Cavirin Systems, Inc. Cavirin Systems, Inc.
 

Cavirin Blog

Healthcare IT Blog Series - 1 of 6 

(This is the introduction post in a Blog series - Moving Healthcare to the Cloud.  The complete series can is now available: Introduction - The Move to the Cloud - Defining the Cloud Project - Managing Risk When Moving to the Cloud - Operationalizing Security in the Cloud - Measuring Success in the Cloud)

One of the key themes of the recent HIMMS18 conference in Las Vegas is that healthcare IT leaders need to embrace the power of change to transform how doctors, nurses, staff and patients consume IT. This approach may be more important than ever, given that the industry is in the midst of an IT crisis.

Threats are coming in from several fronts. Here are a few reasons why many CIOs and CTOs are finding it hard to get a good night’s sleep:

The fallacy of thinking compliance = a strong security posture

Some organizations think that abiding by regulations such as HIPAA makes them safe, but this has been proven to be incorrect. Let’s take a real public example. In February 2015, Anthem disclosed that criminal hackers had broken into its servers and had potentially stolen more than 37.5 million records that contained personally identifiable information. 20 days later, Anthem raised the number to 78.8 million records. According to Anthem, the data breach extended into multiple brands that Anthem uses to market its healthcare plans, including Anthem Blue Cross and Blue Shield, Amerigroup, Caremore, and UniCare. The security breach occurred even though Anthem was HIPAA compliant.

Vulnerable legacy equipment

For decades, manufacturers like Siemens, Bosch, Honeywell and others have built embedded systems that run on operating systems from the Stone Age—unpatched, insecure and vulnerable. An example of this includes Siemens medical scanners. Hackers can exploit trivial flaws in the network-connected devices to run arbitrary malicious code on the equipment. These remotely-accessible vulnerabilities lurked in all Siemens positron emission tomography and computed tomography scanners running Microsoft Windows 7.

Too many compliance mandates

It’s hard to keep up with changing mandates because healthcare organizations have patient data dispersed in many databases across the cloud, the network, and a multitude of endpoints. Sometimes they rely on paper as well. This makes it difficult to comply with the stringent regulatory requirements of HIPAA and HITECH and to safeguard PHI, PII and EHR. In addition, medical teams need to access this information quickly in order to meet the demands of timely care. Security teams are thus challenged to find a balance between patient data security and providing easy access to the information.

Modern-day attacks

Ransomware continued to make the news in 2017 and the healthcare industry was not immune; in fact, it was a leading victim—Hollywood Presbyterian declared a state of emergency over a ransomware attack in February last year. The hospital isn't saying exactly when it paid the ransom, but it looks like they waited at least a week to end the file-hostage situation. The hospital said the payment was 40 Bitcoin, which was worth around $17K at the time. An unnamed doctor told the press that the systems responsible for CT scans, documentation, lab work, pharmacy functions and electronic communications were out of commission. Email was also down, so the staff relied on pencil and paper. It was also reported that radiation and oncology were temporarily shut down.

Severe shortage of IT security personnel

According to Cybersecurity Ventures, there will be 3.5 million unfilled cybersecurity jobs by 2021. And for qualified security personnel, healthcare IT is not the preferred destination of choice: Facebook, Google, AWS and other high-tech innovators are more attractive. 

New age disruptors

Healthcare organizations have to manage insanely large data sets to make their training algorithms better and more robust. But an even bigger and more disturbing challenge is that non-health entities can now play ‘doctor.’ Findings of the research conducted by the Computational Story Lab, a group led by Chris Danforth and Peter Sheridan Dodds of the University of Vermont, show that Instagram knows if you’re depressed, Twitter can indicate PTSD, and Facebook posts can describe a region’s relative public health.

Identifying the Right Steps to Take in the Cloud Journey

So, with all these developments as a backdrop, and as healthcare organizations look to the cloud as a panacea for everything, there needs to be a reality check on how to look at the cloud in the context of the current state and where healthcare is headed. To help organizations take on this challenge, this blog series will walk readers through the why, the what, and the how of ‘Cloud and Healthcare.’

