- We’re more than half-way through 2017 and many healthcare organizations are already looking ahead. And, for good reason.
Healthcare data security will remain one of the top concerns for the vast majority of healthcare organizations housing sensitive data. We’ve seen an increase in breaches, attacks, and ransomware instances. And the attackers are getting bolder.
Today, healthcare is truly at an inflection point. Over the next three to four years, digital transformation will absolutely shift away from just 'projects,' 'initiatives,' or 'special business units.' The digital healthcare framework will become a part of our everyday lives.
Trends around mobility and the growing number of IoT devices are only going to continue to increase.
Consider this latest report from Cisco analyzing the mobility market. Almost half a billion (429 million) mobile devices and connections were added in 2016. Smartphones accounted for most of that growth, followed by M2M modules. Global mobile devices and connections in 2016 grew to 8.0 billion, up from 7.6 billion in 2015.
And, healthcare is at the center of this. As Cisco points out, these devices come in various shapes and forms, ranging from smart watches, smart glasses, heads-up displays (HUDs), health and fitness trackers, health monitors, wearable scanners and navigation devices, smart clothing, etc. The growth in these devices has been fueled by enhancements in technology that have supported compression of computing and other electronics (making the devices light enough to be worn).
Plus, there’s the cloud.
Do you remember, traditionally, when it was one server that carried just one workload? Well, that’s not the case any longer.
Now, increasing server computing capacity and virtualization, multiple workloads per physical server are common in cloud architectures. Cloud economics, including server cost, resiliency, scalability, and product lifespan, along with enhancements in cloud security, are promoting migration of workloads across servers, both inside the data center and across data centers (even data centers in different geographic areas).
Healthcare organizations are taking advantage of the new, compliance-ready, cloud environments to extend and distribute their healthcare ecosystem.
Looking ahead, let’s examine five great ways to enhance security for healthcare organizations, and where you can leverage new technologies.
Healthcare, Compliance, and Cloud – they can be friends
For too long organizations bound by compliance and regulations were forced out of the cloud market. This really isn’t the case anymore. Furthermore, cloud security has become a lot better. Amazon AWS for example now offers a variety of compliant cloud servers, including ones around DoD, PCI DSS, HIPAA, and more. You’re able to control the flow of data with dedicated secure links into the AWS cloud. From there, you can dynamically load-balance your workloads to ensure secure data resides at the appropriate point. Here’s the big point - just because the data is traversing a different network does not mean you can stop monitoring it. Direct integration with a cloud provider allows you to span your monitoring and security control plane.
Integrate server and data center functionality into security monitoring and management
Traditional Windows and operating system services were always left to work within their own little environment. After all, these processes are for the most part internal. So, aside from a few security checks here and there, why monitor them…right?
This is why: “As of June 2017, a new strain of ransomware dubbed ‘Petya’ is worming its way around the world with alarming speed. The malware is spreading using a vulnerability in Microsoft Windows that the software giant patched in March 2017 — the same bug that was exploited by the recent and prolific WannaCry ransomware strain.”
New kinds of threats are taking aim at very specific points within your data center. We’ll get to that in a minute. However, integrating your ITSM solution, LDAP, and even Active Directory services to an enterprise security management layer is a great way to keep an eye on your entire cloud, physical and virtual environment. There are a lot of options here and a lot of great ways to integrate core cloud and OS-layer services directly into the security layer.
Finally, think about the end-point. Do you really need PCs or can you work better with powerful thin clients? Remember, the less OS and data at the endpoint, the less you potentially lose.
Leverage security virtualization for greater controls
You can now deploy entire virtual appliances capable of next-generation firewall and advanced security services, data loss prevention, IPS/IDS, and more. You can also deploy these as standalone virtual services throughout your healthcare network. Traditional unified threat management (UTM) appliances can do a great job managing traffic and controlling security at the core. But what about new kinds of threats? What about data loss within a specific network segment? What about your distributed locations and the edge?
These new VM-based security appliances allow you to monitor internal traffic and integrate with APIs to let you proactively monitor VM changes dynamically feeding that context into security policies.
Application and workload-centric security
Your healthcare applications are an absolutely critical part of your business. New tools around application firewalls and application-centric security are allowing organizations to have greater control over the delivery of their apps.
Furthermore, integrating your applications into an overall management solution can greatly help automate and simplifies the entire security change management process to accelerate application delivery.
Application-aware security features can actually monitor anomalous changes within application behavior. Is there a spike in traffic? Is the wrong kind of data being accessed? Who is actually connecting to the application and from where? New concerns around mobility and application access require a better approach to data and application security.
Stop APTs, create smarter locks
Advanced persistent threats (APTs) can take aim at almost any part of your data center. But, if it’s targeted, the bad guys are after your data.
The best way to keep these kinds of threats at bay is to have an all-encompassing security management and policy control solution.
Consider this, you now have network, firewall, and virtual security services running within your environment. Now, what if they’re distributed? What if they are all different brands of security appliances? How do you manage control of policies and security delivery? How do you control threats which can span your entire cloud or data center architecture?
Managing complex environments is made easier with powerful visibility tools that allow you to control a heterogeneous security environment. The goal here is to simplify security management without giving up control.
One of the best pieces of advices to give is to constantly stay proactive with your security environment and policies. Test out your own systems and make sure your security is evolving at the same pace as your business.
Most of all, when providing services to your healthcare end-users you don’t want to hinder their experience. With a huge focus on application and data delivery, users want their content delivered quickly, to any device, efficiently, and of course, securely as well.