Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Top VM Reports for Healthcare

Posted February 24, 2011    Morey Haber

Every few weeks, I find myself on the road visiting clients, working at tradeshows, and reviewing the latest solutions in security. eEye’s solutions touch almost every vertical market and some of them recognize the need for better vulnerability assessment solutions and reporting over others. When I visit clients in the Healthcare industry, I find a level of maturity only equaled to by the Payment Card Industry and government entities.

Other verticals still have not fully embraced the need for vulnerability assessment. Within the solutions eEye has for the Healthcare industry, one of the most powerful is Retina Insight. The data from Retina Insight allows the Healthcare industry to display trending and granular reports on HIPAA compliance in relationship to Administrative and Technical Safeguards. This is priceless information for Healthcare management to identify whether processes for IT security are being maintained correctly month after month and that PHI is secure.

The sample report below illustrates this. From July to December, the IT assets in this sample are getting worse and have exposure for sections 164.312 and 164.308. Only in January, did internal processes remediate some of the faults and recover some ground, but clearly not enough to completely mitigate the risks compared to July.

For the IT manager, this trend represents an unacceptable risk. Understanding how these risks map to vulnerabilities and HIPAA compliance is crucial. In addition, the age of these vulnerabilities documents for the IT manager how well his internal processes are identifying the risks and remediating the vulnerabilities. Each regulation 164.x sub section is mapped to individual vulnerabilities identified by the Retina vulnerability assessment scan engine. Subsequent scans continue to identify the IT security vulnerability until they are no longer present in the environment. This provides the month over month graph that allows any health care organization to measure how well they are doing against the current regulations. It also provides the details that an auditor would like to see – specifically how PHI is being managed from modern IT security threats. This type of analytics goes far beyond simple bar charts and allows IT executives to explore aging vulnerability assessment trending charts and new vulnerability trends in a single glance with full drill down capabilities.

The security engineer can then use a standard vulnerability report to remediate the vulnerabilities and make sure the highest risk assets are mitigated first.  Below is a sample of this technical report which is available as a drill down report from any of the high level HIPAA reports. It highlights an individual vulnerability which would be linked to asset(s) and compliance controls.

Finally, the entire security team can evaluate the technology they have implemented and the new vulnerabilities published by month. Again, as illustrated above, a large quantity of new vulnerabilities where discovered between July and December. These were automatically added to the scan engine via an auto-update process, allowing for a vulnerability assessment to occur using the most recent signatures possible. A health care organization’s internal processes must be able to accommodate these spikes in new VA announcements and remediate them in a timely fashion in order to maintain compliance. Obviously, one technology over another will have more vulnerabilities than the other (and eEye reports can illustrate this) and would require a larger mitigation effort. Organizations can evaluate the amount of time and money spent mitigating these risk verses choosing another technology that is more secure and poses less risk to the business. Using comprehensive business analytics allows this type of decision, and many others to be a mouse click away from security and IT healthcare professionals.

Overall, eEye solutions can assist almost any vertical with regulatory compliance. The healthcare industry can benefit from vulnerability assessment mapped directly to regulations and eEye’s Retina family of solutions can do this seamlessly to meet your business requirements. For more information on how eEye can help your business, click here or here to have someone contact you.

Leave a Reply

Additional articles

Dark Reading

2014: The Year of Privilege Vulnerabilities

Posted December 18, 2014    Chris Burd

Of the 30 critical-rated Microsoft Security Bulletins this year, 24 involved vulnerabilities where the age-old best practice of “least privilege” could limit the impact of malware and raise the bar of difficulty for attackers.

, , , , ,

Looking back on information security in 2014

Posted December 16, 2014    Dave Shackleford

Dave Shackleford is a SANS Instructor and founder of Voodoo Security. Join Dave for a closer look at the year in security, and learn what you can do to prepare for 2015, with this upcoming webinar. 2014 has been one heck of an insane year for information security professionals. To start with, we’ve been forced…

, ,

December 2014 Patch Tuesday

Posted December 9, 2014    BeyondTrust Research Team

This month marks the final Patch Tuesday of 2014. Most of what is being patched this month includes Internet Explorer, Exchange, Office, etc… and continues a trend of the greatest hits collection of commonly attacked Microsoft software. Probably the one thing that broke the mold this month is that for once there is not some…