Executive Summary

This brief discusses takes an inside look of Bluebird hospitals infrastructure with a Risk Assessment Report (RAR). Information is provided to leadership on the potential threats our network could fall prey to if action is not taken. A system characterization was given to give in sight on Bluebird’s information system as a whole. A breakdown of the hardware, software, system interfaces, users, and databases used to protect the system. There were 4 observations that was discovered when conducting the assessment. Each observation will be reviewed through description, existing mitigating controls, vulnerability, and recommendation. The report measures vulnerabilities using a risk level matrix. Each vulnerability is measured on a scale of low to high risk level.

Purpose

The purpose of this Risk Assessment Report (RAR) is to inform Bluebird Hospital’s board of directors about the security assessment that was performed on the organization network system. The organization network system was scanned by using Wireshark-network protocol analyzer and Nmap-security scanner tools. These tools exposed several vulnerabilities in our system. The vulnerabilities identified by these tools could make our information system infrastructure target to multiple cyber-attacks if not fixed.

Scope

The scope of this risk assessment assessed the use of controls to eliminate vulnerabilities that were exploited by potential threats internally and externally. If exploited, these vulnerabilities could result in unauthorized disclosure of data, denial of service, significant financial loss, and web defacement.

Threats

Cyber security experts around the world has predicted that due to the lack of security control measures that many organizations have security breaches will be at an all-time high (Dobran, 2018). Due to the continued advancement of technology cyber-attacks will grow if Bluebird’s information network is not updated.  Threats to our system are expected if Bluebird’s IT management does not educate themselves on potential cyber-attacks. Spoofing/ cache poisoning exploits vulnerabilities in the system by distracting internet domain name system by diverting internet traffic to a fake server system (Hoffman, 2016). Packet Analysis/Sniffing is a tool that is used by cyber criminals to spy on the network of potential suspects and collect their passwords (O’Donnel, 2018). A DDoS attack is when the network system is compromised and users are not able to get access to the system. The distributed denial of service is used by attackers as blackmail (Florentino, 2018). Insider threats can range from to a disgruntled employee or an employee not being properly trained and falling victim to email phishing attacks. For example a Bluebird employee’s email was infected with a malware virus known to infect users via phishing emails containing malicious links. Over 1,000 patients PHI was compromised in the breach.

System Characterization

In assessing an information technology system, the first step is to characterize your system. Bluebird hospital is composed of several components to make it a whole. Policy and procedures are put in place as guideline rules for all personnel and patients at Bluebird Hospital. In Figure 1 gives a system characterization of Bluebird’s system.

Figure 1. System Characterization of Bluebird Hospital

In Figure 2 a flow chart is provided of the scope of the risk assessment efforts that were made during this risk assessment report.

Figure 2. Input and Output flowchart of the scope of the risk level assessment effort

Risk Assessment Approach

The approach Bluebird’s management takes to protect our system is detrimental to our information network. The participants that were involved in the risk assessment were the database administrator, IT department, security administrator, network manager, and system custodian. The techniques that were used to gather the information were operating systems such as MBSA and OpenVAS and network monitoring tools such as wireshark and Nmap. In the risk assessment matrix table in Figure 3 our IT team has compiled information that shows the risk level each vulnerability has on our system.

Severity

Likelihood

Figure 3. Risk Assessment Matrix of likelihood of Bluebird’s system be susceptible to vulnerabilities (MVROS, 2004)

In Figure 4 there is a description of the risk level matrix scale.

Figure 4. The risk level scale description (MVROS, 2004)

Risk Assessment Results

As technology continues to advance it is imperative for organizations take the necessary steps to ensure the systems are secure. If there are weaknesses our system to be susceptible to data exfiltration. Our organization could suffer from a major financial impact and cause trust issues for customers in the future. After scanning Bluebird’s network several observations were identified using the multiple vulnerability tools such as wireshark, Nmap, OpenVAS, identity management and MBSA. Evaluating the vulnerabilities to get a better understanding of their level of impact is important for upper management to understand. In Figure 5 the risk assessment results of observation that were identified from running scans on our network are identified and rated according the risk level matrix displayed in Figure 3:

Figure 5. Risk Assessment results identified through vulnerability tools (MVROS, 2004)

Summary

There were 4 observations that were identified in this risk assessment report. Observation 1 was multiple user accounts on one computer. This was given a level 6 on the risk level matrix because this is one of the ways our system could be exposed to insider threats. The recommendation for this observation would be to have individualized common access cards that only allows one user on a computer at a time. Observation 2 user having non expiring passwords. This observation was given an 8 on the risk level matrix because hackers could easily guess the users password and infiltrate the system. The recommendation would be for employees to change their passwords every 30 days. The information system will have automatic updates that will require user to update their passwords before moving forward. Observation 3 was fire wall connections were turned off. This was given a 21 on the risk level matrix because firewalls are one of Bluebird’s first line of defense against cyber-attacks. It is recommended that all firewalls connections be turned on at all times and constant updates of the firewall system so the system is constantly protected. Observation 4 is port 3306 is method exploited by nemog and W32.Spybot. This was given a 25 on the risk level matrix because nemog is a backdoor trojan horse virus. Our system could be fully comprised and all access could be lost. It was recommended that an update of malware protection be installed to prevent and remove any viruses.

