Assignment Instructions

Part 1: Major Events Documentation

Scenario: You visit a retail establishment, shop around, and finally carry several products to one of the point of sale (POS) terminals distributed openly around the store. You produce a credit card, the salesclerk processes the transaction, bags your goods, and hands you the receipt. On your way to the exit, a store employee asks to see your receipt and checks the contents of the store bag. Document each of the major events just described and explain them in terms of the PCI compliance standard. Include this report in your assignment.

Part 2: PCI Compliance

This part of the assignment will cover PCI. Please refer to Figure B1 in your responses.

Respond to and address the following in essay style:

Suppose HGAs mainframe, depicted in Figure B-1, stored cardholder data in the private databases. What steps should be taken to protect that data in order to be PCI compliant?

HGAs mainframe has network connectivity. Assuming that cardholder data is transmitted across these networks, describe how data should be protected in transmission.

Users are located at various sites connected to the HGA network. Suggest appropriate access controls to restrict unauthorized users from looking at cardholder data.

The PCI specification notes that all systems and network devices connected to a system that stores, transmits, or processes cardholder data is in scope and must comply with PCI specifications. To avoid having the whole network subject to PCI specifications, how would you segment the network to reduce the scope of compliance?

Read the following information about a typical dental practice:

Community Dental has two offices in the same city the North office and the South office. These offices offer the same dental services to patients. Patients can make appointments to either office at their convenience to see the dentist of their choice. Both offices are similarly equipped.
The professional staff includes the dentists, hygienists, dental mechanics, and administrative staff (receptionist, billing clerk, and office manager).
Each Community Dental office has a waiting area served by a receptionist who uses a computer to check in patients, schedule one of the examination rooms, and answer the phone. The waiting room has a door opening to the outside. A second door admits patients into the rest of the facility. Background music plays inside the waiting area. There is also a large aquarium on display.
Each examination area is partitioned off from the adjacent ones. Each has a computer and LCD screen used to pull up patient information and record new dental data such as x-ray interpretations, examination and test results, and procedures done for the patient. A low-level sound masking system is installed in this area.
After their treatment, the patient visits the billing clerks desk, which of course has a computer and a printer. Here patients pay (cash co-pay, credit card, or check), insurance information is verified, and an appointment is made. This clerk also mails out postcard appointment reminders and answers the phone.
The Community Dental dentists share a private office that has a computer and a printer. Here they can review patient data, access the Internet, and exchange email with their patients, colleagues, and acquaintances.
A database server containing patient data sits in a closet, next to a small tape library used for backup. Next to it sits a VPN server, firewall/router, and cable modem connected to the Internet. The VPN server accepts incoming connections from the dentists home computers. It also provides a permanent VPN connection between the North and South Offices. In this way, all patient data is available at all times at either office.
Most patient data is stored electronically on the database server, but some data such as x-rays and third-party labs results are still in physical form. Community Dental also depends on third party service providers to build crowns, braces, false teeth, soft dental protectors, and such. Information is exchanged with service providers using telephone, fax, letter, and email.
The network infrastructures management and maintenance are outsourced.
Community Dental also maintains an informative website to advertise its practice. The site is remotely hosted.

Answer the following questions in essay style. Make any sensible assumptions necessary in order to continue your analysis. Feel free to use the discussion board to share your assumptions with others in the class:

What is all the electronic and non-electronic private health information (ePHI) that is stored, processed, and transmitted at Community Dentals two offices?

Assess the practices organization. Where is it most likely HIPAA compliant? What changes should be made to move the practice closer to compliance?

Assess the practices physical and technical safeguards. Where is it most likely HIPAA compliant? What changes should be made to move the practice closer to compliance?

Community Dental exchanges data with service providers and uses a third party to manage its IT infrastructure. What administrative and organizational safeguards should the practice expect these providers to adhere to?

Alternative Processing Site Proposal

R&D Media, LLC has asked you to develop a proposal for an Alternative Processing Site.

