System Rules of Behavior, Research Paper Example

It is very important that the systems established to welcome users have a specific rule of policies that are dedicated to make a definite impact on how the users themselves would behave towards the operation of the system. In this regard, the system rules of behavior are among the aspects of the SSAA regulations that must be given attention to. Notably, it could be analyzed that these set of rules intend to define how the division of information that is accessible to specific users only ought to be fully respected. What makes these policies definitely comprehensible is that the system itself has a form of operative control that makes it easier for the users to apply the needed behaviors for the functioning conditions that they ought to recognize while using the website’s shared and private information.

The MCC or the Medical Credentials Company is one organization that provides a clearinghouse for doctors, hospitals and other group practices. Considering the role of the organization, it could be analyzed that a shared online network from the company ought to be well protected. Noting that there are different users who engage in the process of accessing the information to be kept and shared in the network, several points of access point allowances should be given attention to. In the discussion that follows, such division of access-capacities shall be given particular attention to.

The first aspect to give consideration is that of the access that the regular users are to be given. As mentioned earlier, MCC provides the right for third party groups to access particular information that are needed in attending to patients. This particular party includes nurses and other remote healthcare providers who might be attending to the same patients. The access point they are to be allowed to have control of need to be specifically designed to give them only the information that they need and the data that they are allowed to see. This means that the information sharing process ought to be hierarchical. Note that through this approach, the information that are protected and are dedicated to higher supervisory positions only are to be well protected hence putting a great deal of consideration upon the privacy of such data. This aspect of the system’s operation requires the establishment of network firewalls. These firewalls ought to protect the data inside from being accessed by unauthorized personnel. To be able to complete this task, the project or system creators ought to formulate numerical coefficients that would stand as variables for access that the users could use to verify which level of users they are hence allowing them to access information that they could rightfully see and note.

Most likely, the establishment of such security firewalls would take at least a week and a half especially considering that the network shall be made available online. Trials and testing methods ought to be applied to completely see how the firewall functions for the protection of the data stored in the system’s online database. The differential level of access points of the users depending on their hierarchical position in the organization may be one of the most important obstacles that the system creators ought to give attention to. Take note that this means that the divisions of hierarchy ought to be clear. Protecting the information based on this hierarchy of users also mean segregating the information depending on their usability based on the position of the users. For example, a nurse would only need the basic information about a patient as they tend to him or her. However, for a doctor, more in-depth data might be required for diagnosis and reporting purpose. Storing the data into the system alone could already take a week. The other week and a half that was stipulated above is expected to be considered as the point of processing the system’s conditional establishment that is dedicated to making a great impact on how each member of the healthcare organization functions properly for their stakeholders in the society, their patients.

Following the standards of the DITSCAP SSAA guidelines, it could be understood that the need to control the data distribution only to authorized personnel is a crucial point of defining the usability of the system produced. An online database created for MCC is then expected to follow such pattern of information protection and security that would depend largely on the pattern of firewalls that the creators of the system ought to apply in recognition of the said process. In this case, the proper function of the system is not only assumed to be dependent on how much information it could share but also on how efficient the system would be in segregating the information that is to be given towards the users depending on their authorized points of access.

In this regard, it is deemed that the allotted time of at least two and a half weeks is enough to establish the system’s sufficiency and efficiency to function for the target organization. Notably, it could be analyzed that given the proper number of personnel working on the system’s development, the capacity of the system to provide the service and function it is hoped to give to MCC and its stakeholders would be established enough. Given the said time, trials and runtime revisions are expected to be completed hence releasing the system for use at the right time as required by the organization being served. From this point, the group who would handle the project’s completion is expected to make recommended adjustments according to the function of the system that MCC requires during the allotted time. Putting attention particularly on imposing the policies and the technical operations related to securing the information placed within the conditions of the database to be used by the company, the group of system creators are expected to provide ample functional competency on the system that they are to provide.

References:

SSA Outline Guidelines. http://securityv.isu.edu/pdf/ssaaoutl.pdf. (Retrieved on June 10, 2012).

System Authorization Access Request (SAAR) Documentation. System Rules of Behavior. http://www.docstoc.com/docs/849467/DD-Form-2875-System-Authorization-Access-Request-(SAAR)-April-2005. (Retrieved on June 10, 2012).

SANS Institute InfoSec Reading Room: An Introduction to Certification and Accreditation. http://www.sans.org/reading_room/whitepapers/standards/introduction-certification-accreditation_1259. (Retrieved on June 10, 2012).

Security Plans to System Security Authorization Agreements: A Guide for Using the NIACAP Methodology to Develop Quality System Security Plan Certification and Accreditation Packages Developed. https://acc.dau.mil/adl/en-US/33266/file/6591/%2314111%20Department%20of%20Commerce%20Guide.pdf. (Retrieved on June 10, 2012).