If there’s a single IT security strategy that nearly all patient care organizations have implemented at least in part, it’s network segmentation—the purposeful separation of elements of an organization’s information technology network in order to enhance IT security. Yet at the same time, this is an area in which, industry experts say, there is also a vast lack of understanding of the underlying principles and strategies needed to make network segmentation actually help facilitate greater security, in practice.
And of course, the challenges facing the IT leaders of patient care organizations are also facing IT leaders in every type of business organization, in every industry. John Friedman, a managing consultant at the CyberEdge Group consulting firm, puts it this way in his recent white paper, “The Definitive Guide To Micro-Segmentation,” published last year by Illumio, a Sunnyvale, Calif.-based cloud computing security solutions provider: “We can no longer rely on perimeter defenses to keep the bad guys out, and are not doing so well catching them inside the data center either.
Most IT security professionals are familiar with frameworks such as Lockheed Martin’s Cyber Kill Chain,” Friedman notes. But, he says, “Statistics show that it is extremely difficult to reduce the 'dwell time' of attackers once they have a foothold inside the data center. Virtualization and cloud technology exacerbate this challenge. It is hard to protect applications that can be executing anywhere, with pieces being moved around continually. In this environment, limiting lateral movement within the data center becomes a top priority for IT groups. If a cybercriminal compromises the credentials of an employee who uses application A, can we make sure he can’t reach applications B, C, and D? If a hacker uncovers the password of a system administrator in location X, can we make sure she has no way to connect to systems in locations Y and Z?” That remains a fundamental IT security challenge in healthcare.
“This is very difficult work,” confirms Fernando Blanco, CISO at the 60-plus-hospital CHRISTUS Health, which is based in Irving, Texas, and operates across the United States, as well as in Mexico, Colombia, and Chile. “We started a couple of years ago on the journey, and basically, we work on a risk basis. Implementing segmentation adds complexities to the network,” Blanco adds. “It’s necessary, but introduces hardships to the users and to the network team. So we decided to start small, determining the key applications we most needed to protect. We started with a list of about 20 applications, and ended up with about 15 key applications, including our EHR”—electronic health record—“and have segmented those,” beginning with the EHR, three years ago. Blanco and his colleagues are currently focused on PCI (payment card industry) applications, as well as the applications connected to the delivery of care to military veterans.
“When I think about segmentation, it’s [about] data sensitivity, locality, and location,” says Chris Convey, vice president, IT risk management and CISO, at Sharp Healthcare in San Diego. “There’s an art and a science to it. Groups of IoT elements should probably be segmented off; medical devices should probably be segmented off. We’re looking at micro-segmentation. [In the manual network segmentation world], “[Y]ou have to go out and configure every switch and router, but now you can use logical networking, and software-based networking, and that’s where the industry’s going,” he went on. “And micro-segmentation is where things need to go. Because patching medical devices is a constant headache. So the logical choice is network segmentation and micro-segmentation.”
Meanwhile, in Florida, Thien Lam, vice president and CISO at the 14-hospital Clearwater-based BayCare Health System, reports that “In terms of network segmentation, we’ve created a separate network for the medical devices, so that the medical devices don’t talk directly to the production network; they have their own VLAN (virtual local area network). Also, we have devices that we put in front of the medical devices—they’re like a mini-firewall, to make sure the medical devices aren’t vulnerable to an attack. The issue,” Lam notes, “is that the manufacturers themselves—most of the time, they don’t provide patches. They’ll ask you to upgrade a device or replace an old one, but that can cost millions of dollars. So with regard to network segmentation, we want to make sure that we put the medical devices on a VLAN, so that they can’t talk directly to the Internet. At the same time, we micro-segment them by putting a mini-firewall in front of each medical device, and we’ve also locked a USB port on the device.”
More broadly, he says, “We have a plan moving forward that we’re in the process of executing on. Most of us have had flat networks, where everything can talk to everything—your network at home, your car, everything—we’ve spent 20 years creating that connectivity. Now, with all the incidents taking place, it’s clear that that’s no longer a good idea. So now we have to look at this from a role-based standpoint. What we’re planning to do is that we’re going to segment by facility. So if there is an infection within one facility, we want to isolate that facility from the rest of the network, so that the malware or ransomware can’t spread.”
A Sea Change of Epic Proportions
Blanco and fellow healthcare IT leaders across the U.S. are in the middle of a sea change in this area. What’s pushing it? Well, fundamentally, of course, it’s the acceleration of cyber threats against data and IT security in healthcare.
John Robinson, a senior advisor with the Naperville, Ill.-based Impact Advisors consulting firm, puts it this way: “From a senior management perspective, the biggest issues are, firstly, nobody’s really clear what it is. There are so many variations on the theme,” the North Ridgeville, Ohio-based Robinson says. “There’s network segmentation, micro-segmentation, security segmentation, network partitioning. It’s a million names for essentially the same thing.” Among those terms, he says, “The most understood, and the one that has the potential to become the standard term here, is micro-segmentation. But it’s a misnomer. It’s what I would call tentacle segmentation, really. Micro-segmentation has a nice ring to it. What that really is, is a technical approach that makes network security more flexible, by applying software-defined policies, rather than manual configuration.”
