OHDSI OMOP-CDM 데이터베이스 보안 취약점 및 대응방안

• 영문명: OHDSI OMOP-CDM Database Security Weakness and Countermeasures
• 발행기관: 한국IT서비스학회
• 저자명: 이경환(Kyung-Hwan Lee) 장성용(Seong-Yong Jang)
• 간행물 정보: 『한국IT서비스학회지』제21권 제4호, 63~74쪽, 전체 12쪽
• 주제분류: 경제경영 > 경영학
• 파일형태: PDF
• 발행일자: 2022.08.31

영문 초록

Globally researchers at medical institutions are actively sharing COHORT data of patients to develop vaccines and treatments to overcome the COVID-19 crisis. OMOP-CDM, a common data model that efficiently shares medical data research independently operated by individual medical institutions has patient personal information (e.g. PII, PHI). Although PII and PHI are managed and shared indistinguishably through de-identification or anonymization in medical institutions they could not be guaranteed at 100% by complete de-identification and anonymization. For this reason the security of the OMOP-CDM database is important but there is no detailed and specific OMOP-CDM security inspection tool so risk mitigation measures are being taken with a general security inspection tool. This study intends to study and present a model for implementing a tool to check the security vulnerability of OMOP-CDM by analyzing the security guidelines for the US database and security controls of the personal information protection of the NIST. Additionally it intends to verify the implementation feasibility by real field demonstration in an actual 3 hospitals environment. As a result of checking the security status of the test server and the CDM database of the three hospitals in operation, most of the database audit and encryption functions were found to be insufficient. Based on these inspection results it was applied to the optimization study of the complex and time-consuming CDM CSF developed in the "Development of Security Framework Required for CDM-based Distributed Research" task of the Korea Health Industry Promotion Agency. According to several recent newspaper articles, Ramsomware attacks on financially large hospitals are intensifying. Organizations that are currently operating or will operate CDM databases need to install database audits(proofing) and encryption (data protection) that are not provided by the OMOP-CDM database template to prevent attackers from compromising.

목차

1. 서 론

2. 연구의 배경

3. 관련 연구

4. OMOP-CDM 보안 점검 툴

5. 보안 검증 및 보안 권고사항

6. 결 론

참고문헌

키워드

Security Requirements OMOP-CDM STIG PostgreSQL Weakness Tool Check