Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/18/2019
10:30 AM
Jason Polancich
Jason Polancich
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

The Rx for HIPAA Compliance in the Cloud

For medical entities, simply following HIPAA cloud service provider guidelines is no longer enough to ensure that your practice is protected from cyber threats, government investigations, and fines.

The challenges of secure healthcare IT are really hard! It's akin to navigating a barbwire minefield that's surrounded by an endless sea infested with fast, hungry sharks. And it's raining.

That may sound a bit flippant — and it is — but it's also an insightful way to describe the frustrating level of complexity involved in making digital healthcare information more secure and legally compliant. At best, your chance of success is always questionable, and even small missteps come with severe penalties.

About five years ago, the Department of Health and Human Services (HHS) expanded the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a set of laws aimed at providing continuous healthcare coverage and controlling the electronic transmission of healthcare data. The expansion laid out the responsibilities of covered entities (CEs), such as medical practices and insurance companies, and business associates (BAs), referring to technology providers and vendors.

In 2016, the law got even more detailed with guidance for how BAs and cloud service providers (CSPs) should behave in order to be suitably "cyber secure." The new regulations issued very thorough written guidance and set up very stiff penalties for things like data breaches, data loss, and data theft. Since that time, investigations and legal charges have been ongoing — and increasing in volume. If you are curious, you can take a look at the current list of open cases under investigation by the Office of Civil Rights, which has the job of policing HIPAA-covered cyber events.

Recently, a healthcare customer of mine described HIPAA cloud compliance as a big boat that's been hastily built and not tested on the open water. Holes spring up everywhere and, when you plug one, another opens up at the same time.

With all these holes, simply following HIPAA CSP guidelines is not nearly enough to ensure that your company or practice is protected from cyber threats, government investigations, and fines. Each entity involved in handling electronic healthcare information must continuously take extra precautions to keep their risk levels as low as possible.

If those companies (or their IT providers) were to take a look at the cloud networks and client-accessible web portals where they're storing data and hosting things, they'll often find some interesting and unexpected "meetings" going on between their networks and external, often high-risk, IP addresses and networks around the globe.

In other words, if you look at the servers your cloud apps and networks are talking to behind your back and assess them for their cyber threats, you'll find you're opening yourself up to all sorts of potential badness — and HIPAA-policed things like breaches — via vectors like Tor, ransomware, phishing, malware, and botnet-delivered attacks.

By using focused IP and network threat intelligence, healthcare companies and their technology providers can add simple but effective protection measures to more traditional firewall approaches that automatically block access to their networks, data, sites, and apps before the bad things occur.

How do you get started? Here's a checklist to cover the fundamentals:

  • Make sure all your apps, websites, and other networked assets are sufficiently logging inbound and outbound network connections to grab IPs that attempt or make connections.
  • Ensure you have adequate tooling to search, alert, and report on the IP and network data you're collecting with a SIEM or similar tool.
  • Use a quick and accurate service or tool to identify, score, and "rack and stack" the threat profiles of all the collected IP addresses by things like blacklist type and volume, type of threat with which the IPs have been associated, and recency of incidents.
  • Proactively and aggressively provide feedback about the worst and most threatening offenders to your network and web application firewalls for block-listing.
  • Monitor collected IP data over time to catalog baseline patterns and anomalies that warn of current or future incidents.

These methods will help develop a core process you can rely on to profile "normal" traffic patterns between your cloud and external services in order to spot suspicious communications patterns more quickly, which will lead to better threat response and mitigations downstream in your environments before data goes missing. For example, if your cloud all of a sudden starts talking to strange servers in China for a week, you can immediately start looking around for another hole in the boat. At the very least, it's a sign of potential problems to come. 

Too often, medical practitioners and healthcare companies assume that technology providers bear all the burden (and legal risk) for protecting them from the dangers of HIPAA violations. In actuality, the burden to protect businesses and health IT practices is still very much on the non-technical covered entities.

Related Content:

Jason Polancich is co-founder, app designer and digital marketing lead for Musubu.io. Polancich is also a linguist, software engineer, data scientist, and intelligence analyst. He originally founded HackSurfer/SurfWatch Labs (Pre-VC), a cyber analytics firm founded in 2013 ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/22/2019 | 1:59:49 PM
At heart, the cloud is
Jus an enormously long RJ-45 cable from your network to a server somewhere else in the world that has unknown security features running and unknown personnel at the keyboard   For that reason alone it should be suspect and HIPAA only complicate the requirements.  Add in cloud-web apps and you have a hadean nightmare.  HIPAA should never be cloud based.  And I have seen hospitals that use cloud-based patient apps!!!   PRISIM comes to mind and the web version of EYECOM.  No way, ever, should they be used. 
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15540
PUBLISHED: 2019-08-25
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
CVE-2019-15538
PUBLISHED: 2019-08-25
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a ...
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.