Risk
9/10/2008
11:45 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

InformationWeek 500: Secure Authentication is Good Medcine For Cincinnnati Children's Hospital Medical

Fingerprint readers and pass code generators save caregivers time while complying with state laws.

In 2007, Cincinnati Children's Hospital Medical Center began a large-scale migration from paper forms to an application suite from Epic Systems, which makes software for managing patients' health data, prescription processing, billing, and other such tasks. The goals of the project are to streamline patient care management, increase the accuracy and accountability of caregivers treating patients, and support the clinical informatics group. The hospital estimates it's about 18% through the Epic deployment and says it's on track to complete the rollout by 2011.

A critical part of the project is called Secure Authentication, which is the authentication and authoriz- ation component that regulates who can prescribe medication and creates an audit trail of who administers the medication. The hospital estimates it has spent approximately $120,000 on Secure Authentication to date--in line with its expectations--to meet authentication and authorization requirements driven by Ohio State Board of Pharmacy regulations. The board is responsible for enforcing the legal distribution of drugs, and its regulations call for positive identification of a user though some means other than a password.

On the continuum of authentication strength, user name and password methods are relatively weak and subject to any number of social engineering attacks. In contrast, biometrics and hardware tokens, which require a personal identification number and a number generated by the token, are stronger. Tying the sensitivity of the transaction to an authentication method provides greater assurance that the transaction was carried out by an authorized person.

InformationWeek Reports

In complying with the regulations, Cincinnati Children's design went beyond the board's strict security requirements, allowing the hospital to gain approval for its authentication plan on the first try. It was the only hospital in the state to receive immediate approval, according to Cincinnati Children's.

"Secure Authentication added an additional level of validation of the identity of the system user," says Tony Johnston, assistant VP and CTO of Cincinnati Children's. "We have always had secure access to all of our systems, both clinical and financial--the guiding principle being that users have the security level to access all of the information and functions they need to be able to do their jobs in compliance with all licensing and regulatory requirements."

Rolling out a game-changing system, where processes move from a paper world to an electronic one, can be a difficult proposition. To ensure that employees felt they had a stake in the decision, project leaders at Cincinnati Children's involved more than 300 people from all levels of the organization during the Epic selection process, getting user feedback and defining requirements according to departmental needs. Actively involving staff helped ensure that the project would be successful and minimized disruptions during rollout.

Once the Epic system was selected, it was up to the hospital's IT department to implement the application suite. The project staff incorporated initial training on the biometric and token authentication system into the training on the Epic platform. This integrated training allowed staffers to familiarize themselves with the new authentication process while learning the software.

DIG DEEPER
MORE DATA AND ANALYSIS
For the complete data from our InformationWeek 500 research, download this
InformationWeek Analytics
Report
,
free for a limited time.

Communications were also essential. Like any large organization, Cincinnati Children's has built a robust internal communications strategy to keep employees informed of changes to hospital procedures. Cincinnati Children's generated newsletters and updates specifically aimed at the Epic rollout, as well as providing demonstrations of the Secure Authentication products under investigation. The project team solicited input and responses. All of that data was folded into the decision-making process, ensuring that no facet of Secure Authentication was overlooked.

Requiring multiple authentication methods to authorize transactions is not new or unique to Epic Systems, Ohio Board of Pharmacy, or Cincinnati Children's. Tiered authentication has been used in many vertical markets to authenticate individuals engaging in high-value or highly sensitive transactions.

In tiered authentication, the authentication method becomes an authorization factor in the process. A user name or password can be easily shared or stolen without the user's knowledge. However, systems based on biometrics or hardware tokens are harder to crack. Users will quickly notice if tokens are missing, and they can report them as lost. These reports alert administrators to disable lost tokens so they can no longer be used.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1544
Published: 2014-07-23
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger cer...

CVE-2014-1547
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1548
Published: 2014-07-23
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1549
Published: 2014-07-23
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and applica...

CVE-2014-1550
Published: 2014-07-23
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.