View source for August 29, 2017 Security Conference Call

[[Security|Back to Security Main Page]]
==Attendees==
 
{| class="wikitable"
|-
!x||'''Member Name'''|| !!  x ||'''Member Name''' !!|| x ||'''Member Name''' !!|| x ||'''Member Name''' 
|-
||  .|| [mailto:JohnMoerke@gmail.com John Moehrke]Security Co-chair
||||x|| [mailto:Kathleen_Connor@comcast.net Kathleen Connor]Security Co-chair 
||||.|| [mailto:mense@fhtw.onmicrosoft.com Alexander Mense] Security Co-chair
||||.|| [mailto:trish.williams@ecu.edu.au Trish Williams]Security Co-chair
|-
||  x|| [mailto:mike.davis@va.gov Mike Davis]
||||x|| [mailto:Suzanne.Webb@engilitycorp.com Suzanne Gonzales-Webb]
||||x|| [mailto:drs@securityrs.com David Staggs]
||||x|| [mailto:mjafari@edmondsci.com Mohammed Jafari]
|-
||  x|| [mailto:gfm@securityrs.com Glen Marshall], SRS
||||x|| [mailto:Beth.Pumo@kp.org Beth Pumo]
||||.|| [mailto:ioana.singureanu@gmail.com Ioana Singureanu]
||||.|| [mailto:robert.horn@agfa.com Rob Horn] 
|-
||  x|| [mailto:Diana.Proud-Madruga@engilitycorp.com Diana Proud-Madruga]
||||.|| [mailto:serafina.versaggi@gmail.com Serafina Versaggi ]
||||x|| [mailto:joe.lamy@aegis.net Joe Lamy]
||||.|| [mailto:Galen.Mulrooney@JPSys.com Galen Mulrooney]
|-
||  .|| [mailto:duane.decouteau@gmail.com Duane DeCouteau]
||||.|| [mailto:Chris.R.Clark@wv.gov Chris Clark]
||||.|| [mailto:jc@securityrs.com Johnathan Coleman]
||||.|| [mailto:aaron.seib@2311.net Aaron Seib]
|-
||  .|| [mailto:ken.salyards@samhsa.hhs.gov Ken Salyards]
||||.|| [mailto:cbrown@socialcare.com Christopher D Brown] TX
||||.|| [mailto:gary.dickinson@ehr-standards.com Gary Dickinson]
||||x|| [mailto:dsilver@electrosoft-inc.com Dave Silver]
|-
||  x|| [mailto:rgrow@technatomy.com Rick Grow]
||||.|| [mailto:bkinsley@nextgen.com William Kinsley]
||||.|| [mailto:pknapp@pknapp.com Paul Knapp]  
||||x|| [mailto:Mayada.Abdulmannan@va.gov Mayada Abdulmannan]
|-
||  .|| [mailto:kamalinivaidya@systemsmadesimple.com Kamalini Vaidya]
||||.|| [mailto:akleinebe@gmail.com Bill Kleinebecker ]
||||x|| [mailto:Christopher.Shawn2@va.gov Christopher Shawn]
||||.|| [mailto:grahameg@gmail.com Grahame Grieve]
|-
||  .|| [mailto:oliver@lawless.co Oliver Lawless]
||||.|| [mailto:Ken.Rubin@hp.com Ken Rubin]
||||.|| [mailto:dtao12@gmail.com David Tao]
||||.|| [mailto:nathanbotts@westat.com Nathan Botts]
|-
|}
[[Security|Back to Security Main Page]]
=='''Agenda'''==
#''(2 min)'' '''Roll Call, Agenda Approval''' 
#''(4 min)'' ''' Review and Approval of [http://wiki.hl7.org/index.php?title=August_15,_2017_Security_Conference_Call Security WG Call Minutes August 15, 2017] and [http://wiki.hl7.org/index.php?title=August_22,_2017_Security_Conference_Call Security WG Call Minutes August 22, 2017] '''
#''(5 min)'' '''[http://wiki.hl7.org/index.php?title=HL7_WGM_Sept_2017_-_San_Diego_US_AGENDA San Diego Sept WGM Agenda]''' - Kathleen 
#''(15 min)'' '''Working Group Meeting Agenda Items''' - Mike Davis
#''(5 min)'' '''[http://gforge.hl7.org/gf/download/frsrelease/1242/15626/FTSD-WorkGroupHealth_2017SepInterim.pdf Security WG Interim Health Metrics]''' - presiding cochair
#''(5 min)'' '''[http://wiki.hl7.org/index.php?title=ONC_Trusted_Exchange_Common_Agreement_Framework_Comments_Page ONC Trusted Exchange Common Agreement Framework Comments]''' - Kathleen
#''(5 min)'' '''FHIR Security call''' -

==News and Review Material==
*Need assisteance with PASS Audit Ballot Comments from Bernd Blobel resolved.  E.g., Move Figure 1 to Functional Section because it is too detailed.  Make references to "client" as source of audit content and "source" as source of audit content consistent.
