CMP73001: IT Infrastructure and Security for MyHealth Company

This report provides a comprehensive analysis of the IT infrastructure of MyHealth Company, a healthcare service provider dealing with patient data and research. The report begins by discussing the need for robust security measures due to the company's poorly designed network. It delves into the development of security policies, including access control, password management, and data security levels. The report differentiates between incident response and disaster recovery, outlining the phases of an incident response plan. It also covers disaster recovery phases, MTD, RTO, and RPO. The report identifies control methods for threats and explains preventive, detective, and corrective controls, along with different access control systems. It addresses data security controls for data at rest, in motion, and in use, recommending multi-factor authentication and SSO systems. The report concludes with policy recommendations, including data backup and computer policies, to enhance the company's overall security posture.

Running head: IT INFRASTRUCTURE OF MYHEALTH COMPANY
IT infrastructure of MyHealth Company
Name of the Student
Name of the University
Author’s note

1IT INFRASTRUCTURE OF MYHEALTH COMPANY
Table of Contents
1. Introduction..................................................................................................................................2
2. Discussion....................................................................................................................................2
2.1 Security Policy Development................................................................................................2
2.2 Review and Improve Security Policies..................................................................................8
3. Conclusion.................................................................................................................................10
References......................................................................................................................................12

2IT INFRASTRUCTURE OF MYHEALTH COMPANY
1. Introduction
MyHealth Company is considered as one of the best healthcare service providers that is
primarily involved in the management of health education, research based on cancer related
issues and several clinical practices. With the rise of technological systems and a vast form of
usage of essential services, it has been seen that the company makes use of their database server
for the purpose of storing information based on the medical history records of patients (Green et
al. 2014). The company generates a wealth of data based on the analysis of their internal research
team.
However, it has been seen that the internal systems within the organisation have an
extremely poorly designed network that is not supported with the best level of security. Based on
the large number of medical records stored within their database servers, it is a very important
criteria for the company to ensure a highly accessible server that would be able to maintain each
of the complexities involved within their network (Boudreaux et al. 2014). MyHealth has a huge
need for developing a secure web system and protecting their internal servers from various kind
of attacks that might get launched within their internal database servers. This report would thus
discuss about the different forms of development of security policy. The report would further
also discuss about the essential policies based on improving the security functionalities within
their application and thus improving the system architecture based within the boundaries of the
company.

3IT INFRASTRUCTURE OF MYHEALTH COMPANY
2. Discussion
2.1 Security Policy Development
Based on the results gained from risk assessment, some of the access control policy that
could be developed for MyHealth Company are:
Generic Identities – The group IDs would not be provided without the access of critical
data. They would thus be granted permissions based on certain exceptional circumstances
Privileged Accounts – The allocation of different forms of privileged rights such as
domain administrator, root access, super-user and local administrator would be strictly restricted
and thus be controlled (Shin et al. 2015). The authorisation of such kind of accounts would not
be provided explicitly but would be granted access only after proper approval from any senior
manager. It would thus be documented by the owner of system. The technical teams should be
able to safeguard against the use of privilege rights. These would thus help in maintaining the
prospects of integrity and confidentiality.
Maintaining data security levels – Each of the user involved within the system should
gain a knowledge about the importance of data security and sensitivity (Mosadeghrad 2014). The
users who would place the patient information in database systems should ensure that protective
measures are applicable over such systems.
Passwords – Highly strengthened passwords should be applied. The issuing of passwords
should be based on certain encryption algorithms that would help in ensuring the security over
such systems.
The differences between the incident response and disaster recovery could be discussed
as: The Incident Response could be defined as an organized approach based on the factors of

4IT INFRASTRUCTURE OF MYHEALTH COMPANY
addressing and management of aftermath of any incident of security breach or other security
event (Liu & Park 2014). On the other hand, disaster recovery can be defined as an approach
after the occurrence of a security event that would have a direct form of access towards the
business continuity.
The incident response team is responsible for performing a thorough analysis over each
of the security breach incidents and thus take certain necessary steps based on response to such
incidents (Ruefle et al. 2014). The disaster recovery team is responsible for setting different
plans based on recovery and providing motion to the team based on coordinating each of the
efforts during the oath of progress. These teams also help in facilitating towards the resolution of
problems that would be encountered during the path of functions.
The six phases based on the development of an incident response plan can be discussed
as:
1. Preparation – In this phase, each of the requirements would be properly checked. The
MyHealth Company should be able to design response plans, call trees, policies (Ab Rahman and
Choo 2015). They should also gather other documents should be put in proper place based on the
identification of incident response team.
2. Identification – In this phase, the working plan should be mainly prepared. The
MyHealth Company should prepare a workout plan for the design of their internal systems
(Tøndel, Line and Jaatun 2014). Significant deviations could also be made based on certain
methods and “normal” traffic baselines.
3. Containment – In this step, the workout plan would be executed. During this phase,
the MyHealth Company should prepare strategies based on limiting the damage caused within

