Strong Authentication and Single Sign-On (SSO) for Health Care McKesson 9/20/2018 3:34 PM Strong Authentication and Single Sign-On (SSO) for Health Care Kevin Peterson Sr. Security Engineer Product Development World’s largest health care extranet Foundation of security solutions portfolio 900+ hospitals 450+ data lines 4000+ SecurID tokens deployed Only two-factor authentication supported for McKesson’s customers using extranet services Copyright (C) 2002 McKesson Corporation. All Rights Reserved. Proprietary and Confidential.

Strong Authentication McKesson 9/20/2018 3:34 PM Strong Authentication What is strong authentication? Why is strong authentication needed? Non-repudiation (identify the user) Meaningful audit logs Passwords are extremely easy hack, crack, steal, guess, reveal, learn, social engineer, etc.. What you have, what you know, who you are (2 of three) EPHI Impact Copyright (C) 2002 McKesson Corporation. All Rights Reserved. Proprietary and Confidential.

Password Risk 1: Written Down McKesson 9/20/2018 3:34 PM Password Risk 1: Written Down Notepads Sticky notes Wallet cards Password replay/caching software E-mail PDAs Documents P2P Software Malware – HIPAA requirement, hard to control outside the hospital, can easily steal/reveal passwords. The ever-increasing numbers of passwords forces us to synchronize, write down, etc… Copyright (C) 2002 McKesson Corporation. All Rights Reserved. Proprietary and Confidential.

Password Risk 2: Key Logging McKesson 9/20/2018 3:34 PM Password Risk 2: Key Logging Captured logon to a security gateway and then a physician’s portal. <!--08.05.2003, 16:49. User: “Bob". Window title:"MSNBC Cover - Microsoft Internet Explorer"--> portal.hospital.org [Backspace][Backspace][Backspace][Backspace]drsmithpassword bobsmithmysecret Hardware & Software – email functionality Search on Google.com for “keylogger” returns approximately 466,000 hits Search on Download.com for “keylogger” return approximately 41 programs for easy download Take a poll: How many have heard of key loggers? How many believe they are a real threat? Copyright (C) 2002 McKesson Corporation. All Rights Reserved. Proprietary and Confidential.

Password Risk 3: Easily Guessed or Cracked McKesson 9/20/2018 3:34 PM Password Risk 3: Easily Guessed or Cracked Dictionary Attacks Brute Force Attacks Shared passwords Similar to other passwords Stored in weak databases Wireless LAN transmissions Unix - Shadow passwords NT – SAM database on disk Copyright (C) 2002 McKesson Corporation. All Rights Reserved. Proprietary and Confidential.

Single Sign-On

Health Care Challenges Driving Single Sign-On (SSO) McKesson 9/20/2018 3:34 PM Health Care Challenges Driving Single Sign-On (SSO) Clinical workers need to be more efficient Clinical applications are being driven onto the Internet and mobile devices I.T. is a cost center, and costs must be lowered! Too many passwords, too little time HIPAA! PIGs and COWs Copyright (C) 2002 McKesson Corporation. All Rights Reserved. Proprietary and Confidential.

SSO Beliefs Can reduce help desk calls Can decrease the burden on users Immature technology limits its use

SSO “Hidden Secrets” Ideally, users should never know any of their passwords! Can bring down all clinical applications! Must be available at all times! Access for remote users Access for synchronized offline data Biometric devices are not the only answer Must be capable of providing strong authentication outside the hospital

Key Business Planning Steps for Successful SSO McKesson 9/20/2018 3:34 PM Key Business Planning Steps for Successful SSO Evaluate the stability of the SSO vendor Ensure that the solution is being driven toward HIPAA Separate the wants from the needs Ensure that all of the maintenance and support processes are appropriately addressed Ensure a total commitment to the solution Obtain complete funding through both qualitative and quantitative measures – Make the Business Case! I – C - A Copyright (C) 2002 McKesson Corporation. All Rights Reserved. Proprietary and Confidential.

Key Technical Planning Steps for Successful SSO SSO software selection Availability Disaster Recovery Remote Access Mobile Access Desktop Access Thin Client Access Thin Client Access Lab Environment Applications Scripting Training User Enrollment Authentication Devices

Questions?