Conclusion

In conclusion, technology will continue to be updated and therefore threats to any organization network infrastructure needs to be in the fore front of leadership concerns. Using the information provided in this risk assessment report should provide leadership on the areas of concern in our network. Understanding the cost consequence and damage that could possibly be done to the information infrastructure is detrimental. Improving on multi factor authentication and outsourcing a cyber-security company is heavily advised.

References

• Dobran, B. (2018) Cybersecurity Trends 2018: 32 Experts Make Predictions. Found at:
  

  2020 Cybersecurity Trends: 31 Experts on Current Issues

• Florentino, N., (2018) Impact of cyber security incidents on financial institutions. Found at:
  
  https://static1.squarespace.com/static/555f9696e4b0767a7f0769b3/t/5ab1ae2d8a922dca86e30ee8/1521593911874/The+Impact+of+Cybersecurity+Incidents+on+Financial+Institutions+WHITE+PAPER.pdf
  
• O’Donnell, A. (2018). What are Packet Sniffers and How Do They Work? Found at:
• 
  https://www.lifewire.com/what-is-a-packet-sniffer-2487312
  
• Hoffman, C. (2016). What is DNS Cache poisoning? Found at: https://www.howtogeek.com/161808/htg-explains-what-is-dns-cache-poisoning/
• MVROS. (2004). Detailed risk assessment report. Found at: https://itsecurity.uiowa.edu/sites/itsecurity.uiowa.edu/files/sampleriskassessmentreport.pdf

In this paper a comparison of Western medicines and African traditional medicines shall be made. The purpose of this paper is to identify similarities and differences between Western and African conceptions of diseases, cure and effective patient care.

According to Germov (2007, p. 8) Western Medicine is “the conventional approach to medicine in western societies, based on the diagnosis and explanation of illness as a mulfunction of the body’s biological mechanisms.” It encompasses a range of health care practices evolved to maintain and restore health by the prevention and treatment of illness Hewson (1998). WHO defines Traditional medicine as “the sum total of knowledge, skills and practices based on theories, beliefs and experiences indigenous to different cultures that are used to maintain health, as well as to prevent, diagnose, improve or treat physical and mental illnesses.”

Traditional medicine that has been adopted by other populations outside its own culture is often termed alternative or complementary medicine (WHO, 2008).

WHO claimed that primary healers in traditional African medicine are midwives, herbalist and diviners. Diviners are responsible for determining causes of sickness by the ancestral spirits (WHO, 2008). Midwives use herbs and indigenous plants in aiding pregnancy and childbirth (WHO, 2008). Herbalists use animal, plants and mineral based medicines to cure diseases (WHO, 2008). Herb market and herb trading is a very common practice in many African countries (Okpako, 2006)

Traditional African culture believe that good health means a correct relationship between people and their supernatural environment. There are strong spiritual aspects to traditional African medicine, with a widespread belief among practitioners that psycho-spiritual aspects must be addressed before medical aspects. Among the traditional healers, the ability to diagnose an illness is considered a gift from both God and the practitioner’s ancestors. A major emphasis is placed on determining the root cause underlying any sickness or bad luck. Illness is said to stem from lack of balance between the patient and his or her environment. Diviners may use plants not only for healing purposes but also to control weather and events. In addition to plants, traditional African healers may employ charms, incantations and casting of spells. They are also skilled in psychotherapy and counselling.

African healing systems recognise the influence of the mind on the human well being. They recognise the negative emotions such as fear, guilt and hate can lead to illness. Rituals are undertaken to appease the angered ancestral spirits, patients need to make confessions inorder for the spirits to forgive them and be well. The rituals accompanying the use of herbal medicine is referred to as “incantation”.

Incantation is a collection of carefully chosen words used to bring healing effect or resolving emotional conflict in the mind of the patient. Spirits of the ancestors protect their living descendants, however ancestors demand from their descendants strict adherence to the moral laws laid down. An immoral act for example incest is believed to annoy the spirits resulting in serious illness or misfortune.

Makinde (1988) claimed that “through African traditional medicine a diagnosis is reached through spiritual means and a treatment is prescribed, usually consisting of an herbal remedy that has not only healing abilities, but symbolic and spiritual significance”. Traditional African medicine, with its belief that illness is not derived from chance occurrences, but through spiritual or social imbalance, differs greatly from Western medicine, which is technically and analytically based (Makinde, 1988).

According to WHO, 80% of the African population depends on traditional medicine for primary health care. In Ghana, Mali, Nigeria and Zambia, 60% of children with high fever resulting from malaria use herbal medicine at home. Lovell (2009) claimed that individuals suffering from pain, anxiety, depression, headaches and fatigue use alternative medicine. WHO estimates that several African countries practice traditional birth with the help of traditional midwives who uses indigenous plants to aid childbirth.

