal obligation to implement security measures. These cases point to the emergence of a standard respecting security. They demonstrate that security is no longer just good business practice. Information security has become a obligation.

The State of Information Security Law: A Focus on the Key Legal Trends

Information security is rapidly emerging as one of the most critical legal issues facing companies today. Concerns regarding corporate governance, individual privacy, accountability for financial i...

Regulatory Compliance — the Wonderful World of FISMA

The Federal Information Security Management Act of 2002,* FISMA, was enacted into U.S. law by the 107th Congress on December 17, 2002, as part of the E-Government Act. Designed to help improve the ...

Managing Enterprise Security Risk with NIST Standards

Federal agencies and private-sector organizations are increasingly concerned with the risks that today's sophisticated cyberthreats pose to critical enterprise missions and business functions. Federal Information Security Management Act (FISMA) established sweeping information security (IS) requirements for the federal government and contractors, and it made the National Institute of Standards and Technology (NIST) responsible for developing IS standards and guidelines to allow for compliance. NIST faced the challenging task of establishing mandatory minimum IS standards and guidelines for the federal government and supporting contractors, while ensuring flexible implementation based on diverse missions and business functions.

정보보호 강화를 위한 예산편성 제도화 방안 연구

국가 및 공공기관의 정보시스템에 대한 해킹 등의 보안사고 발생이 증대하고 있으나 첨단화되는 공격 기술 등에 체계적으로 대응하기 위한 정보보안 대책 마련에 활용되는 예산 사용의 근거가 미미한 실정이며, 정보화와 정보보안의 양면에 적절한 투자가 이루어져야함에도 불구하고 정보화 분야에 불균형적으로 예산 투자가 이루어지고 있다. 이에 국가기관의 정보보안 예산 현황을 정확히 파악하고 각 기관의 정보보안 강화를 위한 예산 확보 및 사용 근거를 마련하기 위해 정보보안 예산 효율화, 정보보안 예산 산정.집행의 근거 마련, 정보보안예산 직접 마련, 정보보안수준에 따른 정보화 예산 배정 및 정보보안 관리체계 개선 등을 통한 예산 제도화를 위한 방안을 고찰해보고자 한다. US is strengthening the information security by managing federal agency's information and information system systematically. For this purpose. US government put the Federal Information Security Management Act into the E Government Act of 2002. According to the FISMA, it is required to have information securitv management plan for all federal agencies. In addition that, OMB Circular A II requires all federal agencies to identity the ratio of information security investment. That is the basis of strengthening the information security of federal agency, This paper will compare the budget status and information security mechanism of Korea and US.

Cybersecurity: Welcome to My World

The Ginger Cohen Act of 1998 assigned responsibility for ensuring cybersecurity within US federal organizations to the chief information officer, and the Federal Information Security Management Act underscored that responsibility. Every federal CIO is required to report to the Office of Management and Budget quarterly on the status of critical systems. What exactly does it mean to be responsible for cybersecurity? For a CIO, however, ensuring cybersecurity means all that and a lot more. Frequently, it involves learning a whole new language and anticipating previously unheard of threats. It means overseeing a layered defence strategy that spans technical, organizational, and operational control; establishing policies and procedures binding the use community's access to the organization's IT resources; and learning the intricacies of such things as firewalls, intrusion detection, and content-filtering capabilities