Security Assessment of Information System in Hospital Environment

Abstract

The purpose of this paper is to propose the risk assessment for an IT security system used in a hospital. The process is developed based on the study of standard and best practices of security risk assessment used in information system. The security assessment includes key processes such as Risk Assessment and Vulnerability Verification along with other factors for supporting the development. Results from the experiment at sample hospitals, our tool was able to assess and rate the security risk which reflects the environment of the hospital's information system. This tool was able to simulate some examples of exploitation in order to test system flaws and generate a report to be used as a reference.