Assessing information security risk in dual-use health information systems

This paper explores assessing the relationship between mission risk and information assurance risk in complex, dual-use information systems. Project Sentinel Collaboratory conducted a prospective information security risk assessment using the OCTAVEsm to help plan protection for a special information system that supported patient care in a multi-hospital network and medical surveillance for the Washington, DC region. Although the two missions function compatibly during baseline operations, conditions of heightened alert uncover incompatibilities that threaten both information and mission assurance.