BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Top VM Reports for Healthcare

Posted February 24, 2011    Morey Haber

Every few weeks, I find myself on the road visiting clients, working at tradeshows, and reviewing the latest solutions in security. eEye’s solutions touch almost every vertical market and some of them recognize the need for better vulnerability assessment solutions and reporting over others. When I visit clients in the Healthcare industry, I find a level of maturity only equaled to by the Payment Card Industry and government entities.

Other verticals still have not fully embraced the need for vulnerability assessment. Within the solutions eEye has for the Healthcare industry, one of the most powerful is Retina Insight. The data from Retina Insight allows the Healthcare industry to display trending and granular reports on HIPAA compliance in relationship to Administrative and Technical Safeguards. This is priceless information for Healthcare management to identify whether processes for IT security are being maintained correctly month after month and that PHI is secure.

The sample report below illustrates this. From July to December, the IT assets in this sample are getting worse and have exposure for sections 164.312 and 164.308. Only in January, did internal processes remediate some of the faults and recover some ground, but clearly not enough to completely mitigate the risks compared to July.

For the IT manager, this trend represents an unacceptable risk. Understanding how these risks map to vulnerabilities and HIPAA compliance is crucial. In addition, the age of these vulnerabilities documents for the IT manager how well his internal processes are identifying the risks and remediating the vulnerabilities. Each regulation 164.x sub section is mapped to individual vulnerabilities identified by the Retina vulnerability assessment scan engine. Subsequent scans continue to identify the IT security vulnerability until they are no longer present in the environment. This provides the month over month graph that allows any health care organization to measure how well they are doing against the current regulations. It also provides the details that an auditor would like to see – specifically how PHI is being managed from modern IT security threats. This type of analytics goes far beyond simple bar charts and allows IT executives to explore aging vulnerability assessment trending charts and new vulnerability trends in a single glance with full drill down capabilities.

The security engineer can then use a standard vulnerability report to remediate the vulnerabilities and make sure the highest risk assets are mitigated first.  Below is a sample of this technical report which is available as a drill down report from any of the high level HIPAA reports. It highlights an individual vulnerability which would be linked to asset(s) and compliance controls.

Finally, the entire security team can evaluate the technology they have implemented and the new vulnerabilities published by month. Again, as illustrated above, a large quantity of new vulnerabilities where discovered between July and December. These were automatically added to the scan engine via an auto-update process, allowing for a vulnerability assessment to occur using the most recent signatures possible. A health care organization’s internal processes must be able to accommodate these spikes in new VA announcements and remediate them in a timely fashion in order to maintain compliance. Obviously, one technology over another will have more vulnerabilities than the other (and eEye reports can illustrate this) and would require a larger mitigation effort. Organizations can evaluate the amount of time and money spent mitigating these risk verses choosing another technology that is more secure and poses less risk to the business. Using comprehensive business analytics allows this type of decision, and many others to be a mouse click away from security and IT healthcare professionals.

Overall, eEye solutions can assist almost any vertical with regulatory compliance. The healthcare industry can benefit from vulnerability assessment mapped directly to regulations and eEye’s Retina family of solutions can do this seamlessly to meet your business requirements. For more information on how eEye can help your business, click here or here to have someone contact you.

Leave a Reply

Additional articles

pbps-customer-campaign-image

You Change Your Oil Regularly; Why Not Your Passwords?

Posted September 11, 2014    Chris Burd

There are many things in life that get changed regularly:  your car oil, toothbrush and hopefully, your bed sheets.  It’s rare that you give these things much thought – even when you forget to change them. But what if you’re forgetting something that can cost you millions of dollars if left unchanged for long periods…

Tags:
, , ,

On-Demand Webcast: The Little JPEG that Could (Hack Your Organization) with Marcus Murray

Posted September 10, 2014    Chris Burd

IT security has come a long way, but every once in a while you see something that makes you think otherwise. Every day, internal and external hackers breach and traverse “secure” environments, making you wonder just how easy it is for attackers to completely compromise your network. In a new on-demand BeyondTrust webcast, Marcus Murray,…

Tags:
, , , , ,

Retina Vulnerability Audits – September 2014 Patch Tuesday

Posted September 9, 2014    BeyondTrust Research Team

The following is a list of Retina vulnerability audits for this September 2014 Patch Tuesday: MS14-052 – Cumulative Security Update for Internet Explorer (2977629) 35141 – Microsoft Cumulative Security Update for Internet Explorer (2977629) 35142 – Microsoft Cumulative Security Update for Internet Explorer (2977629) – IE8/2003 35143 – Microsoft Cumulative Security Update for Internet Explorer (2977629) – IE8…