1. Rapid Security Risk Analysis Farrokh Alemi, Ph.D. Georgetown University

2. Proposal Set security risk priorities Set security risk priorities Faster Faster More accurately More accurately More objectively More objectively

3. Case of Attack on Boiler Room Consultant’s visit Consultant’s visit Card in boiler room Card in boiler room Contract Contract Comprehensive Comprehensive Physical, electronic, personnel, natural causes, etc. Physical, electronic, personnel, natural causes, etc. Based on opinions Based on opinions Consensus Consensus Imagined risks Imagined risks Attack on milk tanker will kill 500,000 Attack on milk tanker will kill 500,000 Next consultant Next consultant

4. Cost of Comprehensive Security Analysis Wasted time Wasted time Less productivity Less productivity Forgotten passwords Forgotten passwords Lack of coordination Lack of coordination Missed priorities Missed priorities Anthrax versus Katrina Anthrax versus Katrina

5. Probabilistic Security Risk Analysis Collect incidence databases Collect incidence databases Calculate probability of events Calculate probability of events Use time to event Use time to event Set priorities Set priorities Prevent events with high expected damages Prevent events with high expected damages Mitigate consequences of events with low expected damages Mitigate consequences of events with low expected damages Ignore all others Ignore all others

6. Example: Reduce Privacy Security Risks Analyze legal cases Analyze legal cases Analyze reports to DHHS Analyze reports to DHHS Description of risk factor Prevalence of risk factor in the organization Prevalence of security violation given the risk factor 1. Employee views paper documents or manipulates computer passwords to view records of patients not under his/her care 0.00031 2. Benefit Organizations or employers request employee information improperly 0.00030.8805 3. Employees engaged in whistle blowing to uncover illegal or unacceptable business or clinical practices 0.00030.0201 4. Clinician using unsecured email environment to contact patient 0.00030.1606 5. Employee removes patient records from secure location or workplace without authorization 0.00030.88 6. External infection of computers/password/network Systems (e.g. computer hacker) 0.00030.5888 7. Theft of computers or hard drives with patient records0.00030.5867 8. ….

7. Example: Reduce Privacy Security Risks Analyze legal cases Analyze legal cases Analyze reports to DHHS Analyze reports to DHHS Description of risk factor Prevalence of risk factor in the organization Prevalence of security violation given the risk factor 1. Employee views paper documents or manipulates computer passwords to view records of patients not under his/her care 0.00031 2. Benefit Organizations or employers request employee information improperly 0.00030.8805 3. Employees engaged in whistle blowing to uncover illegal or unacceptable business or clinical practices 0.00030.0201 4. Clinician using unsecured email environment to contact patient 0.00030.1606 5. Employee removes patient records from secure location or workplace without authorization 0.00030.88 6. External infection of computers/password/network Systems (e.g. computer hacker) 0.00030.5888 7. Theft of computers or hard drives with patient records0.00030.5867 8. …. Calculate from time to re- occurrence of the event

8. Example: Reduce Privacy Security Risks Analyze legal cases Analyze legal cases Analyze reports to DHHS Analyze reports to DHHS Description of risk factor Prevalence of risk factor in the organization Prevalence of security violation given the risk factor 1. Employee views paper documents or manipulates computer passwords to view records of patients not under his/her care 0.00031 2. Benefit Organizations or employers request employee information improperly 0.00030.8805 3. Employees engaged in whistle blowing to uncover illegal or unacceptable business or clinical practices 0.00030.0201 4. Clinician using unsecured email environment to contact patient 0.00030.1606 5. Employee removes patient records from secure location or workplace without authorization 0.00030.88 6. External infection of computers/password/network Systems (e.g. computer hacker) 0.00030.5888 7. Theft of computers or hard drives with patient records0.00030.5867 8. …. Evidence Based Legal Analysis

9. Example: Security Risks at a Nursing School What should we do? What should we do? Protect against computer viruses Protect against computer viruses Educate faculty about theft Educate faculty about theft Require background checks for students Require background checks for students Introduce camera surveillance Introduce camera surveillance

10. Example: Security Risks at a Nursing School Category of risk factorEvents First reported date Last reported date Average days between events Daily rate Theft of computer217/1/9911/29/04990.010 Theft of other equipment362/5/008/10/99630.016 Theft of personal property27/12/017/11/033650.003 Property damage 2610/7/9910/7/0473 0.013 Vehicle accident on premise1010/27/008/3/051930.005 Damage from natural causes4010/26/996/30/0551.620.019 Hazmat incidents1 10/10/03 7260.001 Student shootings1 Once four years ago in 100 schools 0.00005

11. Example: Security Risks at a Nursing School IT Security violation Estimated days to event Probability of occurrence Dollar amount of damage Desk top security violations 3 months0.03$500 Unsolicited emails requesting personal information Once a week0.14$18,000 Unsolicited emails not requesting personal information Daily1$110 Network penetration Once in last two years 0.0014$300,000

12. Probabilistic Security Risk Analysis Rapid Rapid Relative risks (numeric) Relative risks (numeric) Objective Objective Verifiable accuracy Verifiable accuracy