*[https://www.nitrd.gov/PUBS/NationalPrivacyResearchStrategy.pdf NSTC National Privacy Research Strategy]
*[http://csrc.nist.gov/publications/drafts/800-53/sp800-53r5-draft.pdf NIST 800-53 Rev 5 Review Security and Privacy Controls for Information Systems and Organizations Initial Public Draft]  Comments due Sept. 12.  Please add to [http://wiki.hl7.org/index.php?title=NIST_800-53_Rev_5 CBCC and Security WG NIST SP 800-53 Rev 5 Comment Page]
*[http://csrc.nist.gov/publications/drafts/800-53/sp800-53r5-draft.pdf NIST SP Security and Privacy Controls for Information Systems and Organizations Revision 5] Comments due September 12, 2017 See [CBCC and Security WG Comment Page and Security WG Comment Page for NIST 800-53 Rev 5 Review Security and Privacy Controls for Information Systems and Organizations Initial Public Draft ]]
*[http://csrc.nist.gov/publications/nistbul/itlbul2017-08.pdf Understanding the Major Update to NIST SP 800-63: Digital Identity Guidelines]
*Introduction: Digital identities are used in nearly every aspect of our online activities each day. A digital identity is the unique representation of a subject that is engaged in an online transaction. This bulletin outlines updates that NIST recently made in its four-volume Special Publication (SP) 800-63, Digital Identity Guidelines, which provide agencies with technical guidelines regarding the digital authentication of users to federal networked systems. Rather than being a single, monolithic guideline, SP 800-63-3 has been separated in multiple parts – each representing a distinct component of digital identity services. This way, organizations can choose the document that applies to the digital identity services they want to offer. This approach makes applying the guidelines easier for agencies—and also sets the stage for a nimble continuous improvement process. Also, NIST can quickly release key updates, rather than delivering in two or three year cycles.
*This bulletin will describe the components of digital identity – identity proofing, authentication, and federation – and explain how federal agencies can use them to protect the digital identities of their employees. It also provides an overview of the NIST documents that describe these digital identity components and explains how the information in them is organized.
Understanding Digital
*Identity proofing is the process used to verify a subject’s association with their real-world
identity, establishing that a subject is who they claim to be.
*An authenticator is something the subject possesses and controls (typically, a cryptographic
module or password) that is used to authenticate the subject’s identity.
*Digital authentication is the process of determining the validity of one or more authenticators
used to claim a digital identity. Authentication establishes that a subject attempting to access a
digital service is in control of the technologies used to authenticate. Successful authentication
provides reasonable risk-based assurances that the subject accessing the service today is the
same that previously accessed the service.
*Federation is when the relying party (RP) and identity provider (IdP) are not a single entity or
not under common administration. Federation enables an IdP to proof and authenticate an
individual and provide identity assertions that RPs can accept and trust.
How has SP 800-63-3 evolved?
Since the last revision of this document in 2013, NIST SP 800-63-2, digital identity components have evolved substantially. To better align with market-driven business models and innovation, the new revision replaces levels of assurance (LOAs) with ordinals for individual parts of the digital identity flow, providing implementers with more flexibility in their design and operations:
**Identity Assurance Level (IAL): the identity proofing process and the binding between one or
more authenticators and the records pertaining to a specific subscriber;
*Authenticator Assurance Level (AAL): the authentication process, including how additional
factors and authentication mechanisms can impact risk mitigation; and
*Federation Assurance Level (FAL): the assertion used in a federated environment to
communicate authentication and attribute information to a RP.
