Tag Archive for: RedSeal

Why Visualizing the Entire Healthcare Attack Surface Is Critical

/by

In recent years, the healthcare sector has been steadily adopting web and cloud-based technologies and shifting towards an internet-enabled system to improve quality of care.

However, along with the limitless benefits that the internet offers — like sharing information, simplifying operational processes, tracking workflows, enhancing connectivity, and storing and organizing data — is an increased risk of cyberattacks, data breaches, and other types of fraud. This makes hospitals and healthcare organizations increasingly vulnerable to advanced threats and targeted attacks.

According to recent reports, data breaches in the healthcare sector have been rising at an alarming rate for the last five years. In 2020, during the COVID-19 pandemic, email-based attacks increased by 42%, so it’s no wonder that more and more healthcare organizations are adopting a robust, multi-faceted strategy to improve their security posture. Hospitals’ expanding digital footprint also complicates their network infrastructures, making complete visibility into the entire attack surface extremely essential to managing cyber risks effectively.

Expanding Healthcare Attack Surface Risks

The widespread use of wireless technology is undoubtedly beneficial to the healthcare system. Wireless technology enables healthcare IT infrastructures to run data center servers, medical equipment, tools and applications, and other devices like smartphones, tablets, and USB drives. Organizations stay connected to deliver effective operations and consistently informed care.

These connected devices help in patient monitoring, medication management, workflow administration, and other healthcare needs. However, the increased number of devices connecting to the network also broadens the attack surface — meaning more entry points for unauthorized access and therefore the need for enhanced infrastructure visibility to mitigate risks.

Why Complete Visualization Is Essential

From booking an appointment to setting foot in the doctor’s clinic or hospital, patients go through several processes and interact with different interconnected devices and software systems. While a connected environment ensures a seamless patient experience, the different touch points provide more opportunities for attackers to gain access to sensitive data.

Currently, there are 430 million linked medical devices deployed globally, connected through Wi-Fi, Bluetooth, and radio transmission. The sheer amount of sensitive and personal information healthcare systems capture and process is why their systems are desirable targets. Therefore, it is critical to safeguard the data stored in these systems.

Protected health information (PHI), such as credit card and bank account numbers, and personal identification information (PII), such as social security numbers, are data cybercriminals find particularly alluring. Selling this sensitive information on the dark web is a very profitable business.

Even just a small part of the healthcare technology spectrum may lead to the greatest cybersecurity gaps, allowing criminals to exploit vulnerabilities and gain access to sensitive data. The resulting cyber crimes directly impact organizational productivity and brand reputation.

Here are a few risks that are most detrimental to healthcare businesses’ bottom lines and reputations.

  • Ransomware: Healthcare services are notably vulnerable to ransomware attacks because they depend on technology to a significant extent, considering the nature of their day-to-day operations. Health records are highly rewarding for criminals because each patient, hospital, or confidential record can command a hefty price in the underground market.
  • Phishing: Phishing attacks are quite common in healthcare. Attackers target the most vulnerable link in the security chain, i.e., people, to make their jobs easier. Through social engineering, users click on malicious attachments or links, thereby infecting their systems and losing access. The repercussions can be disastrous and the losses unimaginable. For instance, a Georgia diagnostics laboratory recently discovered that an employee’s compromised email account led to a phishing attack, impacting 244,850 individuals. The attackers were able to acquire patient information and then attempted to divert invoice payments.
  • Cloud Storage Threats: Many healthcare providers are now switching to cloud-based storage solutions for better connectivity and convenience. Unfortunately, not every cloud-based solution is HIPAA-compliant, making them clear targets for intruders. Healthcare companies must implement access restrictions more carefully and encrypt data properly before transmitting. Additionally, complete visualization of the attack surface is necessary to prevent data breaches, data leaks, improper access management, and cloud storage misconfiguration.

How to Protect Expanding Healthcare Attack Surfaces

Attack surface analysis can help identify high-risk areas, offering an in-depth view of the entire system. This way, you can better recognize the parts that are more vulnerable to cyber threats and then review, test, and modify the security strategies in place as necessary.

Healthcare IT administrators must secure the network infrastructure using stringent policies and procedures like enforcing strong passwords, properly configuring firewalls, setting up user access permissions, and ensuring authorized access to assets and resources. They must also monitor and properly configure all the devices connected to the network — be it standard healthcare devices or personal devices of patients and workers. In addition, a strong encryption policy can help increase data security, making it difficult for cyber attackers to penetrate the system.

Conducting regular attack surface scans can also mitigate cyberattack risks. This helps ensure security control measures are adequate and that decision-makers have the data they need to make informed decisions regarding the organization’s cybersecurity strategy. Also, all types of software and related updates for medical devices must be tested prior to installation.

