Bene Gesserit Urgent Care Offices (BGUC) - Component Architecture

James Reynolds, Quincey Jackson, & Aly Malak

Department of Cyber Security, University of San Diego

CSOL-520: Enterprise Security Architecture

Professor Michelle Moore, Ph.D

December 4, 2023
 2

Bene Gesserit Urgent Care Offices (BGUC) - Component Architecture

Bene Gesserit Urgent Care (BGUC) plans to continue utilizing the Sherwood Applied Business

Security Architecture (SABSA) framework, which focuses on connecting each security function to a

business goal, to drive the development of its employee and patient portals. BGUC has thus far utilized

this framework to develop the conceptual, contextual, logical, and physical architectural layers. The most

recently completed layer, the physical architectural layer, outlined the Business Data Model and the

security rules, practices, procedures, and mechanisms as well as identified the users, applications, user

interfaces, platform and network infrastructure, and control structure execution for the Enterprise

Architecture (EA). At this stage of the development process, BGUC will plan the component level

architecture for the EA using the models, rules, and infrastructure created in the physical architectural

layer. This component architecture outlines “the hardware items, software items, and interface

specifications and standards” to construct the structures designed at the physical architecture level

(Sherwood et al., 2009).

Detailed Data Structures

Data structures help facilitate the manner in which data is exchanged across the network. It

consists of the different information and communications technology (ITC) components. The following

ICT components are recommended based on BGUC’s needs:

(1) Abstract Syntax Notation (ASN.1): Group of syntax and encoding rules used to define the data

structures in security protocols like digital signatures and digital certificates (Sherwood, 2005)

and certificate requests and enrollment (Ashcraft et al., 2023).

(2) Extensible Markup Language (XML): Creates application-level languages that are specific to the

type of client-server communication and information exchanged. Has pre-existing XML security

standards, such as XML Encryption and XML Signatures, making it easy to act as a building block

for BGUC’s different types of client-server interactions (Sherwood, 2005).

 3

(3) Trackers, Sensors, Wearables (e.g., smart watches), and Stand-alone Kits (e.g., blood sugar kits):

Empowers patients when they are at home and during their daily activities to take ownership

over their health and monitor key levels relevant to their care. Aids with management of

patients when at BGUC’s facilities, such as providing pulse rate, oxygen levels, and CT scans or

MRIs, without invasive tests or surgery (Arora, 2020).

(4) Healthcare Customer Relationship Management Software: Helps manage the relationships and

interactions between BGUC and its patients by tracking patient medical and prescription data,

appointments, and communication history. Keeps track of referral networks, manages doctor

and medical professional contacts, and monitors and manages BGUC’s online reputation, such as

social media and online review, and payments (Scheiner, 2023).

(5) Health Portals: Resource of medical knowledge and information to be used by medical staff.

Used to facilitate electronic prescriptions (Arora, 2020).

(6) Medical Imaging Software & Hardware: Help BGUC employees visualize and interpret BGUC’s

patients’ interior of their human bodies and detect, diagnose, and monitor diseases and

conditions. Provide high-resolution imaging (2-D and 3-D), radiology imaging, images across

multiple devices, and artificial intelligence data analysis and rapid analysis (Aston, 2023).

(7) Network Hardware: Physical network devices required for the communication and interaction

between BGUC’s network devices. Modems connect computers to the internet, routers connect

multiple networks, hubs, bridges, and switches connect multiple devices to the router and

enable data transfers on the network, network interface cards connect computers to the

network, network cables (over wireless connection) connect BGUc devices to its network and

firewall protects the network from attacks on computers on the network (Kanada, 2022).
 4

(8) Wireless Networks (public and non-public): Public wireless network provided to employees for

personal use and to patients while on premises at BGUC’s facilities. Private wireless network to

be used for communications between BGUC’s medical and IT devices.

(9) Cloud: Stores patient and company data. Allows for easy access to patient data across the

different BGUC medical units and locations. Hosted by a third party provider with a backup

on-site at one of BGUC’s secure facilities.

(10)Information Security & Governance Policies: Encompasses guides, standards, and frameworks for

IT governance and security in proportion to BGUC’s size, the type of organization it is, complexity

of its systems and devices, and the type of data collected. Outlines BGUC’s key organizational

objectives, security risks, roles and responsibilities within the risk framework, identification of

assets, risk assessments and mitigation strategies, and information security policies (European

Banking Authority, 2019).