The series will show how to identify what steps to take in the cloud journey. It starts with the next blog, which will focus on the why—Making the Business Case for the Cloud. The following chapter will delve into understanding what systems are ready for this journey, and frankly, which aren’t. We’ll also look at how you can make that distinction without bias.

The next blog will address the issue of how to assess the appropriate levels of risk for all the assets you are moving (or will be moving) to the cloud to ensure confidentiality, integrity, and availability. The fifth installment will focus on how to operationalize security. This includes the policy controls to put in place beforehand, how to monitor security, and how to react to any indications of breaches or potential breaches. It’s a team effort, so make sure you know who the players are and get your team ready!

Finally, we will look at the advent of artificial intelligence and machine learning, and how there is going to be an opportunity to gather more and do more with patient data, research, and analysis. But all of this should be backdropped with a clear ‘Code of Ethics.’ If you fail in the ethics arena, the fallout could be cataclysmic.

The Need to Embrace Education

The cloud provides an amazing path for your healthcare organization to take a leap forward. You can not only address the security sins of the past in a comprehensive manner, but also set yourself up for success in this new age of healthcare IT that includes the Internet of Things, artificial intelligence and predictive medicine

But, to use the cloud effectively, securely and consistently—truly understanding what the cloud can do for your organization and your patients and to set your organization up competitively—requires you to embrace the need for education without bias. Hopefully, these blog series did just that! 

Read about how Cavirin can protect your ePHI.

Details
Category: Cloud Migration

 

Today we’re announcing the next phase in Cavirin’s evolution, with an approach and product offerings that will truly provide organizations with the visibility and control they require across their hybrid infrastructures, an approach that provides the CISO with actionable insights to minimize the attack surface while meeting the reporting requirements of his or her board.  We call this ‘CyberPosture Intelligence for the Hybrid Cloud.”  Read on!

The hybrid cloud is real, and in fact, 81% of enterprises are adopting a multi-cloud architecture, spanning on-premise and one or more public cloud providers.  And this won’t go away anytime soon, with about 1/3 of workloads remaining on-premise in 2025, sometimes the most critical.  But there is a problem.  A good 77% of IT personnel identify security as still a barrier to adoption, and almost the same number, 75% lack visibility across their hybrid cloud.

So what is CyberPosture, a word that you’ll be seeing more of in the future?  It is verifying that your slice of the public cloud is secure, be it IaaS, PaaS, SaaS, or even FaaS.  It is confirming that your workloads (servers) in the cloud are secure as well, be they VMs or containers.  It is ensuring that sensitive data if in the cloud, is secured, being able to pass your periodic security audits, and not only securing your own infrastructure but those of your critical suppliers and partners.  Finally, it is an architecture to help you truly understand the risks and deficiencies that are part of any hybrid cloud infrastructure.  One that permits you to effectively balance your risk tolerance with skills and budgets.

CyberPosture is closely aligned with the rise of DevSecOps, the automation of security within DevOps to ensure a more secure cloud infrastructure and to offer more automated remediation when issues are discovered.  In a break from the past, SecOps will no longer be held as a barrier to agile development.  They will regain their place at the table as an enabler.  Who manages this?  The ‘Cloud Security Architect’ runs point, bringing together skillsets from across the organization in a ‘Cloud Center of Excellence.’ 

How do you achieve CyberPosture?  As with any type of posture, it doesn’t just come to you.  You actively set off to achieve it.  We help you instrument your public cloud accounts, your cloud security posture.  We offer the tools to enable continuous compliance across regulations that include GDPR, PCI, HIPAA, SOC, ISO, CIS, and others.  We help you apply these tools across critical verticals and use cases, such as cyber-insurance risk assessment or supply chain risk management.  We integrate these tools with your agile development processes. And, we package up this intelligence in the form of a ‘CISO Dashboard’ or as reports for your audit committee, providing you with a consolidated ‘Cavirin Risk Score’ that combines elements of security and compliance, for your cloud, and for your workloads.

