HIPAA Updates Loom as Healthcare Breaches Boom

Summary

The proposed HIPAA Security Rule update would require healthcare organizations to prove, not just document, network visibility, least privilege, an adaptable architecture, and control over third-party access. At ViVE, Zero Networks Field CTO Chris Boehm explains why healthcare is such a lucrative target, what the proposed changes mean for the network, and how automated microsegmentation helped Evercore and Vermeer stop lateral movement without operational impact.

Key takeaways

• Healthcare is a prime target. Hospitals hold identity, payment, and health data in one place, plus valuable research. Chris cites IBM’s average healthcare breach cost at over $7 million.
• The proposed HIPAA changes fall into four buckets. Network visibility, enforced least privilege, an architecture that adapts as the environment changes, and minimized third-party exposure.
• Regulators want proof. Organizations will need to show what’s happening in their environment. Microsegmentation produces the audit trail and can show how much of the environment is isolated, such as 97% or 98%.
• Customers have the results. Evercore passed every pentest after deploying Zero Networks. Vermeer deployed agentlessly across its whole environment in 30 days, with no operational impact on its hardest applications.
• Automated microsegmentation should know, not guess. Zero Networks classifies every asset, builds policies across the network and identity layers, and uses just-in-time MFA for privileged and third-party access, including medical device vendors. One person validates the policies instead of building them.

Speaker: Chris Boehm, Field CTO, Zero Networks

Why is healthcare such a big target?

Chris Boehm: Hi, everyone. My name is Chris Boehm. I am a field CTO here at Zero Networks. Um, a little bit about myself, for those who are joining and who have not met me. Uh, I’ve been in the cybersecurity industry for over fifteen years. I started in state and local government. Um, then I went to a smaller company called Microsoft. I worked there for quite some time. I started on core operating systems, and then I ended in the cybersecurity organization for multiple years. Um, moving forward, I started working for other startup companies, um, including a company called, uh, SentinelOne. Uh, then I went to join this fabulous company of Zero Networks. Now, why is that? There’s multiple things that we’re doing and transforming, and I will dip into that a little bit during this presentation. But the main reason you’re probably here is to learn about how the new HIPAA changes are gonna be impacting, um, your healthcare organizations in its own way. Because there is some new changes around the corner, and I’m gonna highlight those things for you, and expand on why is your networks even being considered during this new evaluation of, uh, the HIPAA improvements, and, uh, what is going on in your industry. So even if you’re not considering Zero Networks, this is just an educational presentation of, um, what you need to be aware of, and how things are changing, and how other companies are looking at, um, the same problem today. It’s not a unique problem to healthcare as a, as in general.

Now, as you’re probably aware, as the presentation is talking about, I’m gonna be talking about some of the, uh, nuances of the healthcare industry. So one of the most common things that you probably are aware of, if you’re not already, is healthcare is one of the most fruitful targets when it comes to gathering collective information. Think about everything that you do when you go to a hospital. If you’re a non-healthcare individual, you have to go there and give them your Social Security number, your credit card information, your healthcare information. You start building this whole profile around you as an individual. And then they have to store that based on HIPAA regulations, um, meeting all the requirements, storing it, containing it. And that’s, that’s exactly why HIPAA is always being brought up, and you have full rights of your own information, and they have to be able to provide that for you. But because of that, there is a lot of fruit when it comes to potential winnings if, for an attacker. That’s sad to say, but it is true. And then there’s the other scope. Healthcare has all something that’s very profitable as research and information in the market as a whole. So think of it as a, hey, I have this cutting-edge technology that this, um, medical center in Los Angeles is developing, and they are the test bed of this. Now they have that fruitful information of what the patient information is doing, how it be— is being analyzed, and it’s a constant process of something healthcare has to fight today, and research facilities as a whole. So on, it is not shocking to me when an IBM states the average healthcare breach is over 7,000,000 on average. And I’ve, I’ve talked to some people that have said that’s, that is a conservative number. It is much higher on the average scale of all businesses as a whole, because it’s loss of trust, information. There’s a lot that goes into it. And not to mention, there’s a lot more fruit for a cybersecurity, uh, individual that, that is hacking — I should say, uh, a hacker is targeting you to gain from them.

