Enterprise Security Program Overview Presenter: Braulio J. Cabral NCI-CBIIT/caBIG Enterprise Security Program Coordinator

Topics NCI-CBIIT Enterprise Security Program Overview Vision and Mission Operational Security Framework Security and the Service-Aware Interoperability Framework The role of security in SAIF Architectural Deliverables Implementing security through the Enterprise Compliance and Conformance Framework (ECCF)

Topics Security as a Service Why moving towards SaaS caGrid Security Services Project Bridging the gap between security needs and caGrid 1.3/1.4 Project Scope What Should You Expect?

The NCI-CBIIT/caBIG Enterprise Security Program

The Vision A holistic Approach to Information Security Integrates community needs, business, strategy, and regulations Follows a well-defined framework for security Supports caBIG vision to Connect the cancer research community through a shareable, interoperable infrastructure Deploy and extend standard rules and a common language to more easily share information Build or adapt tools for collecting, analyzing, integrating and disseminating information associated with cancer research and care

The Vision

The Mission Support caBIG in its mission as an information network enabling all constituencies in the cancer community – researchers, clinicians, patients – to share data and knowledge to accelerate the discovery of new diagnostics and therapeutics, and improve patient outcomes

caBIG ES Security Framework Contextual Security Architecture The contextual architecture defines security business strategic goals, business vision and the security needs to accomplish the business strategy Contextual Security Architecture The contextual architecture defines security business strategic goals, business vision and the security needs to accomplish the business strategy Conceptual Security Architecture The conceptual architecture defines business attributes, and the business needs for security Conceptual Security Architecture The conceptual architecture defines business attributes, and the business needs for security Logical Security Architecture The logical architecture defines the security policy, security requirements, data sharing security needs, security services, privilege profiles Logical Security Architecture The logical architecture defines the security policy, security requirements, data sharing security needs, security services, privilege profiles Physical Security Architecture The physical security architecture is concerned with security rules, practice, procedures, and security mechanism Physical Security Architecture The physical security architecture is concerned with security rules, practice, procedures, and security mechanism Component Security Architecture The component architecture includes, security standards and procedures, security products and security tools, processes, and protocols Component Security Architecture The component architecture includes, security standards and procedures, security products and security tools, processes, and protocols Operational Security Architecture The operational architecture is concerned with assurance of operational continuity, risk management, security service management, and security metrics and performance Operational Security Architecture The operational architecture is concerned with assurance of operational continuity, risk management, security service management, and security metrics and performance The SABSA® Model

The role of security in the Services- Aware Interoperability Framework caBIG SAIF Approach to Security Security and the SDLC Inception, Elaboration, Construction, Transition Architectural Deliverables for Security Use-case model, Analytical model, Design model, Development model, Integration model, Testing model Implementing security through the ECCF Security in the Computational Independent Model (CIM) Use-cases for security (security requirements), security model Preliminary security risk assessment and security controls selection Security in the Platform Independent Model (PIM) Logical representation of security (policies, service contracts, services behavioral constraints) Security in the Platform Specific Model (PSM) Security tools, technology, standards, protocols Security in the Technology Bounding process (Testing security assertions)

Security as a Service Why moving towards SaaS Scalability Consistent security implementation Easier implementation of levels of assurance Ease of use Interoperable ECCF compliant Transitioning Strategy Service Integration Guide (allows the use of existing technology for authentication and authorization as services) Development of other services for security non-existing in the current infrastructure including de-identification, auditing, and data sharing policy service Service Integration Guide for new services

caGrid Security Services Project Advancing caGrid Security Infrastructure Authentication Third party credentials (InCommon, OpenID) Authorization Authorization at service level (CSM/GG) Other Services Audit Service Data sharing policy service De-identification service

What Should You Expect Current ActivitiesStatus caBIG Wiki page on Security Completed caGrid Security Policy handbooks – Completed (see wiki)Completed (see wiki) caGrid host agreement forms/policy – Completed (see wiki)Completed (see wiki) Security Services Project (auditing, de-identification, data sharing policies) In progress Service Integration Guide for caGrid 1.3/1.4In progress Third party credentials (InCommon, OpenID) integration projectIn progress