myDRE CIA-AA Classification
1. Governance Taxonomy & Security Dimensions (CIA-AA Framework)
To guarantee the safe, ethical, and structured secondary use of sensitive healthcare data and intellectual property, anDREa B.V. (hereafter referred to as "anDREa") implements an expanded security dimension framework. This framework incorporates five core informational pillars mapped precisely from international security specifications and the Spanish National Security Framework (Esquema Nacional de Seguridad — ENS, Royal Decree 311/2022).
| Security Dimension | Functional Regulatory Definition | Framework Source |
|---|---|---|
| Confidentiality (C) | The property that information is not made available or disclosed to unauthorized individuals, entities, or processes. | ISO/IEC 27000 |
| Integrity (I) | The property of safeguarding the accuracy and completeness of assets. | ISO/IEC 27000 |
| Availability (A) | The property of being accessible and usable on demand by an authorized entity. | ISO/IEC 27000 |
| Auditability / Traceability | The property or characteristic ensuring that the actions of an entity can be uniquely and indisputably attributed to that entity (Trazabilidad). | ENS (Spain) |
| Authenticity (A) | The property or characteristic ensuring that an identity or system entity is genuine and verified (Autenticidad). | ENS (Spain) |
2. Institutional Risk Classification Profile
The master classification baseline balances clinical-grade data boundaries with computational research flexibility. The myDRE ecosystem is specifically designed for the secondary use of sensitive medical and intellectual data and is explicitly prohibited from operating within primary healthcare delivery pathways (such as real-time Emergency Room applications).
2.1 Master Security Dimension Assignments
The formal security classification profile for both the client-facing myDRE multi-tenant cloud service and the internal anDREa corporate environment is defined as follows:
| Target Operational Environment | Confidentiality | Integrity | Availability | Auditability / Traceability | Authenticity |
|---|---|---|---|---|---|
| myDRE Platform Service | |||||
| anDREa Corporate Office |
2.2 Framework Escalation Protocols
If an institutional tenant or regulatory mandate requires a baseline configuration that exceeds the standard myDRE service classification profile for a specific workload:
- Accountability Mapping: The designated Workspace Accountable assumes absolute structural liability for ensuring that the supplementary security controls are demonstrably implemented, continuously monitored, and formally maintained.
- Change Request Lifecycle: Local Research Support (RS) components will provide operational assistance to integrate advanced parameters via a formalized non-standard change request or dedicated project framework.
3. Confidentiality Perimeter (Justifications & Controls)
3.1 Control Implementation Mapping
The HIGH confidentiality rating across both environments mitigates unauthorized data exposure, external ransomware monetization, and lateral infrastructure hijacking.
- Multi-Factor Authentication (MFA): Enforced programmatically for all login vectors. Sessions require verification at minimum every 24 hours utilizing cryptographic number matching, geolocation telemetry, and explicit application context identification.
- Phishing-Resistant Authentication: The organization mandates passwordless configurations and physical hardware security keys for daily administrative activities. Standard software-based authenticators are retained strictly as a secondary disaster backup path.
- Role-Based Access Control (RBAC): Restricts interface capabilities and cloud fabric operations exclusively to verified personnel based on dedicated workspace role mappings.
- Data Transit & Storage Cryptography: All data volumes are dynamically encrypted at-rest and in-transit utilizing standardized AES-256 protocols and sha256RSA cipher suites.
- Exfiltration Boundary Isolation: Arbitrary data extraction from the myDRE Workspace is blocked by default. Bidirectional local-to-remote clipboard sync (copy/paste) is programmatically disabled. Any file exportation requires a formalized authorization workflow approved by an Accountable or Privileged Member.
- Tenant & Subscription Segregation: Production datasets are strictly isolated from development or testing scopes. Each external tenant operates inside independent Microsoft Azure Subscriptions separated under distinct enterprise billing accounts.
- Cryptographic Key Lifecycle Management: Each discrete cloud storage account is assigned an isolated encryption key managed automatically via Microsoft Azure key orchestration services.
- Data Sovereignty Endpoint Controls: Corporate and research configurations explicitly prohibit the persistence of production data on local user endpoints.
3.2 Regulatory Alignment
These configurations satisfy ISO/IEC 27001:2023 Control A.05.12 (Classification of information) and establish appropriate technical measures to maintain compliance under GDPR Article 32 (Security of processing).
4. Integrity Boundary (Justifications & Controls)
4.1 Implemented Control Topologies
The MEDIUM integrity status for myDRE prevents systemic data corruption while maintaining an agile framework for data processing. The corporate office enforces a HIGH perimeter to secure legal contracts, financial assets, and master source policies.
- Authorized Ingestion Paths: Data ingress is restricted to authenticated identities and explicit system services.
