Fichas
SecurityAmia22
Fichas del conjunto (41)
- 1what is a firewall?set of hardware components and network with software to restrict network traffic to conform to security policy of the site
- 2what is a virtual private network?virtual network built on top of physical networks, that provide a secure communications mechanism for data and other information transmitted between networks
- 3define encryptionthe method of converting an original message/data into "encoded" data by means of an algorithm. which requires a "key" that only the receiver should have and be able to decrypt the data
- 4List some data encryption standaredsDES = data encryption standard
Triple DES, AES = advanced encryption standard - 5What is a hash?method of cryptography that converts any data into a unique string of text. any piece of data can be hashed, no matter type or size
- 6Give examples of Hash Algorithms?SHA-1, SHA256, Message-digest 5 (MD-5), Hash message authentication code (HMAC)
- 7What is public-key encryptiona cryptographic system that uses keys where public keys ( known by others) and private keys (only known by onwer)
- 8what is a zero-day vulnerability?newly discovered, and it is newly discovered and no update to fix issue has been released yet.
- 9What are provisions of the hipaa security rule?1)ensure confidentiality , integrity and availability of all e-PHI that they create, maintain, receive or transmit 2) identify and protect against reasonably anticipated threats to security or integrity 3) protect against reasonably anticipated impermissible uses or disclosures, 4) ensure compliance by workforce
- 10how does hipaa define Confidentiality ?e-phi is not available or disclosed to unauthorized persons. supports the privacy rule prohibitions against improper use and disclosure - promotes 2 additional goals --> integrity and availability
- 11Under HIPAA security rule, what does integrity mean?e-Phi is not altered or destroyed in an unauthorized manner
- 12Under hipaa security rule, what does availability mean?e-PHI is accessible to authorized users on demand
- 13How did security and privacy part of ARRA change HIPPA1) limited data sets 2) restrictions on disclosures, and 3) added reporting requirements
and made sure that enforcement included both CIVIL and CRIMINAL penalties - 14What big change did ARRA make to HIPAA privacy and securityApplied to Business associates requiring changes to agreements, BAA must demonstrate documented policies and procedures, and notify covered entities and HHS of breaches
- 15who is covered under hipaa?Providers of all types, Health plans of all types, clearinghouses that process transactions
- 16what does HIPAA stand for?Health Insurance Portability and Accountability ACt
- 17define a business associateperson/entity other than a workforce member who performs functions or activities on your behalf, provides certain services to or for you, and when services involve the access to, or the use of , or disclosure of PHI
- 18what is considered a breach?unauthorized acquisition, access, or disclosure of unsecured PHI which compromises the privacy, security or integrity of PHI
Unsecured = Phi not secured by technology or method specified by hhs through guidance - 19What are the reporting requirements for a breach1) notify individuals w/in 60 days
2) notify public media if >500 pts
3) notify HHS without delay for breaches >500
4) annual report to secretary of all breaches - 20List technical measures to prevent breaches?audit trails, encryption, VPN, software discipline, system assessments, strong authentication, firewalls
- 21What is Authentication?process of verifying the identity of an entity that is source of a request, or response for information in a computing environment
- 22what are the possible criteria that authentication is based on?1) something you have - key, card, token
2) something you know (mothers maiden name)
3) something related to you - fingerprint, retina, voiceprint, dna
4) something indicating location - termina id, network address - 23what is difference btw authentication and authorization?Authentication ---> who you are
Authorization --> what you can do - 24how are "ease of access" and "security controls related?They work against each other
- 25what is Blockchain?hashchain of block used to create a distributed ledger in conjunction with a consensus protocol and membership protocol
- 26what are the benefits of blockchain?decentralized management, immutable audit trail, data provenance, robustness and availability and security/privacy
- 27Name three types of security controls?Administrative
Physical
Technical - 28give examples of administrative security controls?internet use policy, password management policy, not using SSN in clinical research , BAAs , contracts
- 29Give examples of physical security controls?badge access, camera/rfid protection, dual lock systems for pathogens/animal, data center and data closet security
- 30give examples of technical security controlsfirewalls, VPNs, Network Access controls, Intrusion Detection and preventions systems (IDPS) , data leakage protection, encryption, authentication, authorization, audit logs, patching, antivirus/spyware, host based firewalls, etc
- 31list best practice for organizations for security?security/confidentiality policies
Security/confidentiality committees
Information Security Officer
Education/Training
Sanctions
Improved authorization forms
Patient Access and audit logs - 32what examples of security layers in a healthcare orgPhysical -fire/power/intrusion
NEtwork - firewalls, wired equiv.privacy)
Social -phishing, malware, spoofing
Software - design, updates, authentication
Data - backup, restore, redundancy - 33what is malwaremalicious software
- 34what is a "spoofing" attack?person/program successfully masquerades as another by falsifying data , illegitimate advantage
- 35what is "phishing"deception using email where users are enticed to follow attackers instructions to go to malicious sites or impersonate valid sites to steal data/credentials
- 36what is a Denial of Service Attackattempts to prevent legitimate user access to information systems
- 37what is ransomeware?malware that infects a system/network and prevents users from accessing the computers without paying the ransom. wont restore if not paid
- 38what is the # 1 cause of security threat to healthcare ?Improper usage by inside individuals
- 39what law requires healthcare orgs to conduct/review security risk analysis and implement security updates as necessaryARRA 45 CFR 164.308 a(1)
- 40who is the enforcer of the security breach incidents?The office of Civil Rights (OCR)
- 41What is DMARC?domain -based message authentication , reporting, and conformance - = email authentication, policy, and reporting protocol - built on SPF and DKIM
Información
- Descripción
- Board Exam HealthInformationSystems Fichas sobre SecurityAmia22, creado por Michael Riben el 06/10/2022.
- Creado por
- Michael Riben
- Visitas
- 1
- Valoración