Cyber incidents overall is always, um, is always impactful. I mean, think of ransomware going through a whole entire hospital. This is impacting patients. This is impacting healthcare lives, our state. So this is why it’s such a sensitive topic, and it’s always forefront of anyone in the cybersecurity industry when it comes to healthcare as a whole. Um, and unfortunately, this has not been getting any better. It’s constantly growing. Uh, supply chain targets are impacting, um — I mean, healthcare, retail. There’s certain markets that are growing, because they’re noticing that these regulations are slowing them down, or it’s easier to get in and expose them. So unfortunately, some places, just like healthcare, has seen a spike in breaches. And this is all information that has been shared publicly, by the way.

What’s changing in the HIPAA Security Rule?

Chris Boehm: Now, when it comes to where things are shifting and how things are growing with the HIPAA regulations, this is the, this is what I’m trying to call in this presentation: is what has been changing and what is moving forward. So these are all proposed plans. These have not been finalized today. So just for everyone to be aware of. But cybersecurity measures have been now implemented into the HIPAA regulations on, on the horizon. And this is where regulatory pressures are gonna come in. And you’re gonna start feeling, um, can I even meet these new regulations and requirements? And you’re gonna see a trend when it comes to that. And I have that on the next slide for you.

What will regulators expect you to prove?

Chris Boehm: So, for example, where are things going, and what are they looking for? They want you to be able to prove yourself. They want you to be able to evaluate yourself. They want you to be understand what happens in your environment, and can you show it to me? And that is almost the common trend of the implementations that they’re adding is the HIPAA right at this moment in time. I’ve exposed it down to four different buckets for you, just for simple mental mapping, but one of them is, like, controlling visibility and understanding what is happening in your network. Um, are you enforcing the least privilege? Can you visualize it? Can you see what’s happening? Can you challenge it? Are you disabling and enabling? Uh, is the architecture designed for this implementation? Can you add new things in your environment? Does it dynamically change and update appropriately? And then the big one is, of course, minimizing third-party exposure. Every industry has a lot of third-party visibility, impact, access, and even support. So how are you minimizing that, that channel is not being abused? And that’s exactly the key four elements that are being bundled into this new HIPAA Security Rule right now.

Um, I can think of multiple different scenarios how this is mapping in multiple industries. But as a whole, this is a challenge. I mean, you’re dealing with legacy infrastructure, you’re dealing with old code, you’re dealing with a lot of personnel. I remember talking to a hospital. It’s been a few years now. They told me, on average, they added 5,000 new nurses a month. That’s insane. 5,000 new nurses a month. They’re constantly flowing through personnel. It was a, a training facility, and it was a, uh, a school. I think it’s the combination, for those who are like, that’s insane. But they were constantly adding and removing new users all the time. So think of the potential exposures. How are you mapping that? How are you connecting that with others? And then providing that as a dynamic approach through your whole entire business. And that’s exactly, um, what they’re trying to address here in this new HIPAA regulation.

How did Evercore stop lateral movement?

Chris Boehm: So I’m gonna talk about some, like, real-world scenarios that, uh, some of our existing customers have had. And I’ll do the two sides, as you see in this presentation: like, the current challenge, and what they were trying to solve, and the outcomes they got from it. So Evercore is a phenomenal customer. If you’re on the web, you can actually look up — they have a great video and presentation on our website. Um, but they had four, three different main challenges they wanted to address. One of them is, um, they saw no solution when it came to lateral movement. Think of ransomware. Think of, if I had your credentials, how far could I get with it in your environment? If I can gain your access, and get — you gave me your username, password, and I can jump across everything in your network, that’s a little concerning. Like, then an attacker could do the exact same thing. Operational friction, and they had a lot of agents and infrastructure challenges. So those were one of the main challenges that they’re running into, is, hey, every time we tried implementing or doing something like this, it’s, it’s caused too much business friction, or we’ve lost business operations, um, or, uh, it’s just taken almost too much overhead. It’s not worth it. So that was another challenge that they’re running into. And the last one that I have on this slide for you all to envision is the enforcing the consistent, um, least privileged access. Think of zero trust. That’s the terminology that’s typically used in the cybersecurity market. So that has to work across devices, locations, workflows, and, um, they, they had no way to do that today.