- Platform Invariant Logging: Portal management actions (such as starting/stopping compute nodes, changing roles, or modifying permissions) generate immutable audit records.
- Accidental Deletion Blockades: Underlying resource groups and storage accounts utilize platform locks to prevent accidental or unapproved deletion.
- System Snapshot Routines: myDRE enforces automated 24-hour non-writable snapshots with a 30-day rolling retention model. Extended or immutable forensic backups must be requested through local Research Support.
- Perimeter Network Containment: Workspaces are isolated from the public internet by default. If a research project requires an external connection, specific subdomains can be added to an outbound allowlist by an Accountable or Privileged Member after acknowledging explicit system security risk warnings.
4.2 Delineation of Responsibility Matrix (Data Integrity)
To maintain structural agility, myDRE does not impose restrictive database logic or file validation parameters on researchers. Reviewers must observe the following division of responsibility:
| Data Integrity Control | Implemented by myDRE Platform Service | Responsibility of Client / Tenant Users |
|---|---|---|
| Ingress Invalidation Checks | Yes (User-defined parsing) | |
| Internal Data RBAC Restrictions | Yes (Application-level roles) | |
| Data Modification Logging | Yes (File-level audit trails) | |
| Data Validation & Consistency Checks | Yes (Analytical scripting) | |
| Dataset Versioning & Repositories | Yes (Git / Versioning tools) | |
| Algorithmic Error Detection | Yes (Statistical validation) |
4.3 Corporate Office (anDREa Office - HIGH) Implementation
- Data Ingress & Logging: Mandatory ingestion validation paired with comprehensive event logging across the entire Google Workspace environment.
- Immutable Governance Vaulting: Deployment of Google Vault and automated multi-daily
iDrivearchive sweeps executed 3 times per day. - Directory Scoping: Shared drives are private by default, restricting access exclusively to authenticated
@andrea-cloud.comidentities using role-based permissions. Public sharing configurations require explicit management clearance.
5. Availability Framework (Justifications & Controls)
5.1 Service Level Thresholds
The MEDIUM availability tier for myDRE optimizes infrastructure utilization costs while guaranteeing reliable operational windows for research. The internal corporate office targets a HIGH availability metric to prevent business continuity disruptions.
| Availability Metric | myDRE Platform Service Baseline | anDREa Corporate Office Baseline |
|---|---|---|
| Minimum Monthly Availability | > 99.4% Uptime (per anDREa SLA) | > 99.9% Uptime |
| Maximum Acceptable Outage | 3 Working Days (Worst-case catastrophe) | 4 Hours |
| Maintenance Windows | Scheduled off-peak hours via automated pipelines | Scheduled off-peak hours |
5.2 Resiliency & Fault-Tolerant Architecture
- Decoupled Architecture: Workspace storage systems operate completely independent of Virtual Machine (VM) compute cycles. A localized failure of a virtual machine does not impact or corrupt the underlying research data shares.
- Cloud Fabric Redundancy: Infrastructure operations leverage Microsoft Azure’s geo-redundant data centers and automated fault-domain failover systems.
- Automated System Monitoring: Real-time health checks continuously evaluate platform services, instantly dispatching security telemetry alerts to the engineering on-call rotation upon detecting performance degradation.
- Continuous Integration Deployments: System updates are pushed through automated continuous integration pipelines, inherently testing system restoration and codebase integrity during every lifecycle event.
- Codebase Escrow Protection: Core system source code is updated every three months within an independent ESCROW Portal to guarantee long-term operational viability.
6. Auditability & Traceability (Justifications & Controls)
6.1 Platform Tracking Boundaries
The MEDIUM auditability classification ensures that all administrative actions and tenant modifications can be reconstructed during compliance reviews.
- Activity Logging Architecture: Every portal action (such as provisioning changes, group modifications, or infrastructure power state adjustments) creates a log entry capturing the User ID, exact timestamp, event taxonomy, and cryptographic outcome.
- Identity Association: Anonymous platform access is programmatically impossible. Every system action is cryptographically bound to a unique Microsoft Entra ID personal account profile.
- Log Retention Policy: Central security logs are stored in an immutable repository for a minimum of 30 days to facilitate forensic investigation, with deeper archives retained based on the Retention & Destruction Policy.
- Incident Registry Integration: Security incidents are recorded within a centralized tracking registry managed under ISO/IEC 27001:2023 Control A.05.26 guidelines, explicitly linking the event to the affected workspace perimeter and initiating user identity.