WHO (2008) claimed that 70% to 80% of the population in western countries has used some form of alternative or complementary medicine for example acupuncture.

As noted by Germov (2007) there are varied reasons why alternative medicine is so popular at the expense of western medicine. When people get sick they need to know the causes of the illness, suffering or even death (Germov, 2007). In Western medicine, the traditional view that illness was caused by spiritual evil is no longer valid. Alternative medicine that have an explanation to causes of illnesses and suffering have a greater appeal (Germov, 2007).

The desire to achieve a more holistic form of care may be a motivating factor as to why patients choose traditional medicine (Lovell, 2009).

In most African countries, drugs are out of reach to many people as they do not have the money to buy them. The only solution available is to resort to traditional medicine as it is cheap and reliable.

Most African people are so skeptical to try western medicine. The main reason is that they are afraid to try something new and prefer to continue using their old way of seeking medical help that is the use of traditional medicine.

As stated by Germov (2007) people have lost trust in western medicine. Many toxins found in the drugs have drove people away from the use of it. People have also lost trust in scientific experts, they blame them on almost all the environmental problems such as global warming, oil spills and even acid rain.

Germov (2007) claimed that there is a good relationship between ‘personal’ healer and patient. Personal healers take their time to listen and provide tailor made treatment to the individual client. By so doing they create a strong bond which can lead up to trust and loyalty.

Wilcox & Bodeker (2004) reported that in most African countries the rise in drug resistances and problems in accessing effective anti -malarial drugs in both remote and underprivileged areas has forced people to resort to traditional medicine as their source of treatment.

Disadvantages of western medicines over alternative medicine

Makinde (1988, p.200) claimed that toxins found in western medicines is driving people away from the use of it. Some people get reactions from antibiotics . The relationship between the patient and the therapist is more important.

Disadvantages of African traditional medicine

There is an inadequate evidence base for traditional therapies and products. There is also lack of cooperation between traditional medicine providers and western medicine practitioners.

Why use traditional medicine?

There is lack of trust on the use of western medicine by many African people. A research was conducted and the results show that the quality of services, treatment-related costs as well as the need to maintain social support networks which can be negatively affected by HIV-related stigma (Van Asten, Cairncross, Jaffer, Junghanss, Stuyft and Walter, 2010).

(Pearce, 2009) claimed that there is a significant number of parents in the United Kingdom who are using traditional and complementary medicine as a remedy for their children’s ills. They use honey, herbs and spices. Aresearch was made and more than 30%of parents admitted using traditional medicine.

Friction is evident between ‘Western’ medicines or biomedicines that look at ‘material causation’ to understand and treat an illness; and traditional medicine that generally looks towards the ‘spiritual’ origin such as witchcraft and displeasure by ancestors in order to cure an ailment.23 There has been an array of media reports of traditional healers claiming to have a cure for AIDS or submitting their patients to dangerous or ineffective treatments. Munk writes that some traditional healers view HIV/AIDS as a “development of an old disease that can be treated by TH [Traditional healers] only”. 25 Conditions such as ilumbo, umeqo and ncunsula exhibit the same type of symptoms as AIDS-related illnesses, while their origins are said to be found in bewitchment and infidelity. These can be ‘cured’ by traditional healers by purgative methods and enemas, which facilitate the polluting essence to leave the body. If the symptoms are gone, then the patient is considered cured.26 Amongst some people in Africa, “it is believed that if a sick person does not obtain treatment and dies, his spirit will cause further disease”.27 It is important to take note of the fact that traditional healers, traditional medicine and belief systems of sickness and health can vary from region to region, and from clan to clan.

A number of traditional healers have seen a lucrative opportunity of ‘curing’ people living with HIV/AIDS (PWAs) from HIV/AIDS, in the absence of a cure by biomedicine and where a number of developing countries have not been able to provide anti-retroviral medication or adequate health care to those living with HIV/AIDS. Two case studies are offered to illustrate the ‘AIDS opportunism’ or ‘AIDS entrepreneurship’ displayed by some traditional healers:

25 The WHO describes the problems related to clinical data on traditional medicines in the following way:

The quantity and quality of the safety and efficacy data on traditional medicine are far from sufficient to meet the criteria needed to support its use worldwide. The reasons for the lack of research data are due not only to health care policies, but also to a lack of adequate or accepted research methodology for evaluating traditional medicine. It should also be noted that there are published and unpublished data on research in traditional medicine in various countries, but further research in safety and efficacy should be promoted, and the quality of the research improved. 45

Conclusion

The use of western and african traditional medicine depends on an individual’s beliefs and culture. It also depends on the availability of funds to seek treatment. In Africa most people cannot afford to source western medicine mainly because it is very expensive and so they resort to their traditional medication mainly because it is cheaper.