So what they looked at is, they looked at, uh, considering us, as Zero Networks. And that’s exactly what we started solving for them, as an automated microsegmentation flow. So we analyze, determine, and provide a fully behavioral analytic approach. Then we provide that zero trust methodology of saying, hey, if you are who you say you are, if you normally access this, then you should access it. But if it’s not something that you typically access, and then you’re not near here often, then we should challenge you. So we’re most— we’re identity-based when it comes to access controls. And then we allow this other thing called just-in-time multifactor authentication that gives, gives them access into things that they need at that time, for those third-party supports, as an example. Um, so we started mitigating most of these, uh, challenges for them. We automated, uh, their least privileged access control. And one of the awesome things they call out is their pentesting that they did — they passed all of them. All of them. They had no issues whatsoever. They, the pentesters couldn’t move on past what they’re used to do, and they couldn’t even find the open holes and patches in their environment. So that was a big win for Evercore.

How did Vermeer secure OT with zero downtime?

Chris Boehm: Vermeer is another one of our customers. I believe they’re on our website as well. I don’t know if they have a video, but they had a similar challenge. They had limited network visibility. Um, so they couldn’t, they didn’t understand — they might, they had merger and acquisitions occurring. Things change, developers change. So they ran into the challenge of, okay, well, what can’t I — I don’t understand everything that’s happening in my environment. Um, they had an OT scenario of, uh, it was just impossible to protect. Just like a hospital, uh, for example. You may have those medical devices that is stuck in a specific firmware that has very limited scope, but has to be open in order to work. And, um, how do you protect that? And then they had the complexity of, of every business. They wanted zero downtime. So they had no tolerance for downtime. And they wouldn’t consider any solution or any alternative unless it was actively working toward with their business, not against their business.

Um, I can say the same win story: they are utilizing us today. But the main things that they are able to do now is, now they have privilege activity on the network layer, then they can do multifactor authentication, that just-in-time I talked about earlier. They were able to do this fully deployed, agentless, across their whole entire environment in thirty days. And that was huge for them. That was a CIO, CSO huge win, and showing, here’s what this product does, here’s the result that came, and I can see the difference between the two. And then the other one is, now they can have that end-to-end visibility. You think of that scenario of that medical device or OT device, um, with IoT devices, and then your other infrastructure in place. Then you’re having it contained in multiple different buckets, and kind of creating these mini DMZs everywhere. Well, they didn’t know what was talking to what. They didn’t know, um, how an access was reaching to which endpoint and which entity. So now they have that visibility. The reason for that is exactly how our product works. And so we work by gaining access and understanding of your environment, providing that visibility scope, and then we then automate the segmentation for you. So that was something that they saw as a huge win, because, one, they can see more what’s happening in their environment. And then, two, they can actually then move forward with future challenges by implementing us again in the future for future learnings. And then what they were pleasantly found out is, they had no operational impact. They challenged us on some of the most difficult applications, or difficult servers they had in place, and they saw no operational impact. So that was a huge win for them.

What should automated microsegmentation do?