Security Standards

Cybersecurity standards are overarching plans of minimum requirements for cybersecurity that

benefit both the organizations subject to them and other entities with which those organizations

interact. Standards will provide BGUC with roadmaps to guide it in reducing its cyber risk through

policies, tools, and goals. These standards provide all interacting entities with a sense of assuredness in

the competency of BGUC in appropriately managing cybersecurity (CGI, 2019). As a healthcare company

within the local region, BGUC needs to comply with the following standards:

(1) Healthcare Insurance Portability and Accountability Act (HIPAA): U.S. federal law establishing

Privacy and Security Rules for the protections of patients’ private health information (Lexigram,

n.d.).
 5

(2) Health Information Technology for Economic and Clinical Health Act (HITECH): U.S. federal law

strengthening HIPAA, establishing annual audit requirements, and promoting the use of

electronic health records (EHRs) (Stringfellow, 2022).

(3) ISO 27000 Series: “International guidelines - for managing the risks relating to various types of

information such as customer data, intellectual property, financial systems and personal data

(ISO.org, n.d.).”

(4) Payment Card Industry Data Security Standards (PCI DSS): Financial industry standard promoting

data security for the use of payment cards in a digital environment (PCI Security Standards

Council, 2022).

(5) HITRUST Common Security Framework: Security framework designed to consolidate

requirements from HIPAA, ISO, NIST, and PCI DSS in a convenient manner (Lexigram, n.d.).

The above standards all provide frameworks for BGUC to assess and manage its cyber risk. To aid

in managing this risk BGUC will utilize the risk analysis tool of risk registers identifying the information

identified below in Figure 1. The below risk registers will provide BGUC with a comprehensive catalog of

all of its identified risks and record of which individual or group is responsible for the mitigation plan for

those risks.
 6

Figure 1. Risk Register contents (Team Asana, 2022).

Security Products and Tools

Processes, tools, and protocols will be implemented to ensure that all hardware and software

components for each portal are reusable and capable of being integrated independently throughout any

software and hardware components that are running the BGUC platforms. With component-based

architecture, BGUC can leverage hardware tools such as firewalls, trusted platform modules, intrusion

prevention or detection systems (IDS/IPS) and federated identity management for optimal protection of

its infrastructure (Alsaqour, 2021).

 7

BGUC will implement meaningful hardware and software tools that reasonably and

appropriately manage risks and security controls on its systems that are implemented in accordance with

the risks associated with the healthcare industry. By using a Defense in Depth (DiD) approach to its

infrastructure, BGUC can significantly reduce its attack surface. DiD includes strategies such as:

(1) Firewalls: Regulate network traffic through access or deny policies (Alsaqour, 2021).

(2) Intrusion Prevention or Detection Systems (IDS/IPS): Sends notifications when malicious network

activity is detected (Alsaqour, 2021).

(3) Endpoint Detection and Response (EDR): EDR adds security to BGUC’s hardware. EDR is an

endpoint security solution that continuously monitors end-user devices to detect and respond to

cyber threats (Alsaqour, 2021). The endpoint security solution records the activities and events

taking place on endpoints and all workloads within the infrastructure, providing security teams

with the visibility and knowledge necessary to uncover incidents and attacks that would remain

invisible without the EDR tools.

(4) Trusted Platform Module (TPM): Microchip located in a computer’s motherboard that is used to

verify the state of new software that may potentially be installed on the computer, which

provides additional security to a device.

(5) Network Segmentation: Splits BGUC’s network into multiple networks, which protects the

different divisions of BGUC by stopping traffic from one part of the organization from reaching

another part or by limiting the flow between the different networks based on traffic type,

source, or destination (Cisco, n.d.). This will be done to divide the BGUC network into smaller

network segments. This will allow each segmented network to be compartmentalized so that

each can receive its own unique security controls and protocols.

(6) Zero-Trust Platform: No person or device is able to access sensitive information until both have

been identified and securely authenticated.

 8

(7) Strong User-Access and Authentication Controls: Users are only allowed access to the areas of

the system that pertains to their work business and that once that person’s job functions change

or they are no longer working for BGUC, their privileges should be removed immediately or

updated to reflect their current position.

Identities, Functions, Actions, and ACLs

BGUC will implement component based architecture to develop the elements of personnel

management tools, access control lists, and standards. The patient and employee user portals will be

designed such that each user has their own unique and safe experience when using the BGUC portals. It

is important that the portals only provide necessary information for the intended users. A patient should

not have access to provider information and vice versa.

(1) Identities: Portals will be equipped with identity management controls that restrict unauthorized

users from accessing information that is not intended to be accessed.

(2) Functions: Functionality of the two portals will vary depending on the access controls enabled

on any particular portal. An example of this would be a physician being able to submit a

pharmacy refill through their portal physician portal while the patient portal is only allowed to

receive notifications when the prescription has been refilled.

