Gap Analysis for Information Security in Interoperable Solutions at a Systemic Level: The KONFIDO Approach

Rasmussen, Jens; Natsiavas, Pantelis; Votis, Konstantinos; Moschou, K.; Campegiani, Paolo; Coppolino, Luigi; Cano, Isaac; Marí, David; Faiella, Giuliana; Stan, Oana; Abdelrahman, Omer H.; Nalin, Marco; Baroni, Ilaria; Voss-Knude, Maja; Vella, Vincenzo Alberto; Grivas, Evangelos; Mesaritakis, Charis; Dumortier, Jos; Petersen, Jan; Tzovaras, D.; Romano, Luigi; Komnios, Ioannis; Koutkias, Vassilis

doi:10.1007/978-981-10-7419-6_13

Cited by 8 publications

(13 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The respective material included the following: The ISO 27k family of standards that is widely used for defining IT security policies and controls [19]. The outcomes of a gap analysis study concerning existing security frameworks for interoperable solutions at a systemic level, which was conducted in the scope of KONFIDO [20]. The outcomes of an end‐user workshop and a survey, also conducted in the scope of the project, aiming to identify barriers and facilitators of eHealth acceptance [21].…”

Section: Methodsmentioning

confidence: 99%

“…The outcomes of a gap analysis study concerning existing security frameworks for interoperable solutions at a systemic level, which was conducted in the scope of KONFIDO [20].…”

Section: Methodsmentioning

confidence: 99%

“…Advanced encryption techniques should be in place. This has been identified as a gap of OpenNCP in our gap analysis [20], and it could be one of KONFIDO's important contributions through homomorphic encryption.…”

Section: G23: Enhance Encryption Capabilitiesmentioning

confidence: 99%

See 2 more Smart Citations

Requirements elicitation for secure and interoperable cross‐border health data exchange: the KONFIDO study

et al. 2019

View full text Add to dashboard Cite

In this study, the requirements elicitation approach employed in the context of the KONFIDO project is presented. KONFIDO introduces a technical paradigm for secure and interoperable cross-border health data exchange by leveraging novel approaches and cutting-edge technologies, such as homomorphic encryption and blockchains. Being a key part of the overall user requirements engineering methodology, requirements elicitation focused on producing high-level, end-user goals following a systematic procedure. First, the main business processes were identified based on the project's pilot scenarios. These business processes were the subject of a threat analysis, which identified the respective assets and a list of security risks/ threats. Threats were further elaborated, considering the outcome of relevant projects and applicable best practices/standards. As a result, a set of user goals were identified and analysed in detail. Finally, a meta-analysis of the produced goals against the employed information sources was applied, highlighting the importance of standards as a guide for defining requirements, as well as the complexity concerning the interdependencies among the elaborated business processes, assets, threats, and user goals. As the deployment of the technical solution may be cloud-based, implications and challenges imposed by the adoption of cloud computing in this setting are also presented.

show abstract

Section: Methodsmentioning

confidence: 99%

“…The outcomes of a gap analysis study concerning existing security frameworks for interoperable solutions at a systemic level, which was conducted in the scope of KONFIDO [20].…”

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Requirements elicitation for secure and interoperable cross‐border health data exchange: the KONFIDO study

et al. 2019

View full text Add to dashboard Cite

show abstract

“…(b) Interviews / discussions with experts related with the analysis subject (either directly involved in KONFIDO or not). The overall gap analysis methodology along with some preliminary results were presented in [ 26 ].…”

Section: Methodsmentioning

confidence: 99%

Comprehensive user requirements engineering methodology for secure and interoperable health data exchange

Natsiavas

Rasmussen²,

Voss-Knude³

et al. 2018

BMC Med Inform Decis Mak

View full text Add to dashboard Cite

BackgroundIncreased digitalization of healthcare comes along with the cost of cybercrime proliferation. This results to patients’ and healthcare providers' skepticism to adopt Health Information Technologies (HIT). In Europe, this shortcoming hampers efficient cross-border health data exchange, which requires a holistic, secure and interoperable framework. This study aimed to provide the foundations for designing a secure and interoperable toolkit for cross-border health data exchange within the European Union (EU), conducted in the scope of the KONFIDO project. Particularly, we present our user requirements engineering methodology and the obtained results, driving the technical design of the KONFIDO toolkit.MethodsOur methodology relied on four pillars: (a) a gap analysis study, reviewing a range of relevant projects/initiatives, technologies as well as cybersecurity strategies for HIT interoperability and cybersecurity; (b) the definition of user scenarios with major focus on cross-border health data exchange in the three pilot countries of the project; (c) a user requirements elicitation phase containing a threat analysis of the business processes entailed in the user scenarios, and (d) surveying and discussing with key stakeholders, aiming to validate the obtained outcomes and identify barriers and facilitators for HIT adoption linked with cybersecurity and interoperability.ResultsAccording to the gap analysis outcomes, full adherence with information security standards is currently not universally met. Sustainability plans shall be defined for adapting existing/evolving frameworks to the state-of-the-art. Overall, lack of integration in a holistic security approach was clearly identified. For each user scenario, we concluded with a comprehensive workflow, highlighting challenges and open issues for their application in our pilot sites. The threat analysis resulted in a set of 30 user goals in total, documented in detail. Finally, indicative barriers of HIT acceptance include lack of awareness regarding HIT risks and legislations, lack of a security-oriented culture and management commitment, as well as usability constraints, while important facilitators concern the adoption of standards and current efforts for a common EU legislation framework.ConclusionsOur study provides important insights to address secure and interoperable health data exchange, while our methodological framework constitutes a paradigm for investigating diverse cybersecurity-related risks in the health sector.Electronic supplementary materialThe online version of this article (10.1186/s12911-018-0664-0) contains supplementary material, which is available to authorized users.

show abstract

“…More specifically, KONFIDO will provide a modular set of tools that can be composed to improve the resilience of eHealth data-exchange applications by allowing to address a wide range of possible eHealth scenarios (not only the ones related to OpenNCP) and to solve vulnerabilities in the exchange and processing of health data. As a first step, KONFIDO performed a gap analysis for information security in interoperable solutions at a systemic level [13].…”

Section: Introductionmentioning

confidence: 99%

KONFIDO: An OpenNCP-Based Secure eHealth Data Exchange System

Staffa

Coppolino

Sgaglione

et al. 2018

Communications in Computer and Information Science

View full text Add to dashboard Cite

Allowing cross-border health-care data exchange by establishing a uniform QoS level of health-care systems across European states, represents one of the current main goals of the European Commission. For this purpose epSOS project was funded with the objective to overcome interoperability issues in patients health information exchange among European healthcare systems. A main achievement of the project was the OpenNCP platform. Settled over the results of the epSOS project, KONFIDO aims at increasing trust and security of eHealth data exchange by adopting a holistic approach, as well as at increasing awareness of security issues among the healthcare community. In this light, the paper describes the KONFIDO project's approach and discusses its design and its representation as a system of interacting agents. It finally discusses the deployment of the provided platform.

show abstract

Gap Analysis for Information Security in Interoperable Solutions at a Systemic Level: The KONFIDO Approach

Cited by 8 publications

References 1 publication

Requirements elicitation for secure and interoperable cross‐border health data exchange: the KONFIDO study

Requirements elicitation for secure and interoperable cross‐border health data exchange: the KONFIDO study

Comprehensive user requirements engineering methodology for secure and interoperable health data exchange

KONFIDO: An OpenNCP-Based Secure eHealth Data Exchange System

Contact Info

Product

Resources

About