Continuous risk assessment for electronic protected health information
Methods and systems for continuously and quantitatively assessing the risk to data confidentiality, integrity, and availability on identified on endpoints, servers, medical devices, and “Internet of things” devices in a networked healthcare environment monitor resource requests by user applications running on the various device. A map of resource usage by each application may be generated. Based on the map and a risk model (e.g., the contents of a risk database), application events associated with risks are detected and resources vulnerable to the risk may be identified.
1. A computational system comprising:
a. a processor;
b. an operating system;
c. a computer memory;
d. a plurality of user applications;
e. a risk database;
f. a vulnerabilities database; and
g. at least one agent executable by the processor and configured to
(i) monitor resource requests by the user applications and, based thereon, generate a map of resource usage by each application, the map identifying dependent system resources requested by the applications and security controls that govern read/write access to such resources;
(ii) based on the map and the risk database, detect application events associated with risks;
(iii) upon detection of an event corresponding to a risk, check the event against a minimum cut set of vulnerabilities stored in the vulnerabilities database, wherein the minimum cut set of vulnerabilities is the smallest set of individual component faults required to trigger a root-level fault; and
(iv) determine a set of resources vulnerable to the risk and, based thereon, take an action, wherein a resource is a physical or logical capability managed by the operating system.
2. The system of claim 1 , wherein the action is issuing an alert to a supervisory node responsible for the determined set of resources.
3. The system of claim 1 , wherein the action is updating a computational system-wide risk model.
4. The system of claim 1 , wherein the system is an endpoint device.
5. The system of claim 4 , wherein the system includes an independent sensor associated with each of the user applications.
6. The system of claim 4 , wherein the system includes a single sensor responsible for all of the user applications.
7. The system of claim 1 , wherein the system is a server hosting user application for multiple endpoint devices and users.
8. The system of claim 7 , wherein the system includes an independent sensor associated with each of the user applications.
9. The system of claim 8 , wherein each of the user applications is hosted for multiple simultaneous user sessions.
10. The system of claim 7 , wherein the system includes a single sensor responsible for all of the user applications.
11. A method of detecting and responding to computational risks in a computational system comprising a processor, an operating system, a computer memory, and a plurality of user applications, the method comprising the steps of:
monitoring resource requests by the user applications and, based thereon, generate a map of resource usage by each application, the map identifying dependent system resources requested by the applications and security controls that govern read/write access to such resources;
based on the map and a risk database, detect application events associated with risks;
upon detection of an event corresponding to a risk, check the event against a minimum cut set of vulnerabilities stored in a vulnerabilities database, wherein the minimum cut set of vulnerabilities is the smallest set of individual component faults required to trigger a root-level fault; and
determining a set of resources vulnerable to the risk and, based thereon, taking an action, wherein a resource is a physical or logical capability managed by the operating system.
12. The method of claim 11 , wherein the action is issuing an alert to a supervisory node responsible for the determined set of resources.
13. The method of claim 11 , wherein the action is updating a system-wide computational risk model.
14. The method of claim 11 , wherein the system is an endpoint device.
15. The method of claim 14 , wherein the system includes an independent sensor associated with each of the user applications.
16. The method of claim 14 , wherein the system includes a single sensor responsible for all of the user applications.
17. The method of claim 11 , wherein the system is a server hosting user application for multiple endpoint devices and users.
18. The method of claim 17 , wherein the system includes an independent sensor associated with each of the user applications.
19. The method of claim 18 , wherein each of the user applications is hosted for multiple simultaneous user sessions.
20. The method of claim 17 , wherein the system includes a single sensor responsible for all of the user applications.