Healthcare security posture Scott Raymond, MHA/INF, BSN, RN ACIO VP, Information Technology Centura Heatlth

Southern California IDN 5 hopitals 350 employed physicians 400 specialist 250 affiliates Free standing Surgery centers Free standing Radiology centers Free standing Dialysis centers

Things to cover Best Practice Security Posture Breaches Threats NIST HIPAA Quick Wins Q&A

Best Practice Security Posture Identify Asset Management Business Environment Governance Risk Assessment Risk Management Protect Access Control Awareness & Training Data Security Information Protection Processes & Procedures Maintenance Protective Technology Detect Anomalies & Events Security Continuous Monitoring Detection Processes Respond Response Planning Communication Analysis (RCA) Mitigation Improvements (Post Mortem) Recover Recovery Planning Improvements

Environment assessment Example

Our current posture Firewall Endpoint Security Microsoft Identification Management Data Loss Prevention/Email Encryption SIEM MDM 2FA AD Password Management Web Filtering Remote Access/Remote Support

current posture

Things to work on Security Best Practice Standards Security & Incident Response Playbook (Think Pilot Check Playbook) Elevated credentials 2FA for DBAs Log Aggregator Tap Badging for Clinicians (2FA on the inside) BioMed Management & Surveillance Eliminating Generic Machines and Desktops Published Desktop (CHD) VDI Strategy and deployment

Breaches An intentional or unintentional release of secure or private/confidential information to an untrusted environment

2016 was the year of the breach Democratic National Committee U.S. Department of Justice Internal Revenue Service Yahoo LinkedIn Oracle Cisco Target Wendy’s Snapchat And many more…

Healthcare Breaches Premier Healthcare 21st Century Oncology 200,000 patient records 21st Century Oncology 2.2 million patient records MedStar Health Ransomware Newkirk Products 3.3 million customer health insurance plans According to HIPAA Journal there were 329 healthcare breaches in 2016 exposing 16.5 million records!

Breach Threats External Threats Malware Spyware Ransomware Vandalism Business Disruption No Vendor Back-up or Contingency Internal Threats Bad Actors Negligence/Accidental Inappropriate Access Lack of Controls Lack of Security No Back-up or Contingency

nist Achieving adequate information security for organizations, mission/business processes, and information systems is a multifaceted undertaking that requires:  • Clearly articulated security requirements and security specifications;  • Well-designed and well-built information technology products based on state-of-the-practice hardware, firmware, and software development processes;  • Sound systems/security engineering principles and practices to effectively integrate information technology products into organizational information systems;  • Sound security practices that are well documented and seamlessly integrated into the training requirements and daily routines of organizational personnel with security responsibilities;  • Continuous monitoring of organizations and information systems to determine the ongoing effectiveness of deployed security controls, changes in information systems and environments of operation, and compliance with legislation, directives, policies, and standards;21 and  • Information security planning and system development life cycle management.22 

HIPAA Administrative Safeguards Access Controls Security Awareness Training Security Incident Procedures Evaluation Business Associate Contracts Physical Safeguards Facility Access Controls Workstation Use & Security Device & Media Controls Disposal Media & Media Reuse Technical Safeguards Access Control Audit Controls Integrity (P&Ps) Person or Entity Authentication Transmission Security (encryption) Organizational Requirements BAAs & Other Arrangements Requirements for Group Health Plans Implement Safeguards Ensure Adequate Separation Ensure Agent Safeguards Report Security Incidents Policy & Procedures

NIST & HIPAA Crosswalk Access Control Awareness & Training Audit & Accessibility Security Assessment & Authorization Configuration Management Contingency Planning/Business Continuity Identification & Authentication Incident Response Maintenance Media Protection Physical Environment Protection Planning Personnel Security Rick Assessment System & Services Acquisitions System & Communication Protection System & Information Integrity Program Management

Quick Wins Secure the DMZ Network Segmentation Patch Management Firewall 2FA for all remote access No webmail Network Segmentation Patch Management N+30 Automation End user Education Phishing Campaigns Outlook reporting button SOC 24/7/365 monitoring Managed Services Consulting/Staff Aug Yearly Security Audits Pen Testing Red Team/Blue Team Vendor Audits Security Scorecard Contracts

? Questions Questions Questions Questions Questions Questions

Best Practice Security posture takeawaways Secure the DMZ Firewall 2FA for all remote access No webmail Network Segmentation Patch Management N+30 Automation Scott Raymond scottraymond@centura.com