The Experts below are selected from a list of 3078 Experts worldwide ranked by ideXlab platform
Emmanuel Aroms - One of the best experts on this subject based on the ideXlab platform.
-
nist special publication 800 34 contingency planning guide for federal information systems revision 1
2012Co-Authors: Emmanuel AromsAbstract:This is a Hard copy of the NIST Special Publication 800-34, Contingency Planning Guide for Federal Information Systems Revision 1. This publication assists organizations in understanding the purpose, process, and format of ISCP development through practical, real-world guidelines. While the principles establish a baseline to meet most organizational needs, it is recognized that each organization may have additional requirements specific to its own operating environment. This guidance document provides background information on interrelationships between information system contingency planning and other types of Security and emergency management-related contingency plans, organizational resiliency, and the system development life cycle (SDLC). The document provides guidance to help personnel evaluate information systems and operations to determine contingency planning requirements and priorities. Requirements from FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, Security impact levels, and NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations contingency planning controls are integrated throughout the guideline. Considerations for impact levels and associated Security controls for contingency planning are presented to assist planners in developing the appropriate contingency planning strategy. Although the information presented in this document is largely independent of particular hardware platforms, operating systems, and applications, technical considerations specific to common information system platforms are addressed. Disclaimer This hardcopy is not published by National Institute of Standards and Technology (NIST), the US Government or US Department of Commerce. The publication of this document should not in any way imply any relationship or affiliation to the above named organizations and Government.
-
nist special publication 800 53 revision 3 recommended Security controls for federal information systems and organizations
2012Co-Authors: Emmanuel AromsAbstract:NIST Special Publication 800-53, Revision 3 Recommended Security Controls for Federal Information Systems and Organizations Guide for Applying the Risk Management Framework to Federal Information Systems is prepared by The National Institute of Standards and Technology. The purpose of this publication is to provide guidelines for selecting and specifying Security controls for information systems supporting the executive agencies of the federal government to meet the requirements of FIPS 200, Minimum Security Requirements for Federal Information and Information Systems. The guidelines apply to all components11 of an information system that process, store, or transmit federal information. The guidelines have been developed to help achieve more secure information systems and effective risk management within the federal government by: Facilitating a more consistent, comparable, and repeatable approach for selecting and specifying Security controls for information systems and organizations; Providing a recommendation for minimum Security controls for information systems categorized in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems; Providing a stable, yet flexible catalog of Security controls for information systems and organizations to meet current organizational protection needs and the demands of future protection needs based on changing requirements and technologies; Creating a foundation for the development of assessment methods and procedures for determining Security control effectiveness; and Improving communication among organizations by providing a common lexicon that supports discussion of risk management concepts. The guidelines in this special publication are applicable to all federal information systems other than those systems designated as national Security systems as defined in 44 U.S.C., Section 3542. The guidelines have been broadly developed from a technical perspective to complement similar guidelines for national Security systems and may be used for such systems with the approval of appropriate federal officials exercising policy authority over such systems.13 State, local, and tribal governments, as well as private sector organizations are encouraged to consider using these guidelines, as appropriate. Disclaimer This hardcopy is not published by National Institute of Standards and Technology (NIST), the US Government or US Department of Commerce. The publication of this document should not in any way imply any relationship or affiliation to the above named organizations and Government.
Ana Ferreira - One of the best experts on this subject based on the ideXlab platform.
-
Assessing Access Control Risk for mHealth: A Delphi Study to Categorize Security of Health Data and Provide Risk Assessment for Mobile Apps
'Hindawi Limited', 2020Co-Authors: Pedro Moura, Paulo Fazendeiro, Pedro R. M. Inácio, Pedro Vieira-marques, Ana FerreiraAbstract:Background. Smartphones can tackle healthcare stakeholders’ diverse needs. Nonetheless, the risk of data disclosure/breach can be higher when using such devices, due to the lack of adequate Security and the fact that a medical record has a significant higher financial value when compared with other records. Means to assess those risks are required for every mHealth application interaction, dependent and independent of its goals/content. Objective. To present a risk assessment feature integration into the SoTRAACE (Socio-Technical Risk-Adaptable Access Control) model, as well as the operationalization of the related mobile health decision policies. Methods. Since there is still a lack of a definition for health data Security Categorization, a Delphi study with Security experts was performed for this purpose, to reflect the knowledge of Security experts and to be closer to real-life situations and their associated risks. Results. The Delphi study allowed a consensus to be reached on eleven risk factors of information Security related to mobile applications that can easily be adapted into the described SoTRAACE prototype. Within those risk factors, the most significant five, as assessed by the experts, and in descending order of risk level, are as follows: (1) Security in the communication (e.g., used Security protocols), (2) behavioural differences (e.g., different or outlier patterns of behaviour detected for a user), (3) type of wireless connection and respective encryption, (4) resource sensitivity, and (5) device threat level (e.g., known vulnerabilities associated to a device or its operating system). Conclusions. Building adaptable, risk-aware resilient access control models into the most generalized technology used nowadays (e.g., smartphones) is crucial to fulfil both the goals of users as well as Security and privacy requirements for healthcare data
Pedro Moura - One of the best experts on this subject based on the ideXlab platform.