Chris Boehm: Now, if you haven’t figured some of this part out, I’m gonna talk about what microsegmentation is doing with automation when it comes to Zero Networks. I would say this should be an industry standard for anybody that’s looking at microsegmentation. Uh, one is understanding. Like I mentioned already, we have to provide a scope and visibility of what’s happening in your environment. Are these OT, or is this IoT? Is this a domain controller? Is this an application database? So on and so forth. Like, this has to be all analyzed and determined, and it can’t be an LLM that’s saying, “I think it’s this.” No. It needs to know it’s this. So you have to provide some automated tagging and grouping and analysis to understand what your product is actually doing. So that is something that we do right off the bat. That’s why we have a learning phase. Then, based on that, we start generating precise, nice — I would say, per, per application, um, layer three, layer four visibility when it comes to what app, what is going on in your environment, even the, the layer five, um, and then building policies and assets around it, including the identity level. So me as a user, what am I doing? What is this application doing on my machine? What is this machine doing? It goes to multiple different layers to say, this is exactly how the rules need to be populated and built for you. And then, uh, the ideal goal in any type of situation — which is, this is very hard for businesses to start accepting, because it’s not the standard practice, um, for years and years now — is doing least privilege access. Um, I don’t know how many conversations I’ve had where a developer or someone’s like, “I just need access into everything in your environment.” Unfortunately, that’s not truly necessary. Like, what are you talking to? What privilege do you need? Uh, what capabilities do you need? So this is all determined based on my learnings of me as a user and what my assets are doing. And then it builds that out, but then allows me to do a privilege elevation, which is our just-in-time access. And that’s a network-layer multifactor authentication request. So if I needed to have access to it, if I had the policy in place for it, then I can approve it if I can prove who I say I am on my phone, for example. And then, of course, um, it has to be a scoping capability when it comes to microsegmentation with automation on any type of level. So this is on-prem, a hybrid cloud, multi-tiered infrastructure, uh, in place.

How does just-in-time access work?

Chris Boehm: Now, kinda showing this — I kind of, I guess, leaked some of this information — is, um, but how are we doing this on a visual level? In case of you, when I started saying layer three, level four, level five, you’re like, what the heck is he talking about? This is exactly what I’m talking about. So, typically, uh, from here, uh, you would see the, uh, scoping of information. Let’s just say you are going in here and saying, I need to have access to Exchange, for example. You would get a multifactor authentication request validating who I say I am. And then typically, after that, you will gain access in everything in your environment when it comes to your applications, your other devices in your environment, um, whatever it is. So that’s where lateral movement takes place, and I have another visual in just a second. Where we take it a different approach is, we contain everything, uh, in the layer five to layer three, uh, network stack. So when it comes to your TCP ports, to application layer, to RDP — think of everything that an attacker, or an administrator — think of it as a different way. What an administrator may be using today, we can just-in-time it at that moment in time. So, for example, let’s just say a developer needs to have access to a database it’s never talked to before. Well, we’ve challenged it. It says, hey, you’re not typically here. This is the normal path for you. We are going to say you need to validate who you say you are, and, and then give that privilege access into there. Then they can have that access into that device. That creates that friction layer, but at the same time, it, it just optimizes that zero trust mental state.

So when it comes to combining identity and segmentation, there’s key things that, um, Gartner has stated in the market, like, what are the, what is really changing within the business itself? Well, there’s a few different things. One is, how is something being enforced granularly? How can you provide scope and visibility with your environment? And how can you prevent vulnerabilities from being abused? So that’s where that lateral movement bucket starts falling into place. Can you prove to me — just like that pentesting example, or if someone had your credentials — how far you can go? Are you — and you’ve evaluated? Now, lateral movement cannot usually be a 100% prevented, or it creates too much friction. Think of it as an example. If I am talking to a, a file share, well, that file share, um, typically has a conversation between me and that file share. But that file share talking to something else is abnormal. That’s where the lateral movement should have been stopped, because that’s an abnormality, should have been challenged right off the bat. But as a friction of me talking to a file share that I commonly talk to — which you could have tons of them — then that’s where the friction, um, should be frictionless, unless something is abnormal. For example, an application talking to a file share, it doesn’t normally do that, so we should challenge it. Is it a normal — is it a, a nameless user, anonymous user, trying to access a file share? That should have been challenged. So there’s multiple things that should have been challenged to the process, lateral movement, uh, when it comes to segmentation.

