Plan Patton-Fuller Community Hospital Networking Virtual Organization, Essay Example

 An organization’s system management plan must reflect the capability to cope up with the latest trends in technology and security. It is vital to incorporate a scalable and secure solution for the sustainability of the organization in the market. Before taking decisions on computer network architecture upgrades, security experts must be engaged for expert advice regarding the three triads i.e. Confidentiality, Integrity and Availability. Likewise, these three factors need to be considered before deploying any change within the organization. For instance, the confidentiality factor may consist of security mechanisms and security device capability to prevent data leakage and a breach of confidentiality. Secondly, the integrity will guarantee no interference with the confidential information and its originality will be preserved by up to date firmware, hardware and definitions on the security devices operational on the network. Thirdly, the availability factor must also be ensured by implementing devices with scalability and a long end of life / end of service, as per the organization’s strategic goals. Therefore, a change management phase must be reviewed by security experts to meet security baselines and strategic objectives for the organization. Moreover, the change management process should incorporate impact assessment and risk assessment. Both of these assessments assure a calculated and controlled change i.e. a change with identified risks and acceptable impact levels.

An inventory should be in place for identifying all IT assets of the organization. Likewise, an IT asset coordinator should be in place for recording the assets, tagging asset ownership, procuring and disposing assets and identifying assets with end of life / end of service. Secondly, the configuration management process should be owned by the relevant stakeholders, keeping in mind about the configuration changes within the infrastructure. The primary objective is to record the changes, access the impact and identify risks. Likewise, configuration management for an infrastructure can be associated with the frequent changes within the network. For instance, frequent allocation of IP addresses to a network device, virus definitions, security patches, firmware updates are frequent changes and can be considered as configuration changes for the network (Dynamic host configuration protocol 2007). The process for configuration management should be automated, as every stakeholder should identify their configuration items, record them and update them on a portal or in a word processing document.

For managing these configuration items, there must be a process in place, for instance, a checklist should be maintained for updating the frequent security patches and functional fixes to applications and network devices. Moreover, patch management for security appliances must also be recorded so that they can be checked in spot checking or audit by the relevant function of the organization. Moreover, for contingency planning, a separate team should be in place for implementing business continuity framework within the organization. Likewise, there are two plans that needs to be established i.e. Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP). The BCP plan is a business document and needs to be filled by the relevant business owners, whereas, the DRP document addresses all the technology related contingency planning. However, it is derived by the requirements given by the business within the BCP document. One example would be a data backup contingency i.e. data that is required after disaster should not be more than 4 hours old. The technology team will then establish a backup procedure after every four hours.

For addressing application security, the security team should be involved in the initial stages of software development life cycle. Likewise, the primary goal is to stabilize the application architecture in terms of security controls and their effectiveness. Moreover, the team also needs to ensure for adopting the software secure coding standards to avoid any vulnerable items that may be identified or may not in the testing and UAT stages of Software Development Life Cycle. Further, after addressing these risks, the application layer security is ensured and the security on remaining layers of the OSI model can be ensured by implementing encryption, protocols supporting cryptography, bio metric access to critical assets and implementing environmental controls where necessary. Apart from ensuring security on every layer of the OSI model, the ‘availability’ factor needs to be in place. For instance, if the hospital needs to communicate high definition scans of a patient to another remote office, the infrastructure should ensure a robust transfer of patient file that may be very large in size. Likewise, the availability of that file on the remote location is critical due to patient’s health condition. In this scenario, the network devices and Wide Area Network link should be fast enough, otherwise, patient’s life should be at risk, if the file does not arrives on time to the doctor  available with the patient on a remote site. As mentioned earlier, an IT asset coordinator will be responsible to inform the approval authorities timely for replacement of end of life/end of service equipment from the network. An alert mechanism should be in place that may generate alerts on email or cell phone about the replace or downtime of specific hardware equipment or a security appliance. However, priority of both should be different.

References

Dynamic host configuration protocol.(2007). Network Dictionary, , 167-167.