-
Assessing Access Control Risk for mHealth: A Delphi Study to Categorize Security of Health Data and Provide Risk Assessment for Mobile Apps
'Hindawi Limited', 2020Co-Authors: Pedro Moura, Paulo Fazendeiro, Pedro R. M. Inácio, Pedro Vieira-marques, Ana FerreiraAbstract:Background. Smartphones can tackle healthcare stakeholders’ diverse needs. Nonetheless, the risk of data disclosure/breach can be higher when using such devices, due to the lack of adequate Security and the fact that a medical record has a significant higher financial value when compared with other records. Means to assess those risks are required for every mHealth application interaction, dependent and independent of its goals/content. Objective. To present a risk assessment feature integration into the SoTRAACE (Socio-Technical Risk-Adaptable Access Control) model, as well as the operationalization of the related mobile health decision policies. Methods. Since there is still a lack of a definition for health data Security Categorization, a Delphi study with Security experts was performed for this purpose, to reflect the knowledge of Security experts and to be closer to real-life situations and their associated risks. Results. The Delphi study allowed a consensus to be reached on eleven risk factors of information Security related to mobile applications that can easily be adapted into the described SoTRAACE prototype. Within those risk factors, the most significant five, as assessed by the experts, and in descending order of risk level, are as follows: (1) Security in the communication (e.g., used Security protocols), (2) behavioural differences (e.g., different or outlier patterns of behaviour detected for a user), (3) type of wireless connection and respective encryption, (4) resource sensitivity, and (5) device threat level (e.g., known vulnerabilities associated to a device or its operating system). Conclusions. Building adaptable, risk-aware resilient access control models into the most generalized technology used nowadays (e.g., smartphones) is crucial to fulfil both the goals of users as well as Security and privacy requirements for healthcare data
Paulo Fazendeiro - One of the best experts on this subject based on the ideXlab platform.
-
Assessing Access Control Risk for mHealth: A Delphi Study to Categorize Security of Health Data and Provide Risk Assessment for Mobile Apps
'Hindawi Limited', 2020Co-Authors: Pedro Moura, Paulo Fazendeiro, Pedro R. M. Inácio, Pedro Vieira-marques, Ana FerreiraAbstract:Background. Smartphones can tackle healthcare stakeholders’ diverse needs. Nonetheless, the risk of data disclosure/breach can be higher when using such devices, due to the lack of adequate Security and the fact that a medical record has a significant higher financial value when compared with other records. Means to assess those risks are required for every mHealth application interaction, dependent and independent of its goals/content. Objective. To present a risk assessment feature integration into the SoTRAACE (Socio-Technical Risk-Adaptable Access Control) model, as well as the operationalization of the related mobile health decision policies. Methods. Since there is still a lack of a definition for health data Security Categorization, a Delphi study with Security experts was performed for this purpose, to reflect the knowledge of Security experts and to be closer to real-life situations and their associated risks. Results. The Delphi study allowed a consensus to be reached on eleven risk factors of information Security related to mobile applications that can easily be adapted into the described SoTRAACE prototype. Within those risk factors, the most significant five, as assessed by the experts, and in descending order of risk level, are as follows: (1) Security in the communication (e.g., used Security protocols), (2) behavioural differences (e.g., different or outlier patterns of behaviour detected for a user), (3) type of wireless connection and respective encryption, (4) resource sensitivity, and (5) device threat level (e.g., known vulnerabilities associated to a device or its operating system). Conclusions. Building adaptable, risk-aware resilient access control models into the most generalized technology used nowadays (e.g., smartphones) is crucial to fulfil both the goals of users as well as Security and privacy requirements for healthcare data
Pedro R. M. Inácio - One of the best experts on this subject based on the ideXlab platform.
-
Assessing Access Control Risk for mHealth: A Delphi Study to Categorize Security of Health Data and Provide Risk Assessment for Mobile Apps
'Hindawi Limited', 2020Co-Authors: Pedro Moura, Paulo Fazendeiro, Pedro R. M. Inácio, Pedro Vieira-marques, Ana FerreiraAbstract:Background. Smartphones can tackle healthcare stakeholders’ diverse needs. Nonetheless, the risk of data disclosure/breach can be higher when using such devices, due to the lack of adequate Security and the fact that a medical record has a significant higher financial value when compared with other records. Means to assess those risks are required for every mHealth application interaction, dependent and independent of its goals/content. Objective. To present a risk assessment feature integration into the SoTRAACE (Socio-Technical Risk-Adaptable Access Control) model, as well as the operationalization of the related mobile health decision policies. Methods. Since there is still a lack of a definition for health data Security Categorization, a Delphi study with Security experts was performed for this purpose, to reflect the knowledge of Security experts and to be closer to real-life situations and their associated risks. Results. The Delphi study allowed a consensus to be reached on eleven risk factors of information Security related to mobile applications that can easily be adapted into the described SoTRAACE prototype. Within those risk factors, the most significant five, as assessed by the experts, and in descending order of risk level, are as follows: (1) Security in the communication (e.g., used Security protocols), (2) behavioural differences (e.g., different or outlier patterns of behaviour detected for a user), (3) type of wireless connection and respective encryption, (4) resource sensitivity, and (5) device threat level (e.g., known vulnerabilities associated to a device or its operating system). Conclusions. Building adaptable, risk-aware resilient access control models into the most generalized technology used nowadays (e.g., smartphones) is crucial to fulfil both the goals of users as well as Security and privacy requirements for healthcare data