*SP 800-63 is a suite of four documents: SP 800-63-3 (the parent document; your starting point for all things digital identity and risk) and three additional documents – SP 800-63A, 800-63B, and 800-63C –which cover the various components of a digital identity system. These documents are described below:
*SP 800-63-3, Digital Identity Guidelines, provides an overview of general identity frameworks,
guidance regarding use of authenticators, credentials, and assertions together in a digital system, and a risk-based process of selecting assurance levels;
**SP 800-63A, Enrollment and Identity Proofing;
**SP 800-63B, Authentication and Lifecycle Management; and
**SP 800-63C, Federation and Assertions.  
*See links @ *[ https://pages.nist.gov/800-63-3/NIST SP 800-63, Digital Identity Guidelines - 4 Volumes]
*'''[https://www.nitrd.gov/PUBS/NationalPrivacyResearchStrategy.pdf NSTC National Privacy Research Strategy] and [http://wiki.hl7.org/index.php?title=NIST_800-53_Rev_5_Review_Security_and_Privacy_Controls_for_Information_Systems_and_Organizations_Initial_Public_Draft_-_CBCC_and_Security_WG_Comment_Page Comment Page]'''
*[http://www.pewinternet.org/2017/05/22/the-internet-of-things-and-future-shock-too-much-change-too-fast/ PEW Report - The Internet of Things and Future Shock: Too Much Change Too Fast?]Lee Rainie, director of Internet, Science and Technology Research at the Pew Research Center, spoke on May 10, 2017 to the American Bar Association’s [http://www.americanbar.org/content/dam/aba/events/cle/2017/spring/ce1705iot_webbrochure.authcheckdam.pdf Section of Science and Technology Law] about the rise of the Internet of Things and its implications for privacy and cybersecurity. The velocity of change today is remarkable and increasingly challenging to navigate. Rainie discussed Pew Research Center’s reports about [http://www.pewinternet.org/2014/03/11/digital-life-in-2025/ “Digital Life in 2025”]and [http://www.pewinternet.org/2014/05/14/internet-of-things/ “The Internet of Things Will Thrive by 2025],” which present the views of hundreds of “technology builders and analysts” on the future of the internet.
**[http://www.pewinternet.org/2017/05/22/the-public-and-cybersecurity-practices-and-knowledge PEW Report - The public and cybersecurity practices and knowledge] Lee Rainie, director of internet, science and technology research at Pew Research Center, presented the Center’s findings about public practices and knowledge related to cybersecurity to the advisory board of the National Cybersecurity Alliance on May 5, 2017. He discussed the wide variance in what the public knows about key cybersecurity issues and concepts and people’s habits when it comes to handling the passwords to their online accounts and their use of public Wi-Fi networks.

== Minutes ==
* Chaired by Kathleen
* Agenda Approved
* Approved Security WG Call Minutes August 15, 2017 (Beth, Mike) 
* Approved Security WG Call Minutes August 22, 2017 ( Mike, John) 
* San Diego Sept WGM Agenda - Kathleen
** Agenda still in progress
*** Working Group Meeting Agenda Items - Mike Davis
** Pass Audit has comments against it that were adjudicated by the Work Group
** Mike requested John to help review some of the comments by Burns 
** Comment (1) Mike: Ken Roubin is a proponent of Security topics but is stepping down as co-chair
** Chris will be the interim co-chair 
** Currently focusing on SOA  
** Comment (2) John: Security topics should become high priority for SOA for health care needs and standards 
** Comment (3) Suzanne: SOA is primarily responsible for reference architecture
** Next Step: Will take comments and bring up as topic to see what action is needed from Security Working Group
** Comment (4) Kathleen: Recommends a FHIR Deep Dive by John 
** Mike has been working with NIST for internet of things since resources are internet addressable
** Looking at how our security solutions work with big data and privacy and security solutions 
** What is the Security and Privacy impact, and Harmonization topic are related to NIST
** Next Step (Recommendation/Mike): Propose to start a Study group and create a report with the implication of NIST and FHIR's Rule 
** Comment (5) John: Gram is looking for the cross section with FHIR, and maybe interested in the connection of NIST and FHIR 
** Comment (6) Mike: We have a RBAC road map and Rolled Based Access Control examples, and can update it in line with NIST. Some standards such as SMS is not allowed in NIST (80063). Knowledge factors is also disallowed in NIST. 
* Security WG Interim Health Metrics - presiding cochair
** 91% response comments are complete 
* ONC Trusted Exchange Common Agreement Framework Comments - Kathleen
** Still in the works
* FHIR Security call -
** Will have security call, will walk through ER's, no formal agenda planned
* Call adjourned