NIST SPECIAL PUBLICATION 1800-1

---

Securing Electronic Health Records on Mobile Devices

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), How-To Guides (C), Standards and Controls Mapping (D), and Risk Assessment and Outcomes (E)

Gavin O’Brien

Nate Lesser

Brett Pleasant

Sue Wang

Kangmin Zheng

Colin Bowers

Kyle Kamke

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-1

The first draft of this publication is available free of charge from: https://www.nccoe.nist.gov/sites/default/files/library/sp1800/hit-ehr-nist-sp1800-1-draft.pdf

NIST SPECIAL PUBLICATION 1800-1

Securing Electronic Health Records on Mobile Devices

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), How-To Guides (C), Standards and Controls Mapping (D), and Risk Assessment and Outcomes (E)

Gavin O’Brien

Nate Lesser

National Cybersecurity Center of Excellence

Information Technology Laboratory

Brett Pleasant

Sue Wang

Kangmin Zheng

The MITRE Corporation

McLean, VA

Colin Bowers

Kyle Kamke

Ramparts, LLC

Clarksville, MD

July 2018

U.S. Department of Commerce

Wilbur Ross, Secretary

National Institute of Standards and Technology

Walter Copan, Undersecretary of Commerce for Standards and Technology and Director

• Volume A
  • Executive Summary
    • Challenge
    • Solution
    • Assess Your Risk
    • Share Your Feedback
    • Technology Partners/Collaborators

• Volume B
  • 1. Summary
    • 1.1. Background
    • 1.2. Challenge
    • 1.3. Solution
    • 1.4. Assess Your Risk
  • 2. How to Use This Guide
    • 2.1. Typographic Conventions
  • 3. Approach
    • 3.1. Audience
    • 3.2. Scope
    • 3.3. Risk Management
    • 3.4. The Use Case
    • 3.5. Security Characteristics
    • 3.6. Technologies
  • 4. Architecture
    • 4.1. Methodologies
      • 4.1.1. Defense-in-Depth
      • 4.1.2. Modular Networks and Systems
      • 4.1.3. Traditional Engineering Practices
    • 4.2. Architecture Description
      • 4.2.1. Organizational Architecture
    • 4.3. Security Characteristics
      • 4.3.1. Access Control
      • 4.3.2. Audit Controls and Monitoring
      • 4.3.3. Device Integrity
      • 4.3.4. Person or Entity Authentication
      • 4.3.5. Transmission Security

• Volume C
  • 1. Introduction
    • 1.1. Practice Guide Structure
    • 1.2. Typographic Conventions
  • 2. Operating Systems
    • 2.1. Windows Installation and Hardening
      • 2.1.1. Windows System Requirements
      • 2.1.2. Windows Installation
      • 2.1.3. Windows Post-Installation Tasks
      • 2.1.4. Windows Security Hardening
    • 2.2. Linux Installation and Hardening
      • 2.2.1. Linux Installation
      • 2.2.2. Linux Post-Installation Tasks
      • 2.2.3. Linux Security Hardening
  • 3. Basic Network Infrastructure Services
    • 3.1. Hostnames
    • 3.2. Bind Domain Name System (DNS) and Domain Names Search Engine (DNSE) Installation and Hardening
      • 3.2.1. Bind DNS Setup
    • 3.3. Firewalls: IP Tables
    • 3.4. Intrusion Detection System (IDS)
      • 3.4.1. Security Onion
  • 4. Configuration Management
    • 4.1. Puppet Setup
      • 4.1.1. Pre-installation Tasks
      • 4.1.2. Installation Instructions
      • 4.1.3. Post-Installation Tasks
    • 4.2. Puppet Enterprise Configuration
      • 4.2.1. Puppet.conf
      • 4.2.2. Manifests
      • 4.2.3. Templates
      • 4.2.4. Modules
      • 4.2.5. Puppet Enterprise Web-Based Reporting Installation and Configuration
    • 4.3. Production Web Server
  • 5. Backup
    • 5.1. UrBackup Server Setup
    • 5.2. UrBackup Client Setup
  • 6. Certificate Authority
    • 6.1. Fedora PKI Manager
    • 6.2. Post-Installation
  • 7. Identity and Access Controls
    • 7.1. Cisco Identity Services Engine
    • 7.2. Cisco ISE Post-Installation Tasks
    • 7.3. Configure Cisco ISE to Support EAP-TLS Authentication
      • 7.3.1. Set ISE to support RADIUS authentication
      • 7.3.2. Enable PKI in Cisco ISE
      • 7.3.3. Populate Certificate Store with Required CA-Signed Certificates
      • 7.3.4. Set Identity Source for Client Certificate Authentication
      • 7.3.5. Set Authentication Protocols
      • 7.3.6. Configure Cisco ISE to Integrate with Fiberlink MaaS360
      • 7.3.7. Configure Cisco ISE to Authorization Policy
  • 8. Remote Office Network Configuration
    • 8.1. Access Point: Cisco RV220W
      • 8.1.1. Cisco RV220 AP Setup
      • 8.1.2. Post-Setup Tasks
      • 8.1.3. Cisco RV220 AP Setup for RADIUS Authentication
  • 9. Virtual Private Network Using Intel Identity Protection Technology with PKI
    • 9.1. Microsoft Enterprise CA Server Installation
    • 9.2. Add the Intel IPT Cryptography Service Provider to Microsoft Enterprise CA Server
    • 9.3. Set Up Client Device for VPN by Using Intel Identity Protection Technology with PKI
    • 9.4. Cisco ASAv VPN Server Configuration
    • 9.5. Test and Confirmation
  • 10. Hosts and Mobile Device Security
    • 10.1. Mobile Devices
      • 10.1.1. Android Mobile Device Setup
      • 10.1.2. Apple Mobile Devices Setup
    • 10.2. MaaS360
      • 10.2.1. MDM Setup
    • 10.3. Host-Based Security
      • 10.3.1. Symantec Endpoint Protection Suite
  • 11. Governance, Risk, and Compliance
    • 11.1. RSA Archer GRC
      • 11.1.1. System Requirements
      • 11.1.2. Pre-installation
      • 11.1.3. Installation
      • 11.1.4. Post-Installation
      • 11.1.5. Content Setup for Establishing GRC Process

• Volume D
  • 1. Practice Guide Structure
  • 2. Introduction
  • 3. Security Standards
  • 4. Security Characteristics and Controls
  • 5. Technologies

• Volume E
  • 1. Practice Guide Structure
  • 2. Introduction
  • 3. Results
  • 4. Security Controls Assessment
    • 4.1. Security Scenario Assessment
      • 4.1.1. Lost Mobile Device Scenario
      • 4.1.2. Internal Network Access Scenario
      • 4.1.3. OpenEMR Access Scenario
      • 4.1.4. Physical Access Scenario
    • 4.2. Functional Assessment
      • 4.2.1. Send a Referral
      • 4.2.2. Send a Prescription
    • 4.3. Security Assessment
  • 5. Risk Assessment Methodology
    • 5.1. Table-Driven Risk Assessment Example
    • 5.2. Ramparts’ Attack/Fault Tree-Driven Risk Assessment Example
  • 6. Risk Assessment Results
  • 7. Tests Performed in Security Controls Assessment
  • 8. Risk Questionnaire for Healthcare Organizations Selecting a Cloud-Based Electronic Health Record Provider
    • 8.1. Introduction
    • 8.2. Security Questionnaire