Data Sharing Review

[Ian Batten]

On 17 Jul 08, at 1154, Michael Simpson wrote:
> What i meant was:
> Using a well designed RBAC system based on use of secure Cryptographic
> algorithms where the initial design has been informed by individuals
> or companies with a track record of being able to implement secure
> systems would be the solution to the huge trust problem that is
> creating electronic able-to-be-shared patient records.

Define `secure'.  Secure so that only the right people can see and  
modify the information?  Define `right people'.  Define `the  
information'.   Are there exceptions to who the `right people' are?   
Define those.

The only people with a track record of implementing secure systems on  
a large scale are the military and intelligence services.  Personally  
I'd be happier about a medical IT system being operated by CESG than I  
would by the NHS itself, but I suspect a lot of people might not agree  
with me.

> This system
> should be open to peer-review and tested (and attacked) repeatedly
> (for ever) in order to insure that the implementation has not
> compromised the security of the underlying "published and thought to
> be secure so far" crypto protocol used.

Really?  You mean someone gets a free pass to break into a doctor's  
house, put a knife to their young child's throat and ask her father to  
hand over the information?  To phone up your office when you're on  
holiday, tell then I need one of your patient's records, and to call  
me back on 123 4567?  Or are you assuming that information threats  
play by the Queensbury rules?

No one is going to attack a health records system with a subtle  
differential cryptanalytic attack on the S Boxes.  No one's even going  
to engage in subtle side-channel attacks on crypto hardware.  They're  
going to social engineer well-meaning medical staff (if they're after  
information for mild reasons) or they are going to terrorise medical  
staff (if they're after something for harder reasons).

>
> I like using systems that work and have been shown to be secure so
> far.

Such as?  Not crypto algorithms, but _systems_ that work?  On the  
scale of the medical records of a medium-sized developed country?   
I've worked in IT for more than twenty years and I can't think of a  
single example of a non-military system for confidential data that  
hasn't leaked like a sieve.  Not one of those, so far as I know, was  
attacked at the protocol level.  If you put the CD and the key in the  
same envelope, the algorithm doesn't matter.

> I also am an optimist

Then don't work in security.  It's about pessimism: what happens if  
people _don't_ follow the rules?


> and would like to think that it is possible
> to achieve the nirvana like state of having shared records with proper
> authentication, authorisation, and non-repudiation/accountability.
> From my repeated reading of Bruce Schneier's work this would seem to
> suggest some sort of use of cryptography.

I can quote a list of people who don't believe in Bruce Schneier's  
book on crypto (a copy of which is by my left hand).  Amongst them are  
Bruce Schneier.

ian