Meanwhile, in terms of how the IT security professionals in patient care organizations are doing network segmentation, Robinson says, “The vast majority of healthcare organizations are still back in the manual configuration phase, trying to address rapidly evolving threat vectors with a manual methodology that just can’t keep up. You can’t type fast enough, basically, to do manual configuration in order to keep up with the threat vectors that are accelerating on a daily basis.”
The new wave in this area? Software configuration. “Creating a software-defined network,” Robinson says, “allows you to apply policies, processes, and procedural rules to the traffic and data on the network itself, as opposed to manual configuration, where you are still manipulating software, but where you’re still essentially twisting wires. So this is not something that’s an alternative to manual configuration. You still need to electronically twist the wires, as it were, to keep your basic physical infrastructure chugging along, but you apply software definitions to that network so that you’re looking not at physical attributes of connectivity, but at the data flowing across that physical infrastructure, and applying polices and rules to that data, to make sure it goes where you want it to go, and doesn’t go where you don’t want it to go.”
A key difference between software-configured and manually-configured network segmentation? “You can start with, 'I’m not going to let anybody in,' and then loosen from there, whereas with the physical configuration, you’re starting off allowing everyone to connect,” Robinson notes.
Thinking About How to Protect Data
Another element that is connected to, though distinct from, network segmentation itself, is that of processes around data risk analysis or assessment, and auditing. Many patient care organization leaders are in fact quite unaware of what kinds of data they have, and where those different kinds of data reside—which is why network segmentation without analytical processes can end up being flawed, says Stephanie Crabb, co-founder and principal in the Panama City, Fla.-based Immersive consulting firm. “Looking at this from a data lens—the data we’re creating, saving, and moving—we need to move towards more data-centric types of audit and protection philosophies and approaches,” Crabb says.
And what does that mean in practice? “Let’s look at the OCR,” Crabb says, referring to the Office of Civil Rights within the Department of Health and Human Services, “and at the OCR’s enforcement and activities. One of the first things that the OCR has identified, and why they haven’t encountered a single organization doing risk analysis/assessment to their standard, is that many organizations simply have not gone about the work of identifying their ePHI [electronic protected health information], where it lives in their organization, where it flows, and what’s done with it. The simple fact is that most organizations simply do not have a good handle on what sensitive data they possess, what ePHI they have, where it lives, and where it goes.”
What’s more, Crabb says, “The false sense of security from network segmentation or defense in depth is that it says, we have a good handle on structured data, and we can put that inside a structured environment, with defense in depth. But without knowing what we have, we may have a very false sense of security, based on how we’ve architected that defense in depth, that is blind to other types of sensitive data—for example, contract performance data with our payers. We’re constantly looking at our performance to contract, especially in risk contracts. And as we pull that analysis together to do population health, etc., those things are typically packages that don’t live inside databases.” The fact is that a huge amount of ePHI lives outside the EHR, she points out. “There are many types of data way outside the EHR, in fact. But without classifying those things and knowing where they live, we may not have adequate protections, and some of these highly valued, highly sensitive assets may have almost no protections around them at all.”
On a practical level, Crabb says, “For example, it’s not uncommon for smaller organizations to email packages of information to board members in advance of board meetings. They’ll often email those board packets to board members’ personal email accounts. Now, we may have a highly secure email drive around our four walls. There, our defense in depth and network segmentation may work for us. But if the data is delivered to a highly insecure location, that’s where all that sound infrastructure in segmentation, is great, but our walls, our perimeter, are not what it used to be. So if we perform that discovery, and classify those data and information aspects, that allows us to determine whether our network segmentation model or defense in depth model, really protects our sensitive data or not. And when we discover data that lies outside those parameters of protection, we can remediate those weaknesses.”
In his white paper, Friedman recommends that IT security leaders take a granular approach to network segmentation, leveraging what he calls “dynamic segmentation: techniques, three in particular. “Abstraction is the ability to express security policies in terms of application concepts (such as web, application, and database tiers) rather than in terms of network constructs (such as IP addresses, subnets, and VLANs),” he writes. “Intelligence is the ability to detect when changes are made to applications or the infrastructure, and then reconfigure policies to adjust for the changes.” And, he says, “Automation is the ability to rapidly deploy new and revised security policies to monitoring and enforcement points, without human intervention. Depending on the implementation, micro-segmentation can increase your adaptiveness in other ways as well, such as helping provide consistent security across data centers and cloud platforms,” he writes. “It addresses the challenge of stopping lateral movement by dividing IT environments into controllable compartments. It makes security dynamic by allowing security rules to be expressed in terms of application concepts, and reconfigured automatically when applications and infrastructure components change.”
How rapidly will dynamic segmentation/micro-segmentation strategies come to be applied in patient care organizations? Probably not super-quickly, given all the prioritization challenges. But all those interviewed for this article agree—the time is ripe to move towards more advanced network segmentation strategies, at a time of accelerating threat vectors.