How does microsegmentation help with compliance?

Chris Boehm: Then there’s the compliance challenges. It’s amazing what visibility you gain when doing this microsegmentation capabilities. As you kind of might have figured out, we have to look at multiple layers of the network stack, identity layer stack, and even application layer, to just the workstation layer. So every entity that you can think of — identity, user, servers — it all, that has to be meshed together, then the network track has been meshed together. So all of a sudden, we have this amazing visibility. And that’s where that visibility key comes in that we were solving for our, one of our customers before. So from there, we then add an audit capability. Everything that gets challenged, authorization, port control — then you have the capability to say, “Hey, mister auditor, this is exactly what is happening to our environment. We can prove it to you, because it’s actually scoped and curated automatically.” Then we can prove that it’s actually strengthening defenses by saying, how far, how much can things be reached? Well, used to be a fully flat network with some VLANs and connections. Well, now I can say 98%, or 97%, of my environment is fully isolated into this bubble. And then we simplify everything when it comes to compliance, because we’ve now passed, passed and hardened a lot of those things. So from a compliance requirements perspective, it starts feeding a lot of those buckets automatically. Think of PCI, HIPAA, uh, now soon, or, um — there’s, there’s the top two of the ones at the top of my mind, but there’s some other ones that are in place that you can leverage, uh, segmentation, audit control, and visibility for.

For network complexities, I kinda already highlighted this earlier. The thing is, things change constantly, and it’s hard to stay on top of it, on understanding all paths, what other people are doing in your business. Um, it’s nice to have something that’s constantly analyzing, learning, providing you scope and visibility, and then providing you an analysis of, hey, why is this open? Why are these things talking to this? So you take a different approach, versus, yeah, this is the reason why someone got on here, is because it would just open anything in our environment.

What does lateral movement look like before and after?

Chris Boehm: So kinda just showing you before and after visual, as I’ve been highlighting a few times in this presentation so far. Um, as you can see, an attacker comes in. I give multiple examples. We’re just using an application. Here’s an example, but you can think of a phishing email. You can think of, they clicked on something malicious. And this is assuming they bypass all your cybersecurity measures. So EDR didn’t see it. Uh, your SIEM tool analysis says, hey, this looks normal, because, you know, it looks like you logged in. Um, everything looks normal. So, um, I’m assuming your security layers in place have been, unfortunately, bypassed. That happens. It happens quite often, unfortunately. Now they’ve gotten into your environment. So typically, from that approach, they’re doing exactly what this is — you know, this is visual. They are on your machine, then they access another machine, then that machine accesses another machine, and then they just start spreading until they find something that’s very valuable, like your domain controller, or, uh, your research, or your critical information that, hey, if they brought this down, all of a sudden, it’s gonna create some pain, which then I could potentially make some money from, uh, which is where ransomware comes in often. And they get cyber insurance involved, and then it has other challenges that you’re probably aware of.

So what it’s being done on a microsegmentation level is, hey, I, as a user — as on the left side, as an example — someone got onto my machine, was accessing it, and then they tried accessing another machine. Well, maybe that is standard. Maybe that is not standard. I don’t, I don’t know. If it is standard — I typically talk to this machine — they might have gained access to that. But because the other communication is not standard, or this application layer is not standard, then it gets blocked and contained and hardened, because we’re gonna challenge that attacker, like, hey, even though you’re faking or acting like this user, it’s not normal. It’s not, it’s common. Actually, this shouldn’t be a lot at all. And that’s when the door slams right in their face and says, uh, are you really who you say you are? Because we’re, the, the port’s closed. There’s nothing they can do right now.

What is Zero Networks?