The next step?  Visit us at RSA to learn more about Cavirin’s CyberPosture Intelligence, and while there challenge your existing cybersecurity partner on how to solve this hybrid cloud security and visibility challenge.  Then drop by booth N4439 and share your thoughts with us!

Details
Category: Continuous Security Assessment & Remediation

A Catch-up Plan for Technical Controls

In under 60 days, the GDPR regulation officially takes effect in the EU, and will impact companies well beyond Europe’s borders.  As a reminder, on May 25 the GDPR will replace the EU’s existing privacy regulation, and in a nutshell, data protection is now by design and by default.  And, data includes both personal and professional information.  A major point is the ‘right to be forgotten,’ and some of the controversies around Google and Facebook is a result of this intent.

By now, organizations should have a well-developed plan in place for implementation, including the assignment of a Data Protection Officer and coordination across all impacted business functions.  An issue is that this planning is not universal, and in fact, many US companies don’t realize their exposure.  In a recent study, less than 25% of US Firms consider themselves to be GDPR-ready.   Not a good place to be in, given that a just-released ESG survey shows GDPR-subject data as the most widely deployed in the cloud.

GDPR ready

Digging further, the GDPR defines three elements of compliance – people, process, and technology.   Cavirin can’t directly address the first two, but we can help with plugging holes in the third.  In a four-phase process that includes discover, manage, protect, and report, the third – protect – closely aligns with Cavirin’s capabilities.  We’ve created a policy framework that helps to automate the following across cloud providers and operating systems: 

  • Auditing Personal Data Processing Systems: Ensuring that all user and admin activities in personal data processing systems are traceable at all times.
  • Monitoring Personal Data Processing Systems: Ensure they are safe from software vulnerabilities
  • Personal Data Access controls: Ensure that access to systems storing or processing personal data is restricted to only users or programs that need it
  • Personal Data Security controls: Monitoring configuration settings for systems storing or processing personal data to prevent breaches and disclosure
  • Personal Data Transfer Security: Monitoring usage of encryption and network configuration to detect and/or prevent unauthorized transfers of personal data

So how to get started?  In under 30 minutes (really), you can deploy the solution on-premise or within your public cloud provider.  The deep discovery of the critical workloads, you identified in the steps above, then commences, and in a short amount of time, you’ll have actionable reports that identify your top risks.  The assessment delivers remediation guidance, and even for the largest of infrastructures, you’ll have plenty of time to take action before the deadline.  But don’t stop there!  Configure the platform for continuous assessment, so if the configuration of any of your servers changes, or new ones are added, you’ll be immediately notified and can then take action.

Download the linked infographic for more on the above!  And listen to the on-demand webinar for further information on putting your own plan in place for GDPR enforcement day, May 25th, 2018.

 

Details
Category: Regulatory Compliance

 

This last week, the US Centers for Medicare & Medicaid Services (CMS) announced MyHealthEData, a federal initiative that for the first time will provide patients with full and secure control over their healthcare data, no longer locking it to a single healthcare system or provider.

When announcing the program, CMS Administrator Verma related an experience where her husband was in the hospital for a week due to heart failure. Upon discharge, Verma asked for her husband’s records, and was presented with a CD-ROM, itself incomplete. This brought up memories of my wife’s experience in Taos where she came down with a bad case of pneumonia and upon discharge was presented with a large folder containing X-Rays. Very useful. Verma then went on to question the $30 billion spent to-date by the US government on EHR implementation, and whether the patient experience has improved.

Key stakeholders in MyHealthEData include the White House, the NHS, the VA, and the NIH. The intent is to completely revamp the way patients interact with the healthcare system, making them the center of control and permitting them to better compare providers based on cost and capabilities. Other impacts of greater data sharing should be better diagnosis and less duplication of care, outcomes that will hopefully drive down the cost and raise the quality of care for everyone.

Note that the data ‘ownership’ aspect of MyHealthEData is much like the intent of GDPR within the EU, placing people and privacy first. It reflects a growing trend given the pervasiveness of personal data hosted across the Internet and especially within healthcare. And paralleling the EU, we’ll see the rise of the Data Protection Officer (DPO) within US enterprises and other organizations, a role integral to privacy.

