preview

Orthonet Case Study

Satisfactory Essays

ORTHONET (AE) – INVINCEA
BACKGROUND
Orthonet is an acquired entity that is looking for help on the Invincea browser protection solution. Patrick Black, CDO, has designed this AE to use our Invincea API servers within our DMZ. The API DMZ solution has not been vetted by the security architecture team or been auditing for open vulnerabilities. This design bypassed several groups, which warrants a major concern.
WANTS
Orthonet is looking to use our Invincea infrastructure once the API servers are setup.
REASON
• Control and support from UHG Optum
PREREQUISITES
• Orthonet would like access to the Invincea management server
• They would like guidance from our UHG project team
ID DESCRIPTION SECURITY ANALYSIS - FIRST GLACE OVERVIEW …show more content…

A software-as-a-service model is not a desired strategic plan for several reasons. First, it puts additional stress on internal UHG resources. The internal resources are already fully utilized, so an additional external service model will only add major resource allocation problems. Second, the amount of bandwidth coming into and out of the UHG environment may increase the internet cost and decrease the productivity within the UHG environment. Internet is not cheap, so this needs to be a factor within the overall decision. Last, the manageability of using one product for dozens of AE’s may break the purpose of the product. Any type of product inefficiency for UHG Optum will not be acceptable, since this product was primarily purchased for internal use. This product was not meant for multitenant environments, hence the lack of modularity within the product. Hundreds if not hundreds of thousands of endpoints could be hitting our API servers, which was a solution not fully endorsed by the security architecture team. There is a governance level defined within UHG that may have been missed or not taken into account. The importance of governance allows a fundamental framework for areas like strategy, awareness, controls, countermeasures, and policies (Brotby, 2009). Patrick Black has completely taken the governance into his own hands and made

Get Access