HyTrust Heals Healthcare

Transcription

1 HyTrust Heals Healthcare Challenges and Solu<ons to Security and Compliance in the Healthcare Industry Eric Chiu, Founder and President 2016 HyTrust, Inc. 1

2 Who is HyTrust? HyTrust Workload Security solu<ons mi<gates the security and opera<onal risks that organiza<ons face when pursuing cloud and virtualiza<on data center transforma<on Founded in 2007 Extensive virtualiza<on and cloud security exper<se 12 granted and pending patents Acquired HighCloud Security in HyTrust, Inc. 2

3 How Bad is Security in Healthcare? How many breached: 91% of Healthcare Orgs suffered data breach in past two years Who discovered the breach: 69% of the <me auditor 30% of the <me pa<ent 23% of the <me - accidentally Breaches occur because: 70% of orgs say employee negligence 26% of orgs say malicious insiders Figure 25. Trends in data breach incidents 50% 40% 30% 45% 46% 40% 38% 39% 36% 33% 33% 31% 29% 26% And it hurts! 20% 10% 0% Yes, more than 5 breaches 16% 16% 17% 12% 9% 10% 6% Yes, 2 to 5 breaches Yes, 1 breaches No 4% 14% $2.1M / data breach CE 2015 FY 2013 FY 2012 FY 2011 FY HyTrust, Inc. 3

4 Trends Driving Security Changes for Healthcare Technology ShiOs Threat Landscape ShiOs Key regula<ons remain same, but added complexity of cloud usage Cloud also introduces more supply chain obliga<on (via Business Associates) Buying decisions for server and network compute can be made solely by IT now (without every group having a review) Roles overlap (SDDC/NSX) crea<ng process confusion Admin in virtual environment has more impact with each ac<on Value of healthcare records is highest for black market ($470/record vs $1 or less for credit card data) leading to more frequent aeempts at breaches (internal or external) Note black market rate for EHR has increased 10x in just 3 years! From 2013 to 2014 alone healthcare related companies saw a 72% increase in cyber aeacks (internal or external) 2016 HyTrust, Inc. 4

5 What Keeps Healthcare CISOs Up At Night? Employee negligence 70% Cyber aeackers 40% Use of public cloud services 33% Mobile device insecurity 32% Employee-owned mobile devices or BYOD 29% Malicious insiders 26% Iden<ty thieves 19% Process failures 15% System failures 15% Insecure mobile apps (ehealth) 13% Insecure medical devices 6% Other 2% 0% 10% 20% 30% 40% 50% 60% 70% 80% Marked items show areas HyTrust can address immediately! 2016 HyTrust, Inc. 5

6 Best PracWces Regulatory Requirement HyTrust Visibility HIPAA (Audit/Logging Controls) Admin logs, compliance logs, compliance/security % met Audit HIPAA (Audit/Logging Controls) Admins AutomaWc Enforcement HIPAA (Access Mgmt/Data Protec<on)/HITECH HyTrust Boundary Control VirtualizaWon specific HIPAA (Access Mgmt/Data Protec<on) HyTrust DataControl/Policies Run-Wme HIPAA (Data Protec<on)/HITECH (Safe Harbor) Run-<me encryp<on and re-keying (no down<me/reboots) How Does HyTrust Cure Headaches from Security/ Compliance Requirements? Detailed protecwon Extend coverage Support offshore/ contractors Performance HIPAA (Data Protec<on) HIPAA (Access Mgmt) HIPAA (Business Associates/Access Mgmt)/HITECH HIPAA (Data Protec<on)/HITECH 28 templates with automa<c hardening Fine grained policy controls and extended/customizable RBACs; APIs RBACs, HyTrust Boundary Control (defined by datacenter or geography) Very fast and transparent controls and encryp<on; ac<ve-ac<ve configura<ons 2016 HyTrust, Inc. 6

7 Thank you 2016 HyTrust, Inc. 7

8 Don t Break Your Back! Heaving Lioing? Already done. (HyTrust/ HIPAA Mapping) 2016 HyTrust, Inc. 8

9 HyTrust Workload Security Journey HyTrust CloudControl HyTrust BoundaryControl HyTrust DataControl Protect server virtualiza<on Workload encryp<on Mul<-cloud 01 Private cloud 02 Pubic cloud 03 Sooware-defined boundary Secure mul<-tenancy IaaS migra<on Data sovereignty 2016 HyTrust, Inc. 9

10 HyTrust CloudControl Who Log Viewer* Unified Access Role Permissions Assessment Tool* What Role-based access control (RBAC) Workload/SMART tagging Workflow escala<ons/secondary approvals 30+ preconfigured roles HyTrust CloudControl Capabili<es Strong two-factor authen<ca<on How Integrates with Ac<ve Directory, RSA SecureID, CA ArcotID, RADIUS and TACACS+, Smart Cards (PKI) Root password vaul<ng Forensic level logs Real-<me alerts for sensi<ve or abnormal ac<ons Built-in integra<on to SIEM tools (HP ArcSight, Splunk, RSA EnVision, McAfee epolicy Orchestrator Why *Coming in future releases 2016 HyTrust, Inc. 10

11 HyTrust DataControl HTDC protects data everywhere On-premises and cloud ready across all major cloud providers Hyper-Convergence ready built into Nutanix, Simplvity, others Storage ready including SSD technology HTDC provides easy management Scalable, zero down<me re-key management and encryp<on Single interface regardless of where the workload runs Pre-integrated to KMIP client/server for easy extensibility HTDC provides deep protecwon Workload protec<on from boot to data with complete stack protec<on Portable policy travels with workload to ensure always on protec<on Connects with HyTrust BoundaryControl and HyTrust CloudControl for automated and workflow oriented security Key Control the key manager that ensures enforcement of policy via key management Workload Workload Policy Agent <es policy to workload and executes encryp<on and decryp<on Admins OrchestraWon HyTrust Key Control and Policy Engine Hypervisor Policy Engine ensure appropriate controls with context Hardware 2016 HyTrust, Inc. 11

12 2016 HyTrust, Inc. 12