But with portability comes additional requirements for security. No longer confined to the network of a single provider, records will be ‘borderless,’ accessible by almost every healthcare provider and across multiple devices including smartphones. To encourage security, MyHealthEData will leverage the Merit-based Incentive Payment System (MIPS) which includes penalties for security breaches. This is where Cavirin can help.

With data spread across a much larger and interconnected threat, there are many more chances for breach, both intentional and non-intentional. The workload and cloud account protection provided by Cavirin will be even more critical, and since security is a function of its weakest link, the ease of implementation and automation we provide will permit the adoption of best practices by anyone within the healthcare value chain.

Cavirin as a company is not new to healthcare, with customer use cases spanning the OS hardening of servers used in medical device manufacturing, HIPAA compliance on-premise and within AWS, including the application of the AWS HIPAA Quickstart, and use of our open APIs to connect to other security platforms within a genomic research environment.  We also have multiple deployments within the largest dental benefits provider in the United States.  Learn more at http://www.cavirin.com/solutions/continuous-compliance/hipaa-hitech.html.

Details
Category: Regulatory Compliance

Azure Hardening

 

This morning, Cavirin announced the near-term availability of the new CIS Microsoft Azure Foundations Benchmark.  The document is expected to be generally available within the next week or two, but why wait?  It is available today to anyone with CIS access, and is a milestone for public multi-cloud security as a foundational and prescriptive guideline for organizations to establish a healthy security posture in Azure Cloud investments.  This is the first hardening benchmark for Azure, completing an earlier available benchmark for AWS, also supported by Cavirin.  To address any confusion, other cloud security vendors do offer a view into one’s Azure security posture via published APIs.  We do the same, but the CIS Benchmark takes a different approach to uncover a deeper level of understanding.

The availability of the new CIS Benchmark is critical in securing hybrid cloud environments.  CNBC recently reported that AWS held a 62% market share for public cloud deployments, a drop from 68% a year earlier.  In the same timeframe, Azure jumped from 16% to 20%.  More importantly, ESG states that by the end of 2018, 81% of enterprises in the cloud will deploy on more than one provider. Cavirin’s goal is to enable hybrid cloud security, offering an organization a single, correlated view of their security posture across multiple public clouds, as well as on-premise.  This is very different from a simpler multi-cloud deployment that looks at each cloud in isolation, ‘clouds in the night’ if you will.

The recommendations fall into eight areas:

  • Identity and Access Management
  • Security Center
  • Storage Accounts
  • SQL Services
  • SQL Databases
  • Logging and Monitoring
  • Networking
  • Virtual Machines
  • Other Security Considerations
Details
Category: DevOps

Hybrid Cloud Strategy Advantages

A Hybrid Cloud Strategy is Important for Security 

Cybersecurity is evolving and strengthening every day, but Lloyd’s, in partnership with AIR Worldwide, released a cautionary report entitled Cloud Down – The impacts on the US economy. This report outlines the possible, and probable, repercussions of the failure of one of the leading cloud providers. In focus: the financial impact of such an event.

Why should we care? If these insights are heard and headed, insurance managers could better grow their cyber business in a judicious manner. Along the same train of thought, it is important to remember that these analyses are made with the notion that a unique CSP would be affected at a time. As such, distributing workloads across multiple CSP’s, taking the time to analyze which advantages of each cloud would best help you attain your goals, would be a possible real-world application of this report.

To provide us with a baseline, the report specifies that “the results published in the report are based on the top 15 cloud providers in the US, which account for a 70% market share.”

Details
Category: Continuous Security Assessment & Remediation

  1. Full-Stack Container Security - A Unified Approach
  2. 3 Key Ingredients to DevSecOps
  3. Mind the (Skills) Gap!
  4. Securing the Hybrid Enterprise – Cavirin’s Reflection on 2017

Subscribe

Tag Cloud

Categories

© Cavirin Systems, Inc. All rights reserved.