Cyber Security and Open Source Community Call Seong K. Mun, PhD Don Hewitt, CISSP OSEHRA Arlington, Virginia Webex: TID=ed80e9e1ef fe28dc5f063d03edhttps://osehra.webex.com/osehra/onstage/g.php?M TID=ed80e9e1ef fe28dc5f063d03ed Call-in number: Access code: :00 pm (Eastern) Wednesday, March 23, 2016

Specific Questions and Lead Volunteers Workgroup Reports Question 1 Question 3 Question 4 Work Schedule Any Questions or Comments? Please Note: Calls are Recorded for Future Reference and Collected Documents are Open Agenda 2

OSEHRA Cybersecurity Workgroup Onboarding 1.Join OSEHRA as an Associate member (free)Join OSEHRA 2.Join Cybersecurity Workgroup to receive meeting notice and minutes.Join Cybersecurity Workgroup Workgroup Resources (located at the Group homepage)Group homepage –Section Leaders - –Reference Documents List –Draft Response Documents –Members Weekly Call Meetings (Weekly: Wed, 1:00 PM Eastern) –Webex: e1ef fe28dc5f063d03edhttps://osehra.webex.com/osehra/onstage/g.php?MTID=ed80e9 e1ef fe28dc5f063d03ed Call-in number: , Access code: Cybersecurity Workgroup 3

1.Does the open source community have a focus on cyber security? Mun - OSEHRA 2.Are projects to enhance cybersecurity proposed to OSEHRA by the open source community? If so, have any been completed? Hewitt – OSEHRA 3.Are there lessons learned from Red Hat/LINUX WRT cybersecurity that might be applicable to health IT? Hilburger – Redhat 4.What is the relationship of OSEHRA certification to cybersecurity? Hewitt - OSEHRA Need Lead Volunteers 4

OSEHRA does not (yet) Some examples in greater OS community – Available OS Security Resources – NIST – DHS (Q1) Focus on Cyber Security 5

Previous special project for vulnerability remediation –M2M Broker Vulnerability –Joint effort, closed project group under non-disclosure –Precedent and process established No project proposals for explicit security upgrades Project Metron and Apache NiFi proposed as items of interest VA has proposed an open source project for a code scanning tool (similar to HP Fortify) for M code –OSEHRA recommends enhancing the existing Xindex tool rather than starting from scratch –Most effective approach would be a funded community open source project (Q2) Open Source Projects 6

Are there lessons learned from Red Hat/LINUX WRT cybersecurity that might be applicable to health IT? (Q3) – Red Hat Reporting 7

8

9

10

11

12

What is the relationship of OSEHRA Certification to cyber security? Brief answer: OSEHRA Certification is intended as a prerequisite for, not a replacement of, the in-depth testing required for specific implementations. As such, while specific tools may be run during code review, OSEHRA does not intend to certify the security of code. However… (Q4) Certification 13

(Q4) Certification Components 14

Standards and Conventions Compliance –Critical aspect of security –Dependent upon quality / breadth of SAC rule base –Example: scope checking Susceptible to use of scanning tools –Fortify –Xindex (currently limited) (Q4) SAC Checking 15

Major advantage of open source – More eyes on code is better – Security through obscurity is a myth Proper facilitation is key – Bugs – Possible improvements – Possible (or definite) vulnerabilities Documented issues and results (Q4) Code Review 16

Continuous Unit Testing – Emergent best practice – Critical part of defense in depth – Required for higher OSEHRA certification levels M-Unit available for M code (Q4) Regression Testing 17

No overt security certification by OSEHRA Substantial contribution to security of incoming open source code – Use of automated scan tools – Open code review – Requirement for unit tests As tools improve (e.g. Xindex), OSEHRA contribution to security will increase (Q4) Summary 18

Weekly Calls 1:00 PM (Eastern) – Volunteer Leaders Will Facilitate Wednesday, March 30 Wednesday, April 6 Wednesday, April 13– SUBMISSION TO VA Workgroup Schedule 19

Thoughts? Comments? Questions? Closing… 20

Adjournment