5IT INFRASTRUCTURE OF MYHEALTH COMPANY
their internal systems (Othman, Beydoun and Sugumaran 2014). The company should also
prepare long and short term containment activities that would be able to help in limiting the
raised issues.
4. Eradication – During this phase, a clean system should be made ready based on
preventing any occurrence of further damage. The MyHealth Company should design their plans
with the help of an incident response team. The company should also design backup procedures
based on putting the existing system on to the backup platform.
5. Recovery – In this phase, it would be highly determined whether to put the original
system in proper place. The MyHealth Company should decide on proper strategies based on
deciding about putting the original systems back from the backup systems (Ahmad, Maynard and
Shanks 2015). Another factors that would need to be determined is based on identifying the use
of monitoring systems based on the detection of any form of abnormal activity within the present
systems.
6. Lessons Learned – It would be highly critical to put a look behind at the chosen
systems and thus see the proper working of every system in a proper order. The MyHealth
Company should perform a re-check over their presented systems (Koning et al. 2015). They
should also ensure that the proper security algorithms have been implemented and whether these
systems are working in a synchronised manner.
Examples of natural or human-made disasters are: Hurricanes, earthquakes, fire
accidents, transport accidents and industrial accidents. The three phases of disaster recovery are:
Mitigation, Response and Recovery. In the mitigation phase, the efforts based on pre-disaster
mitigation n procedures would be mainly defined (Coombs 2014). In the phase of response, a

6IT INFRASTRUCTURE OF MYHEALTH COMPANY
strict and immediate response plan should be shared with each of the stakeholders. A business
recovery center should also be established within the organisation. In the recovery phase, a plan
based on post-disaster recovery should be defined.
Maximum Tolerable Downtime (MTD) can be defined as the maximum time up to which
a certain business would be able to tolerate the unavailability or absence within a particular
function of a business (Sun et al. 2016). Recovery Time Objective (RTO) and Recovery Point
Objective (RPO) can be defined as one of the most important parameters based on disaster
recovery or protection plan for data. The use of RTO would be able to analyse the inclusion of
the plan for business continuity.
The five control methods for controlling identified threats are:
Identified Threats Name of Control Technique Name of Control Method
DoS attack Least privilege, Threat detection Detective Controls
Remote execution of
malicious codes.
Web filtering, block high-risk IP
address changes
Preventative Controls
Backdoor Attack Incident response process Corrective Controls
The differences between preventive, detective and corrective controls are:
Detective Internal
Controls
Preventative Internal Controls Corrective Internal
Controls
These controls would
be mainly designed
for finding errors
after the event of
occurrence.
These controls are put in proper place
in order to prevent several errors and
irregularities from their occurrence.
These controls are put in
proper place in order to
correct any kind of errors that
were found within the
defective internal controls.
The defective internal
controls would be
useful for the
These preventive controls occur on a
regular basis
Different procedures should
be place for correcting the

7IT INFRASTRUCTURE OF MYHEALTH COMPANY
protection of assets order.
Some of the
examples of defective
controls includes
protecting the
systems from Least
privilege and Threat
detection
Examples of preventive controls
include block high-risk IP address
changes and web filtering
Examples of this kind of
control include Incident
response process
The types of access control systems that could be used for the controlling of threats are
classified as physical and logical (Levy 2014). Three different forms of access controls that
would be helpful in preventing unauthorized access to towards the MyHealth Company are:
Mandatory Access Controls (MAC), Role-based access control (RBAC) and Attribute Based
Access Control (ABAC).
The data security controls for the different states present within the company are:
Data at Rest – The data stored with the help of backup tapes, offsite cloud backup and
hard drives could be defined.
Data in motion – The data that would cross across networks based on local storage to
cloud storage should be properly encrypted. The aspect of data in motion could be able to
include data that would move across wireless or cables.
Data in use – This kind of data can be defined as data that is presently been in use. The
protection of such data could be defined as a challenging task.
Based on the discussion over the factors present within MyHealth Company, the multi-
factor method of authentication could be mostly and vividly recommended within the company.