6.2 Application-Level User Responsibilities
The myDRE platform is tool-agnostic and does not inspect data payloads or trace individual processes inside virtual machine environments. Clients must explicitly configure:
- File-System Traversal Logs: Tracking specific file access events (e.g., local read/write logs for sensitive
.csvfiles) inside the VM. - Scientific Reproducibility: Managing version control for application scripts, code bases, and statistical models to ensure complete algorithmic traceability.
7. Authenticity Verification Framework
To prevent identity spoofing, session hijacking, or credential stuffing, both the myDRE platform and anDREa corporate offices enforce a HIGH authenticity perimeter as the primary line of defense.
- Mandatory MFA Challenge: Every distinct authentication session requires verification via multi-factor challenges.
- Exclusion of Shared Identities: System configurations strictly prohibit shared accounts. Every corporate worker or research user must authenticate utilizing an individual digital identity verified through Microsoft Entra ID or an authorized
@andrea-cloud.comprofile. - Active Session Lifecycle Controls: Strict conditional access timeouts and idle session expirations are enforced to mitigate physical endpoint hijacking or token cloning vectors.
- Cryptographic Channel Authenticity: All network traffic traverses TLS/SSL encrypted channels, protecting server-to-client identity verification and preventing man-in-the-middle interception.
8. Threat, Vulnerability, and Risk Mitigation Matrix
8.1 myDRE Platform Technical Risk Registry
| Threat Taxonomy | Integrated Platform Mitigation Control | Residual Risk Level |
|---|---|---|
| Dormant Identity Privilege Creep | Enforcement of mandatory, bi-annual workspace Access Reviews alongside ad-hoc validation workflows. | Very Low |
| Credential Spoofing & Brute-Force | Mandatory MFA (24h limit); hardwarykey, passkey, and authenticator paired with geolocation confirmation and number-matching tokens. | Very Low |
| Cloud Hypervisor Failure | Complete compliance with native Microsoft Azure high-availability SLAs. | Low |
| Platform Software Defect | Execution of peer code reviews across a standard Dev/Test/Accept/Prod (DTAP) pipeline. | Low |
| Physical Facility Compromise | Physical protection managed entirely by certified Microsoft Azure data center facilities. | Very Low |
| Catastrophic Data Loss | 24-hour non-writable snapshots (30-day rolling) and resource deletion locks. | Very Low |
| Unavailability of Local Manager | Backup support coverage provided directly by the centralized anDREa Support Team. | Very Low |
| Network Interception / MitM | Cryptographic enforcement of TLS-protected data channels (sha256RSA). | Very Low |
| Infected Research File Uploads | Workspaces lack inbound internet access by default; isolated environments utilize standard Windows Defender configurations. | Very Low |
| Phishing / Virtual Machine Compromise | Compute endpoints restricted to explicitly allowlisted IPs; VM network addresses rotate automatically upon reboot. | Very Low |
| Malicious Data Exfiltration | Core clipboard operations are blocked; all egress actions require authorization from an Accountable or Privileged member. | Very Low |
| Tenant IAM Core Compromise | Isolation of authentication domains via dedicated anDREa Entra ID directory infrastructure. | Low |
8.2 Tenant Operational Safeguards
| Tenant-Side Threat Context | Recommended Mitigation Control for Users & Clients | Residual Risk Level |
|---|---|---|
| Delayed Account Revocation | Execution of ad-hoc Access Reviews by institutional Research Support. | Very Low |
| Primary Accountable Inaccessibility | System provision for Research Support to transfer the Accountable role profile to an alternate manager. | Very Low |
| Systemic Vendor Unresponsiveness | Core storage accounts are deployed directly within the tenant's own Azure billing account, allowing complete directory ownership transfer if necessary. Code assets are backed by an independent ESCROW framework, permitting approved institutions to spin up a new platform entity if required. | Low |
8.3 anDREa Corporate Office Threat Registry
| Threat Taxonomy | Integrated Office Mitigation Control | Residual Risk Level |
|---|---|---|
| Dormant Identity Privilege Creep | Execution of mandatory, periodic internal Access Reviews. | Very Low |
| Corporate Cyberattack | Enforced MFA (24h limit); hardwarekey, passkey, or authenticator paired with number matching and geolocation verification. | Very Low |
| SaaS Core Fabric Failure | Operational alignment and reliance on standard Google Workspace SLAs. | Low |
| Corporate Data Loss | Continuous data retention archiving via Google Vault and specialized iDrive automated snapshots. | Very Low |
| Physical Endpoint Exposure | Device verification metrics restricting data store access exclusively to vetted @andrea-cloud.com identities. | Very Low |
| Malicious Network Interception | Cryptographic enforcement of TLS-protected data channels (sha256RSA). | Very Low |
| Malicious File Ingestion | Automated file checking, scanning, and malicious upload blockades executed by Google infrastructure engines. | Very Low |