(3) Access Control Lists (ACL): Specifies who has access to what information and what they can do

with such access. Access is based upon the role of the person and their job duties and will be

provided on a need-to-know basis in order to fulfill job functions (Brooks, 2023). This ensures

the portals will be safe from unauthorized access of information with the implementation ACLs.

If an employee is no longer employed by BGUC, they will be unable to access the portals any

further due to ACLs.

(4) Roles & Actions: Roles and actions will dictate the information that the user is able to access on

the portal. This will ensure that only the information that needs to be accessed by a user is
 9

accessed by that user. If a family member is placed as the primary contact for a minor or elderly

patient, they should be granted unique privileges to that person’s portal without violating any

compliance laws or regulations.

Component-based architecture will ensure that these elements can be overridden or isolated

depending on how the portal uses it. If a portion of the portal goes down or is attacked,

component-based architecture will update its interface without forcing the other components to refresh

or modify their UI since each component is independent (Nandaniya,2023).

Processes, Nodes, Addresses and Protocols

At the component level of the EA architecture, processes and protocols that build upon the

existing infrastructure and security mechanisms identified earlier in the SABSA process and that provide

data security both at rest and in transit of the higher levels need to be identified and implemented

(Fincannon & Moore, n.d.).

(1) Hypertext transfer protocol secure (HTTPS): BGUC will exclusively utilize and enforce the use of

HTTPS, a more secure version of HTTP, for its services. This is an internet protocol for

communicating between a web client and web server to provide the user with an html view of a

webpage (Sherwood, 2005). The HTTPS differs from HTTP in its usage of Transport Layer Security

(TLS) and Public Key Infrastructure (PKI) to provide asymmetric encryption, protecting data in

transit between the end user and the web server (Cloudflare, n.d.).

(2) IPSec: IPSec encompasses a variety of standards for integrating cryptography into the IP packet

layer through Encapsulating Security Payload (ESP) or IP Authentication Header (AH) (Sherwood,

2005).

(3) Virtual Private Networks (VPNs): VPNs are an implementation of IPSec that hide the true,

original IP addresses of internet communications (Sherwood, 2005). As previously outlined in

 10

the remote access policy, BGUC will enforce the use of OpenVPN, a VPN service, for all

employees remotely accessing the EA. This component will provide secure, encrypted

communications between the user and BGUC’s web servers. OpenVPN additionally allows for

tunneling and access controls to limit traffic to undesired domains and ensure access only to

required resources (OpenVPN, n.d.).

(4) DNS Security Extensions (DNSSec): This “feature of the Domain Name System (DNS) …

authenticates responses to domain name lookups. It does not provide privacy protections for

those lookups, but prevents attackers from manipulating or poisoning the responses to DNS

requests (Google, n.d.).” BGUC will require all DNS requests to be validated with RSA digital

signatures.

Security Step Timing and Sequencing

The security-step timing and sequencing tools are driven by BGUC’s business requirements. The

tools below will facilitate the timing and sequencing necessary for BGUC’s operations:

(1) Network time protocol (NTP): Will be used on BGUC’s public network. Synchronizes clock times

across the BGUC system using Coordinated Universal Time (UTC) and uses hash codes and clock

selection to improve security (Manmeetjuneja5, 2021).

(2) Precision time protocol (PTP): Will be used to synchronize clocks on the different types of

devices on BGUC’s network and its IT applications. Uses cryptography security mechanisms to

provide security. Operates on a master-slave architecture, so a grand master clock will need to

be identified and used to synchronize the times (Manmeetjuneja5, 2021).

(3) Generic Interrupt Controller (GIC): Prioritizes and manages the distribution of interrupts across

devices on BGUC’s network (HWE.Design, n.d.)

(4) Data Retrieval Time Minimization: Steps and reorder of sequencing in order to minimize the

amount of time to retrieve and decrypt patient records.

 11

(5) Time Server: Synchronizes all devices on the network to a legally traceable time, which enables

data logs to be used as evidence in court (Orolia, n.d.).

Conclusion

The component security architectural layer describes the products, components, and personnel

necessary to execute the physical security architecture. The data structures, security standards, products

and tools, processes and protocols, and security timing and sequencing is the final layer prior to looking

into the security service management architecture, which overlaps each of the other architectural layers.

Now that BGUC has completed the contextual, conceptual, logical, physical and component layers, it can

turn to developing the security service management architecture, which is concerned with the

security-related parts of the system operations and service management, such as the service delivery,

operational risk, process delivery, personnel, environmental, and schedule management (Sherwood et

al., 2009).
 12

References
Alsaqour, R., Majrashi, A., Alreedi, M., Alomar, K., & Abdelhaq, M. (2021). Defense in Depth: multilayer of

security. International Journal of Communication Networks and Information Security, 13(2),

242-248.

