NIST provides guidance for NHIN security

["Anders Rundgren" <anders.rundgren@telia.com>]

http://www.nist.gov/public_affairs/2005_hsemerjian_senate_healthIT_6-30.html

 

Apparently NIST have committed to writing a security guidance.

 

Where do CSRC, PKI-TWG and FPKI fit into this, in my opinion, possibly "trend-setting" and de-facto-standards-defining mission?

 

I hope that it is not only going to be written on a "political" or "executive" level, because implementers and vendors cannot translate that into code.

 

May I again repeat my request for a multi-disciplinary case-study, where security is not only measured in terms cryptography, but in terms of costs and scalability, as well as its impact on client and server SW?  To succeed with such a task requires strong links to typical applications as well. Otherwise the result may be neglected as a "guidance" is not a "law".

 

That's why it is extremely important to gather people with different backgrounds (and key issues).

 

I guarantee this would be very interesting and rewarding for everybody with a reasonably open mind!

 

Sincerely

Anders Rundgren

Located in the EU, working for a US company, here expressing my own opinion