Chris Boehm: So what is Zero Networks? I have been highlighting and scoot-scooting around it the whole entire time. Uh, there’s a few, few different main things that I wanna highlight. One of the key things is microsegmentation. That is exactly what I’ve been talking about this whole entire time. So that’s for servers, clients, OTs, IaaS, PaaS. Think of everything in your environment, um, when it comes to connectivity and understanding of scope. How can you harden it and make each asset its own bubble? And that’s exactly what’s kind of being visualized here. So everything has its own protective bubble around it. That’s the micro part of segmentation. Then we do the identity layer. So I mentioned this a little bit. We learn and assess: hey, is this a service account? Is this an administrative account? Is it over-privileged? Does it do the wrong things? Uh, is it accessing too much in your environment? It’ll show you this full path and visualization of what these accounts are doing, tag it, asset it, and then you can understand, oh, interesting, I have, um, an AI service account that’s talking to everything in my environment. Well, if that was taken over, or something was being abused inappropriately, then they would have access to everything in my environment. So that’s where it kinda sets that approach, and we provide the identity control measures for you. Um, and the same can go for an administrator. Administrator should have access. They should do their job, but they should be challenged at a point where it shouldn’t be abused.

And then we have remote access capabilities and third-party access. So think of a contractor coming in. They need to have access to a point-of-sale system, or a medical device in your scenario, and they need to do a firmware update. Well, they joined your network. They have unauthorized credentials from you, but they never talked to this. So are they really who they say they are? Are they doing what they’re supposed to do? This is a great example. So we can allow them to gain access into that medical device as a just-in-time, with that validation. It opens up that port for that medical device, and then they can do their whatever they need to do during that period of time with policy management, and then it closes it. This could be done through automated system ticketing, to approvals, to whatever process you wanna put in place. That’s just a great example. Then, of course, remote users, and there’s a few other scenarios when it comes to remote access, or, uh, our zero trust network access.

Why has microsegmentation been so hard?

Chris Boehm: Now, as you might have determined from my earlier statements, uh, we are trying to make things simpler. Um, so what that means is, instead of it taking years — uh, unfortunately, a lot of this time — microsegmentation is not new. It’s been around for — I, I think I was just corrected the other day — about twenty years now. Uh, almost twenty years. It’s, I think, uh, 2007 when microsegmentation was just being really talked about. Well, the implementation process has been, unfortunately, not the smoothest in the market. Uh, you have typically consulting hours, then you have, uh, products that analyze your network, and then you have to enforce it, then you install agents, and then it becomes this huge nightmare and experience. Even with some automation in place, it still is not smooth and easy to understand when it comes to network traffic and hardening. Or you implement it and it’s too hardened, and all of a sudden you’re like, this is just not worth it for my business. It’s literally preventing us from making money. So there’s been a lot of burn stories when it comes to microsegmentation, and it’s, it’s just an industry standard, unfortunately.

That’s where Zero Networks is coming in to shift it. Uh, we are fully automated. We learn. We provide, uh, that asset and for inventory management of understanding your environment. We have time requirements, because we have to learn your business. It takes thirty days, is what my recommendation — could be sixty, ninety, whatever you want in place. But because of that, we can deploy very quickly. And then, while we still need a full-time employee to maintain this, we just need someone to validate what is being done appropriately. We don’t know your business. We have to have someone to say, “Yeah, this is actually what it’s supposed to be done. I want to open up these ports.” Or, “Why is it accessing 180 devices in my environment? That makes no sense. Like, it shouldn’t be doing that.” That’s where the human deterministic comes in. So we need someone to go in there and validate. Now, you can have it automatically just patch it and do whatever you want it to do. But usually there’s that, um, ticket management, change control, those other things that need to be put into place. That’s exactly where this FTE comes in. So we need someone to go in there and maintain it and update it, um, and evaluate it when necessary, because it is learning based on your network.

Um, with that said, I appreciate everyone joining this presentation. Hopefully, you learned a little bit something about the HIPAA regulations. I encourage you to go look it up online. It is a wonderful read. Um, it’s something I got to enjoy myself a few times. So if you have any questions, please feel free to reach out to me, or reach out to the Zero Networks team.