Vulnerabilities / Threats

1/18/2019
10:30 AM
Jason Polancich
Jason Polancich
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

The Rx for HIPAA Compliance in the Cloud

For medical entities, simply following HIPAA cloud service provider guidelines is no longer enough to ensure that your practice is protected from cyber threats, government investigations, and fines.

The challenges of secure healthcare IT are really hard! It's akin to navigating a barbwire minefield that's surrounded by an endless sea infested with fast, hungry sharks. And it's raining.

That may sound a bit flippant — and it is — but it's also an insightful way to describe the frustrating level of complexity involved in making digital healthcare information more secure and legally compliant. At best, your chance of success is always questionable, and even small missteps come with severe penalties.

About five years ago, the Department of Health and Human Services (HHS) expanded the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a set of laws aimed at providing continuous healthcare coverage and controlling the electronic transmission of healthcare data. The expansion laid out the responsibilities of covered entities (CEs), such as medical practices and insurance companies, and business associates (BAs), referring to technology providers and vendors.

In 2016, the law got even more detailed with guidance for how BAs and cloud service providers (CSPs) should behave in order to be suitably "cyber secure." The new regulations issued very thorough written guidance and set up very stiff penalties for things like data breaches, data loss, and data theft. Since that time, investigations and legal charges have been ongoing — and increasing in volume. If you are curious, you can take a look at the current list of open cases under investigation by the Office of Civil Rights, which has the job of policing HIPAA-covered cyber events.

Recently, a healthcare customer of mine described HIPAA cloud compliance as a big boat that's been hastily built and not tested on the open water. Holes spring up everywhere and, when you plug one, another opens up at the same time.

With all these holes, simply following HIPAA CSP guidelines is not nearly enough to ensure that your company or practice is protected from cyber threats, government investigations, and fines. Each entity involved in handling electronic healthcare information must continuously take extra precautions to keep their risk levels as low as possible.

If those companies (or their IT providers) were to take a look at the cloud networks and client-accessible web portals where they're storing data and hosting things, they'll often find some interesting and unexpected "meetings" going on between their networks and external, often high-risk, IP addresses and networks around the globe.

In other words, if you look at the servers your cloud apps and networks are talking to behind your back and assess them for their cyber threats, you'll find you're opening yourself up to all sorts of potential badness — and HIPAA-policed things like breaches — via vectors like Tor, ransomware, phishing, malware, and botnet-delivered attacks.

By using focused IP and network threat intelligence, healthcare companies and their technology providers can add simple but effective protection measures to more traditional firewall approaches that automatically block access to their networks, data, sites, and apps before the bad things occur.

How do you get started? Here's a checklist to cover the fundamentals:

  • Make sure all your apps, websites, and other networked assets are sufficiently logging inbound and outbound network connections to grab IPs that attempt or make connections.
  • Ensure you have adequate tooling to search, alert, and report on the IP and network data you're collecting with a SIEM or similar tool.
  • Use a quick and accurate service or tool to identify, score, and "rack and stack" the threat profiles of all the collected IP addresses by things like blacklist type and volume, type of threat with which the IPs have been associated, and recency of incidents.
  • Proactively and aggressively provide feedback about the worst and most threatening offenders to your network and web application firewalls for block-listing.
  • Monitor collected IP data over time to catalog baseline patterns and anomalies that warn of current or future incidents.

These methods will help develop a core process you can rely on to profile "normal" traffic patterns between your cloud and external services in order to spot suspicious communications patterns more quickly, which will lead to better threat response and mitigations downstream in your environments before data goes missing. For example, if your cloud all of a sudden starts talking to strange servers in China for a week, you can immediately start looking around for another hole in the boat. At the very least, it's a sign of potential problems to come. 

Too often, medical practitioners and healthcare companies assume that technology providers bear all the burden (and legal risk) for protecting them from the dangers of HIPAA violations. In actuality, the burden to protect businesses and health IT practices is still very much on the non-technical covered entities.

Related Content:

Jason Polancich is co-founder, app designer and digital marketing lead for Musubu.io. Polancich is also a linguist, software engineer, data scientist, and intelligence analyst. He originally founded HackSurfer/SurfWatch Labs (Pre-VC), a cyber analytics firm founded in 2013 ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/22/2019 | 1:59:49 PM
At heart, the cloud is
Jus an enormously long RJ-45 cable from your network to a server somewhere else in the world that has unknown security features running and unknown personnel at the keyboard   For that reason alone it should be suspect and HIPAA only complicate the requirements.  Add in cloud-web apps and you have a hadean nightmare.  HIPAA should never be cloud based.  And I have seen hospitals that use cloud-based patient apps!!!   PRISIM comes to mind and the web version of EYECOM.  No way, ever, should they be used. 
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
55% of SMBs Would Pay Up Post-Ransomware Attack
Dark Reading Staff 4/25/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11538
PUBLISHED: 2019-04-26
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, an NFS problem could allow an authenticated attacker to access the contents of arbitrary files on the affected device.
CVE-2019-11539
PUBLISHED: 2019-04-26
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web...
CVE-2019-11540
PUBLISHED: 2019-04-26
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote attacker can conduct a session hijacking attack.
CVE-2019-11541
PUBLISHED: 2019-04-26
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authentication with the Reuse Existing NC (Pulse) Session option may see authentication leaks.
CVE-2019-11542
PUBLISHED: 2019-04-26
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authentica...