View attached explanation and answer. Let me know if you have any questions.

1

Database Security Assessment Request for Proposal
Student Name
Course name:
University name:
Professor's info:

2

Overview for Vendors
The National Military Hospital (NMH) offers health care to armed forces members and
other eligible beneficiaries. People who benefit from this medical system are members of the
military(reserves and active duty), their families, veterans, retired, civilians working in the
Defence Ministry, and non-military civilian employees (Bricknell & Cain, 2020). The NMH
assists military personnel and improves military medical education and practice. The Privacy
Rule by HIPAA requires the protection of all personally recognizable health info. (Snell, 2017).
The hospital is searching for a vendor to implement health care database management content to
manage the electronic medical records with the help of a security system engineer.
A database is an archive of organized data that may be expanded, updated, and accessed
easily (Health Data in the Information Age, 1994). The military hospital's database will store the
patient's personal information and health information. Medical diagnoses, names, treatment
regimens, residences, and social security numbers are among the information contained in the
database. Administrative support workers and healthcare professionals will have access to the
database. Therefore, all private data must be kept secure. The medical personnel, including
physicians and nurses, will require access to the database to change, update, and examine patient
data to make proper diagnoses and create treatment regimens.
On the other hand, medical personnel must be barred from obtaining sensitive patient
data such as social security numbers and addresses. On the other hand, the administrative
personnel will need access to patient information such as social security numbers, billing, and
home addresses to perform necessary billing functions while restricting access to patient health
information. Furthermore, the military hospital would wish to create a web page for patients to

3

have remote access to their health and personal data while guaranteeing that only authorized
personnel may modify patient data.
Inadequate security controls in healthcare databases may lead to data breaches. These
data breaches, however, expose patients to economic difficulties, mental anguish, and social
stigma. (Healthcare Data Breaches - The Costs and Solutions, 2018). The expense of having a
patient's personal and medical records stolen can be high. There are also the costs of lost revenue
if unhappy patients seek care at other institutions and the costs of investigations, remedies, and
potentially class-action lawsuits (Nass, 2009).
Context for the Work
The hospital anticipates that its new database system will be secure, well-organized, and
expandable, allowing simple queries to retrieve all patient information. Furthermore, the HIPAA
privacy act mandates that all personally identifiable patient data be kept private.
The hospital database's functional security needs include:
a. Database injection attacks, in which a hacker interferes with the database queries that
an application performs to its database (What is SQL Injection? 2021 Tutorial & Examples | Web
Security Academy)
b. Malware is a type of software used to steal private data from legitimate users via
infected devices.
c. Denial of service where an attacker floods a database with requests, causing it to fail to
fulfill legitimate users' queries (IBM Cloud Education, 2019)

4

The database must also safeguard the security of the hospital's patents. The hospital must
restrict access so that only authorized hospital personnel can access the database system and the
patient's sensitive personal information. The hospital also asks staff to authenticate their
identities using methods such as two-factor authentication. Furthermore, the hospital requires the
integrity and backup of all data contained in the database.
Vendor Security Standards
Common Criteria for information technology security evaluation
Common Criteria is an international computer security standard used to evaluate a
computer system by defining the extent to which the system and its resources are secured.
Common criteria are a way of assessing the security of software. The Common Criteria attempts
to reassure that owners, users, and clients took a computer security solution's specification,
implementation, and assessment seriously and thoroughly. The CC was formed as a result of
collaboration between six governments. (Blancco, 2021).
To have a product reviewed; vendors must submit a Security Target description. The
Security Target will be assessed against the Security Functional Requirements. This procedure
enables the product's vendor to customize it to the anticipated capabilities. Vendors may assert
that the target product meets one or more of the Protection Profiles.
Evaluated assurance levels
A system or an IT product's evaluated assurance levels (EAL1 through EAL7) are a
numerical grade assigned following a Common Criteria examination. It is a standard measure
that has been in use since 1999. The EAL level does not indicate the system's security; instead, it

5

shows the level at which the system was tested. The higher levels are designed to assure users
that the system's main security measures are being applied correctly. To obtain Common Criteria
certification, the higher the assurance level, the more assurance standards must be met
(Wikipedia Contributors, 2021).
Disaster recovery and Continuity of service
Disaster recovery and Continuity of Services are essential in an organization's planning
for unanticipated hazards. Disaster recovery is the step-by-step method an organization follows
in the case of a disaster that disrupts normal business operations. In such an incident, measures
taken include recovering the server from backups and providing a Local Area Network (LAN) to
fulfill a business's urgent needs. (Sullivan et al., 2017).
The actions taken by an organization to prevent and recover from potential hazards to a
business are referred to as Continuity of service. It protects the safety of employees and assets
and...