©2014 mfmer | slide-1 · 2018-03-31 · ©2014 mfmer | slide-10 “today the only this that is...

©2014 MFMER | slide-1

http://youtu.be/t0U86sBPcxc

http://youtu.be/t0U86sBPcxc


“BEYOND COMPREHENSION”

“AMAZING”

“I CAN’T BELIEVE IT”

“SO WELL THOUGHT OUT, SO

WELL PLANNED”

“IT WAS DONE” (EASY)

“OFFER HELP”

“IT’S JUST THE WAY IT IS”


“Will my information be secure?”


KATE PALMER, HRIS ANALYST

LEHRN @ MAYO

FEBRUARY, 27 2015


• THE LANDSCAPE

• OUR FOUNDATION

• OUR APPROACH

• NEXT STEPS

• CONSTANT CHANGE

©2014 MFMER | slide-7©2013 MFMER | slide-7

TECHNOLOGYHAS CHANGED US…

Mayo Clinic | Office of Information Security | 2014


…IN USABILITY.• NO LOGIN

– JUST PUT ME THERE

• LESS CLICKS

– EVERYTHING IN ONE PLACE

• LESS TIME

– SEE MY CHANGE NOW

…FROM SECURITY.• DUAL AUTHENTICATION

• MULTIPLE LAYERS

• SEND DATA AT LESSER INTERVALS


“TODAY THE ONLY

THIS THAT IS

PERMANENT IS

CHANGE”DR. CHARLIE

MAYO, APRIL

1930

“I LOOK THROUGH A HALF

OPENED DOOR INTO THE

FUTURE, FULL OF INTEREST, INTRIGUING BEYOND MY POWER

TO DESCRIBE, BUT WITH A FULL

UNDERSTANDING THAT IT IS FOR

EACH GENERATION TO SOLVE ITS

OWN PROBLEMS AND THAT NO

MAN HAS THE WISDOM TO GUIDE

OR CONTROL THE NEXT

GENERATION”DR. WILLIAM J MAYO,OCTOBER 1931


• CONFIDENTIAL INFORMATION

• E-MAIL HOST SECURITY

• IDENTITY MANAGEMENT FOR MAYO CLINIC ONLINE SERVICES

• INACTIVE SESSIONS

• INFORMATION INTEGRITY CONTROLS

• INFORMATION SECURITY GOVERNANCE

• MAYO SYSTEMS ADMINISTERED BY CONTRACTORS

• PORTABLE COMPUTING AND TELECOMMUNICATIONS DEVICES

• REMOTE ACCESS

…AND MORE…


• SOLID DISCUSSIONS, DOCUMENTED

• NEED TO HAVE + NICE TO HAVE

• NOT JUST FUNCTIONAL AND SYSTEMATIC, REMEMBER

THE EXPERIENCE.


Purchase

• Partnership with contracting

• Partnership with IT

• Partnership with Information Security

Implement


• Partnership with Vendor

Support


• Partnership with Information Security

OUR APPROACH


Purchase

HR Technology

(Coordinate)

Contracting

Human Resources

Information Technology

Information Security

Others


• RFI / DEMOS

• VENDOR STABILITY

• ARCHITECTURE REVIEW

• SECURITY

• DATA WAREHOUSE

• ACCESS MANAGEMENT

• SSO

• INTERNATIONAL SUPPORT? WHERE? (+/-)

• CONTROLS

• DSR

Purchase


• RFP / CONTRACTS

• DATA TRANSMISSION REVIEW

• VOLUME

• FREQUENCY

• DATA RETENTION

• MODE OF DISPOSAL

• INCOMING/OUTGOING DATA

• DATA TRANSMISSION METHOD (ENCRYPTION)

• WHO HAS ACCESS?

• HAVE THEY EXPERIENCED A DATA BREACH?

• SUB-CONTRACTORS? (BACKGROUND CHECKS)

Purchase


• RFP / CONTRACTS (CONT.)• DEPENDENT ON CONTRACT SOME ITEMS

REFERENCED DIRECTLY WITHIN CONTRACT

DOCUMENTATION OR AS ADDENDUM

• PROTECTION AGAINST MALICIOUS ATTACKS

Purchase


• NAME (INITIALS)

• ADDRESS

• SSN

• BIRTH DATE

• PHONE

• E-MAIL

• WAGE / SALARY

• ACCOUNT NUMBERS

• DEVICE IDS

• BENEFICIARIES

• DRIVERS LICENSE

• VEHICLE ID

• CREDIT CARD

*PERSONALLY IDENTIFIABLE INFORMATION


Implement

HR Technology

(Lead)

Vendor

Human Resources

Information Technology

Information Security

Others


• DOCUMENTATION IN-HOUSE

• NO GOOGLE DRIVE AND DROPBOX

• ENCRYPTED EMAILS WITH VENDOR

• BUSINESS INFORMATION +PII

• DATA TRANSMISSION

• SFTP

• ONLY SEND WHAT IS NECESSARY

Implement


• WORK ACCOUNTS

• TRUSTED USERS – PEOPLE

• IDENTITY PROOFING

• TRUSTED USERS – SYSTEMS

• SYSTEM-GENERATED COMMUNICATIONS

• WHITE LIST WHERE POSSIBLE (SERVERS OR ADDRESS)

• EMPLOYEE EXPERIENCE

• ACCESS MANAGEMENT

• NEED TO KNOW BASIS

Implement


Support

Happy Employee

HR Support Model

HR Technology

(with IT)Vendor


• THE DISCUSSION ISN’T OVER AT GO-LIVE

• ANNUAL DISCUSSION

• CHANGES TO POLICY?

• PLAN FOR BREACH?

• PROTECTION AGAINST MALICIOUS ATTACKS?

• ON-GOING DIALOG AS THE LANDSCAPE CHANGES

• NEW REPS = NEW DISCUSSIONS

Support


• THE DISCUSSION ISN’T OVER AT GO-LIVE

• ANNUAL DISCUSSION

• CHANGES TO POLICY?

• PLAN FOR BREACH?

• EDUCATE REGARDING MALICIOUS ATTACKS

• ON-GOING DIALOG AS THE LANDSCAPE CHANGES

• NEW REPS = NEW DISCUSSIONS

Support


PROS

• GREAT SUPPORT FROM INTERNAL

PARTNERS

CONS

• THIS TAKES TIME

• SOCIAL ADOPTION MODEL


• UPFRONT WORK = LESS DOWNSTREAM ISSUES

• NOTHING HERE PROHIBITS OR PREVENTS USABILITY

• MAKE IT PART OF THE REQUIREMENTS AND CONTINUE

TO MEASURE AGAINST IT.

• THE HUMAN FACTOR

• NO MATTER WHAT WE DO – WE STILL HAVE THE PEOPLE

PORTION TO CONSIDER.

©2014 mfmer | slide-1 · 2018-03-31 · ©2014 mfmer | slide-10 “today the only this that is...

Documents