Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Top VM Reports for Healthcare

Post by Morey Haber February 24, 2011

Every few weeks, I find myself on the road visiting clients, working at tradeshows, and reviewing the latest solutions in security. eEye’s solutions touch almost every vertical market and some of them recognize the need for better vulnerability assessment solutions and reporting over others. When I visit clients in the Healthcare industry, I find a level of maturity only equaled to by the Payment Card Industry and government entities.

Other verticals still have not fully embraced the need for vulnerability assessment. Within the solutions eEye has for the Healthcare industry, one of the most powerful is Retina Insight. The data from Retina Insight allows the Healthcare industry to display trending and granular reports on HIPAA compliance in relationship to Administrative and Technical Safeguards. This is priceless information for Healthcare management to identify whether processes for IT security are being maintained correctly month after month and that PHI is secure.

The sample report below illustrates this. From July to December, the IT assets in this sample are getting worse and have exposure for sections 164.312 and 164.308. Only in January, did internal processes remediate some of the faults and recover some ground, but clearly not enough to completely mitigate the risks compared to July.

For the IT manager, this trend represents an unacceptable risk. Understanding how these risks map to vulnerabilities and HIPAA compliance is crucial. In addition, the age of these vulnerabilities documents for the IT manager how well his internal processes are identifying the risks and remediating the vulnerabilities. Each regulation 164.x sub section is mapped to individual vulnerabilities identified by the Retina vulnerability assessment scan engine. Subsequent scans continue to identify the IT security vulnerability until they are no longer present in the environment. This provides the month over month graph that allows any health care organization to measure how well they are doing against the current regulations. It also provides the details that an auditor would like to see – specifically how PHI is being managed from modern IT security threats. This type of analytics goes far beyond simple bar charts and allows IT executives to explore aging vulnerability assessment trending charts and new vulnerability trends in a single glance with full drill down capabilities.

The security engineer can then use a standard vulnerability report to remediate the vulnerabilities and make sure the highest risk assets are mitigated first.  Below is a sample of this technical report which is available as a drill down report from any of the high level HIPAA reports. It highlights an individual vulnerability which would be linked to asset(s) and compliance controls.

Finally, the entire security team can evaluate the technology they have implemented and the new vulnerabilities published by month. Again, as illustrated above, a large quantity of new vulnerabilities where discovered between July and December. These were automatically added to the scan engine via an auto-update process, allowing for a vulnerability assessment to occur using the most recent signatures possible. A health care organization’s internal processes must be able to accommodate these spikes in new VA announcements and remediate them in a timely fashion in order to maintain compliance. Obviously, one technology over another will have more vulnerabilities than the other (and eEye reports can illustrate this) and would require a larger mitigation effort. Organizations can evaluate the amount of time and money spent mitigating these risk verses choosing another technology that is more secure and poses less risk to the business. Using comprehensive business analytics allows this type of decision, and many others to be a mouse click away from security and IT healthcare professionals.

Overall, eEye solutions can assist almost any vertical with regulatory compliance. The healthcare industry can benefit from vulnerability assessment mapped directly to regulations and eEye’s Retina family of solutions can do this seamlessly to meet your business requirements. For more information on how eEye can help your business, click here or here to have someone contact you.

Leave a Reply

Additional articles


Getting More Value from QualysGuard Vulnerability Data with BeyondInsight v5.1

If your vulnerability assessment scans can’t produce meaningful and actionable reports, performing a scan does no good for anyone. If you’ve read my other blog posts, you know I have no qualms about stating that BeyondTrust provides the best vulnerability reporting in the industry. Ask your favorite analyst and they’ll tend to agree. Of course,…

Post by Morey Haber April 18, 2014
, , , , , , , ,

Mitigating Inside Threats to U.S. Federal IT Environments

Recent high-profile cases have increased the perceived risks that go along with disclosure and usage of confidential information. One of the most difficult security threats to mitigate is an attack from the inside. When an over-privileged user, such as an unhappy current or former employee, contractor, or consultant, begins navigating your network, how will you…

Post by BeyondTrust Software April 17, 2014
, , , , ,

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
, , , , ,