Adele Farhadian

The Ontario Health Ministry hired me to perform a threat risk assessment (TRA) and privacy impact assessment (PIA) on a project.

The project goal was to design a solution to copy the PHI (personal health information) of Ontario residents from every clinic, hospital, and medical facility into their own data center and then keep the historical data at the source location as read-only files reference only.

They had multiple vendors with different roles in this project. I had to understand their roles, their demarcation points, their responsibilities, access needs, and so on to complete the TRA and PIA. They adopted HIPAA as the best practice, and then TRA/PIA was used to design and enhance the solution.

I've evaluated, tested, designed, and helped implement several security solutions, e.g., SIEMs, Tenable, among others. I completed these designs by performing a threat risk assessment (TRA) and working with the stakeholders, infrastructure, database, and application owners.

For example, for a utility company, I reviewed their NERC compliance implementation. I dug deep into their other systems (there were none identified as NERC assets), identified many assets that were not compliant or were not sufficient in their NERC compliance control implementations. They then engaged their external auditors to report these non-compliance issues.

Since these findings were investigated internally and reported as a self-report, their fines were minimal compared to an external audit findings fines and/or a reported security/privacy incident.