Arora, V. (2020, November 18). What ICT hardware and software is used in hospitals? Planet Crust.

https://www.planetcrust.com/what-ict-hardware-and-software-is-used-in-hospitals?utm_campa

ign=blog

Ashcraft, A., Smeitanowski, S., Sharkey, K., Coulter, D., Jacobs, M., Sherer, T., & Satran, M. (2023, January

25). Introduction to ASN.1 Syntax and Encoding. Microsoft Learning.

https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-introduction-to-asn-1-sy

ntax-and-encoding

Aston, B. (2023, August 9). The pioneers of precision: the 24 best medical imaging software of 2023. The

Medical Practice. https://themedicalpractice.com/tools/best-medical-imaging-software/

Brooks, C. (2023, October 3). What is file security? Best practices & tools for security. Digital Guardian.

https://www.digitalguardian.com/blog/what-file-security-best-practices-tools-security

Cisco. (n.d.). What is network segmentation?

https://www.cisco.com/c/en/us/products/security/what-is-network-segmentation.html

CGI. (2019). Understanding Cybersecurity Standards.

https://www.cgi.com/sites/default/files/2019-08/cgi-understanding-cybersecurity-standards-whi

te-paper.pdf

Cloudflare. (n.d.). What is TLS (Transport Layer Security)?

https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/

European Banking Authority. (2019, November 29). Final Report: EBA Guidelines on ICT and security risk

management.
 13

https://www.eba.europa.eu/sites/default/documents/files/document_library/Publications/Guid

elines/2020/GLs on ICT and security risk management/872936/Final draft Guidelines on ICT and

security risk management.pdf

Fincannon, J., & Moore, M. (n.d.). Component Security Architecture Module 6 [Slide show; Online]. CSOL

520. https://sandiego.instructure.com/courses/856/files/630468?module_item_id=272883

Google. (n.d.). DNS Security Extensions (DNSSEC) overview. Google Cloud.

https://cloud.google.com/dns/docs/dnssec

HWE.Design. (n.d.). Interrupt handling, timers, and security.

https://www.hwe.design/design-fundamentals/embedded-system-basics/core-concepts-in-arm-

processor/interrupt-handling-timers-and-security

ISO.org. (n.d.). https://www.iso27001security.com/html/iso27000.html

Kanade, V. (2022, February 10). What is network hardware? Definition, architecture, challenges, and best

practices. Spice Works.

https://www.spiceworks.com/tech/networking/articles/what-is-network-hardware/

Lexigram. (n.d.). Security standards in healthcare.

https://www.lexigram.io/lexipedia/security-standards-in-medicine/

Manmeetjuneja5. (2021, August 18). Difference between NTP and PTP. Geeks for Geeks.

https://www.geeksforgeeks.org/difference-between-ntp-and-ptp/

Nandaniya, H. (2023, November 20). A guide to component-based architecture: Features, benefits and

more. Maruti Techlabs. https://marutitech.com/guide-to-component-based-architecture/

OpenVPN. (n.d.). Secure Remote Access.

https://openvpn.net/solutions/use-cases/secure-remote-access/

Orolia. (n.d.). Time synchronization: a critical part of a security system. Safran.

https://safran-navigation-timing.b-cdn.net/wp-content/uploads/2021/07/timing-sync-security-s
 14

ystems-infographic-1.pdf

PCI Security Standards Council. (2022). Payment Card Industry Data Security Standard: Requirements and

Testing Procedures v4.0.

https://www.pcisecuritystandards.org/document_library/?document=pci_dss

Scheiner, M. (2023, August 28). Best healthcare CRM software 2023: HIPAA compliant CRM solutions.

CRM.org. https://crm.org/crmland/best-healthcare-crm-software

Sherwood, N. (2005). Enterprise Security Architecture. Taylor & Francis.

https://online.vitalsource.com/books/9781498759908

Sherwood, J., Clark, A., & Lynas, D. (2009). Enterprise Security Architecture [White Paper]. SABSA

Institute.

https://sabsacourses.com/wp-content/uploads/2021/02/TSI-W100-SABSA-White-Paper.pdf

Stallings, W. (2023). Cryptography and network security: principles and practice (8th ed.). Pearson.

Stringfellow, A. (2022, February 12). 6 Key regulations for healthcare cybersecurity. Tausight.

https://www.tausight.com/key-regulations-for-healthcare-cybersecurity/

Team Asana. (2022, December 5). Risk Register: A Project Manager’s Guide with Examples. Asana.

https://asana.com/resources/risk-register