8IT INFRASTRUCTURE OF MYHEALTH COMPANY
Based on the use of this method of authentication, the computer user would be granted access
based on the successful presentation of more than two pieces of evidences.
The Single Sign-on systems could be helpful for MyHealth Company to authenticate the
data that might be entered within the internal records of the company. The website would mainly
redirect the user within the SSO supported website based on performing the operations of log in
(Suoranta et al. 2014). After the user has been authenticated, the internal system would verify
and match the identity of the user with the input within the new website. In order to implement
the SSO service, the protocol that need to be managed and implemented for the SSO service is
SAML
2.2 Review and Improve Security Policies
Some of the different versions of policies that would be created for proposing of policies
within the company are:
Data Backup Policies:
1. An appropriate team would be responsible for performing the cases of backup for the
data stored within the organisation.
2. All of the backup data should be stored in an encrypted manner. They would be
encrypted at rest with the help of AES-256 symmetric encryption algorithm.
3. The backup copies of each stored data should be kept in an environmentally protected
and an offsite location (Xia et al. 2014).

9IT INFRASTRUCTURE OF MYHEALTH COMPANY
4. Each of the stored copies should be stored with the help of a short description that
would include information based on: resource names, backup date or type of backup method
used.
5. Each of the stored backup copies of data should be made available based on authorized
form of request.
6. A whole record of each of the logical and physical movements over each of the backup
copies should be highly maintained.
Computer Policies:
1. No user should access the computer within the company or avail network facility
without prior and proper form of authorisation. There should be no individual who would assist
in, encouragement, and attempt at unauthorized use of the network and computer facilities.
2. No individual should knowingly pose endanger towards the security of the computers
and network facility.
3. There should not be anyone who would make use of the different forms of
communication facilities that would be provided from the company. There should not be any
form of legitimate use based on the computer facility (Lowry et al. 2015). The users within the
MyHealth Company should have the full responsibility to store the data within the computers.
They would not be given the facility if transmitting the stored data to any other system that
would be outside of the premises of the organisation.

10IT INFRASTRUCTURE OF MYHEALTH COMPANY
4. Any form of unauthorized communication or connection based on connecting within
the premises of the company. Each of the established connection should meet with the proper
form of security requirements and technical standards.
5. Any user who would not have specific authorization over the use of facilities within
the company would not be granted to any form of facilities within the company. They should not
also try to select any kind of unauthorized means based on gaining a charge over the system
administrator (Demir, Cunche and Lauradoux 2014). The system administrator would only be
provided the responsibility to authorize over the issue of passwords for the computers.
6. No individual should be provided the rights to copy or install any kind of software or
data files within the system. This would be highly considered as an act of violation of copyright
issue or license agreements. They should not also create software or data files that would be in
violation of applicable copyrights.
3. Conclusion
Based on the discussion supported from the above discussion, it can be concluded that the
use of proper systems and security policies would be highly essential in securing the high-end
technological systems of the company. The report discusses about the nature of the MyHealth
Company and the various functions that are supported within the functionalities. The report thus
discusses about the cases of incident response and disaster recovery that have been considered as
the primary business aspects. An incident response plan has also been defined for the
organisation. This plan helps in understanding the key problems that might be faced by the
organisation. Based on the development of the plan, each of the activities have been defined that
would be helpful in mitigating the scenarios of risks occurring over the company.

11IT INFRASTRUCTURE OF MYHEALTH COMPANY
The report also focuses over the aspects of disasters that could be human-made or natural
disasters that could devastate the internal structures of the organisation. the proper definition of
MTD, RTO and RPO have been described in detail in order to gain a clear understanding about
each of the scenarios during the time of disaster recovery. The report also puts emphasis over the
various forms of access controls that could be applied within the systems based on protecting the
assets of the company. A complete review over each of the security policies have also been
discussed in detail. Hence, from the discussion it could be concluded that the use of such
measures would be helpful in mitigating the several problems within the MyHealth Company.
The introduction of efficient form of policies within the company would be able to secure the
data stored within the cloud platforms. It would also help in maintaining the efficiency of
website and thus aid in the business processes.