Conduct research on the latest technologies for Alternative Processing Sites (feel free to use your teamwork for this part of the assignment).
Determine who the companys stakeholders are.
Using the results of your research, develop the request for proposal that best meets the stakeholders requirements and incorporates innovative technologies.
Within your proposal you must also consider cost and what R&D Media, LLC can afford.
Develop and document the requirements for R&D Media, LLCs alternate processing site.
Identify the mission critical services and indicate services that are not provided at the alternate site. The plan must include all data security issues.
Create and document the design and do walkthroughs for building the alternate site to ensure that there are no omissions and errors.
Document the activation process for the alternate processing site.
Document the hand-back process.
The information you need about R&D Media, LLC is as follows:

Consider the LAN for a small 100-person business, R&D Media, LLC Inc. The business occupies one floor in an office building. Everybody has a computer on his or her desk, and there are servers for the web, file and print sharing, email, database, and a small 3D render farm, a rack of 20 quad processor Xeon servers running Red Hat Linux that generates the actual high-resolution video animations that R&D Media, LLC produces for its clients. The desktop systems consist of Apple Mac Pro desktops running the latest version of the Mac OS for the creative staff, and the latest version of Windows on computers for general use. The servers are running the latest version of Windows Server running Microsoft Exchange, web server, and file and print service.

The network is gigabit

Ethernet and the network hardware are a mixture from Cisco and Hewlett-Packard. Employees, business partners, and clients may visit R&D Media, LLCs office with laptop computers in order to collaborate on projects. The laptops will obtain their IP configuration from the DHCP server at R&D Media, LLC.

R&D Media, LLC has 10 megabit/second Internet access and uses a SOHO firewall that doubles as a DHCP server. This firewall filters out Internet-based attempts to access R&D Media, LLCs servers and desktop computers, but admits email, web, and SFTP (Secure FTP) traffic destined for specifically hardened servers.

R&D Media, LLC produces short animation movies for advertiser clients

These clients are located worldwide and need to communicate securely with R&D Media, LLC as they collaborate on their advertising shorts. R&D Media, LLC uses its high- speed Internet connection both to support the exchange of movie shorts as well as for email and general Internet web connectivity.

The network has the following additional specifications:

The network is all TCP/IP based.
The network is based on Cisco routers and switches.
All desktop computers include email, web, database access, and office productivity software.
Creative users also have multimedia authoring software installed.
All server and critical network equipment are in a secure server room.
Printers are located around the office area.
The multimedia department uses high-end workstations for video rendering and animation.
A load-balancing dual firewall connects the network to the Internet.
Security Policy:

All email must be secure so it cannot be inadvertently sent to the wrong party or intercepted.
All network resources and equipment must be password protected.
Company equipment may not be used for personal business.
All Windows-based PCs must run approved anti-virus and antispyware programs.
All servers and desktops should run host-based intrusion detection software.
Clients may use the Secure FTP (SFTP) server to send or receive multimedia files, but under no circumstances should one client be able to view the files of any other client.
The mail server must be configured not to forward email that originated on the Internet.
Password aging must be enforced on all servers and desktops.
All server configurations must be readily available to rebuild a failed system.
Offsite backup is required, with 24/7 access to that location.
All employees will demonstrate they understand the security policy.
There will be a security officer who reports directly to the CEO of R&D Media, LLC.
Be sure that you capture the following information in your report:

List of mission critical applications, list of non-critical applications dropped
New technologies for Alternative Processing Sites are utilized
The needs of R&D Media, LLCs stakeholders are considered within the plan
A Plan for updating alternate processing site software during normal operation
Documentation showing a simple rack diagram and a network diagram
Network configuration info (IP, DNS, MX)
Power consumption estimates
Bandwidth estimates
Information security architecture (firewalls, VPNs)
Plan for cutting over to the alternate plan
Plan for cutting back to the main site (a.k.a. hand back)