1. Tom Walsh, CISSP President
Audit Controls
Tom Walsh, CISSP
President

2. Copyright © 2003, Tom Walsh Consulting, LLC
Certified Information Systems Security Professional (CISSP)
Co-authored a book on HIPAA Security
Invited speaker at national conferences
Former information security manager for large healthcare system in Kansas City, MO
DOE-certified safeguards and security instructor
A little nerdy, but overall, a nice guy 
Copyright © 2003, Tom Walsh Consulting, LLC

3. Copyright © 2003, Tom Walsh Consulting, LLC
Why do we audit?
Investigations
Troubleshooting
Employee misconduct
Forensic evidence
Random sampling to keep users in check
Users are randomly selected for audit
Audit data is provided to their managers
Compliance
Because it is required in HIPAA
Copyright © 2003, Tom Walsh Consulting, LLC

4. Copyright © 2003, Tom Walsh Consulting, LLC
What do we audit?
Operating system
Programs/files modifications
Directory or file access or failed attempts
Password changes, strength, etc.
Application
Order entry, changes, updates, deletions, etc.
Access control lists to Data Owners
Network
Internal (User’s logging on and off)
External (Vendors, workforce members, file transfers, etc.)
Copyright © 2003, Tom Walsh Consulting, LLC

5. What do we do with audit logs?
Controlling access to logs
Are they stored on a separate system?
System administrators - Should they have access to audit logs?
Reviewing logs
Network engineer? Information Security Officer? Clinical manager? Internal audit?
Storing logs (retention)
Operating system
Application
Network
Copyright © 2003, Tom Walsh Consulting, LLC

6. Copyright © 2003, Tom Walsh Consulting, LLC
Other Issues...
Are warning banners are displayed at logon to any system or network to notify users of auditing and monitoring activities?
Have Data Owners determined the events that will trigger an audit trail?
Have we checked with our vendors on audit capability and performance impact?
What tools are available for quickly reviewing audit data?
What are other organizations doing?
Copyright © 2003, Tom Walsh Consulting, LLC

7. Determining Audit Controls
Management: “We need audit controls.”
IT: “Okay, what activities do you need to capture in an audit log?”
IT: “How long will you want to retain the audit logs?”
IT: “What performance impacts are you willing to accept?”
“… and so it goes…”
Copyright © 2003, Tom Walsh Consulting, LLC

8. Copyright © 2003, Tom Walsh Consulting, LLC
Participation
This panel discussion offers you the opportunity to share your thoughts on audit controls and to hear from our panel of experts.
Thank you for being here!
Copyright © 2003, Tom Walsh Consulting, LLC