Secure Your Entire Healthcare Network with RedSeal

Healthcare organizations often hesitate to invest in cloud security solutions. But the average cost of a healthcare breach is $9.23 million, which is far more than the cost of professional cloud security solutions. Additionally, healthcare institutions deal with extremely sensitive information, and fines for data security noncompliance can be extremely costly. Healthcare security leaders must be able to effectively visualize their entire attack surface to bolster their cybersecurity defenses.

RedSeal offers award-winning cloud security solutions that provide comprehensive, dynamic visualization of all connected devices. We partner with leading network infrastructure suppliers to provide comprehensive network solutions and professional services. This way, you can see and secure your entire network environment.

Contact us to learn how we can help strengthen your network security.

Tales from the Trenches: Vol 7 — You Can’t Always Get What You Want

/by

Since 2004, RedSeal has helped our customers See and Secure their entire complex network. And while those customers may have understood the value of understanding their environment, how it was connected and see what’s at risk, there is often an “Aha” moment when the true significance is clear. The stories of these moments are lore within the walls of RedSeal. But these tales so clearly illustrate the value of RedSeal beyond just theory that we think they’re worth sharing. In the words of our team in the field, the ones working directly with our customers, this blog series will share the moments where it all gets real.

In this edition of the series, Bill Burge, RedSeal Professional Services places customer questions in full network context and reveals an even better solution with RedSeal.

You Can’t Always Get What You Want

While working with a large customer with multiple, interconnected, environments, their greatest fear was that infection in one environment might cross over one environment into the others.

They had purchased a managed service, which meant I was the primary RedSeal Admin. They approached me with a request and it was obvious they were having a possible “incident”. It was obvious they didn’t want to provide TOO many details, but I’ve spent enough time on both sides of these topics that I was pretty sure what I was up against.

Their request was simple to say, but that doesn’t mean it was simple to perform. “Can you give us a report of all the firewall rules that control this particular subnet?” For RedSeal, I can perform some queries that will do a pretty poor job of that when you factor in the multiple ways to cover a block of addresses in a firewall policy, groups, large masks, even the use of “any”. All these would have to be detected, expanded, broken out and apart, etc. It’s largely a fool’s errand.

So I politely declined. I gave a brief explanation of the dynamics and the fact that firewall policies would also have to be weighed against, and in conjunction with, router ACLs, and even routing. I always say “the firewall rules are only the verb in the sentence of access”. I offered an alternative: “Tell me the IP address that has been compromised, and I’ll tell you all the subnets it might have accessed, and all the vulnerabilities it might have exploited in the process.”

The customer’s response was: “You can do THAT? THAT’S even better! Let’s do it!”

I explained that calculating access is the foundation of RedSeal. As Mick Jagger says “you can’t always get what you want, but you just might find — you get what you need”.

Interested in how RedSeal can help your team? Click here to set up a demo or an introductory call.

Purdue 2.0: Exploring a New Model for IT/OT Management

/by

Developed in 1992 by Theodore J. Williams and the Purdue University Consortium, the Purdue diagram — itself a part of the Purdue Enterprise Reference Architecture (PERA) — was one of the first models used to map data flows in computer-integrated manufacturing (CIM).

By defining six layers that contain both information technology (IT) and operational (OT) technology, along with a demilitarized zone (DMZ) separating them, the Purdue diagram made it easier for companies to understand the relationship between IT and OT technologies and establish effective access controls to limit total risk.

As OT technologies have evolved to include network-enabled functions and outward-facing connections, however, it’s time for companies to prioritize a Purdue update that puts security front and center.

The Problem with Purdue 1.0

A recent Forbes piece put it simply: “The Purdue model is dead. Long live, Purdue.”

This paradox is plausible, thanks to the ongoing applicability of Purdue models. Even if they don’t quite match the reality of IT and OT deployments, they provide a reliable point of reference for both IT and OT teams.

The problem with Purdue 1.0 stems from its approach to OT as devices that have MAC addresses but no IP addresses. Consider programmable logic controllers (PLCs). These PLCs typically appear on MAC addresses in Layer 2 of a Purdue diagram. This need for comprehensive visibility across OT and IT networks, however, has led to increased IP address assignment across PLCs, in turn making them network endpoints rather than discrete devices.

There’s also an ongoing disconnect between IT and OT approaches. Where IT teams have spent years looking for ways to bolster both internal and external network security, traditional OT engineers often see security as an IT-only problem. The result is IP address assignment to devices but no follow-up on who can access the devices and for what purpose. In practice, this limits OT infrastructure visibility while creating increased risk and security concerns, especially as companies are transitioning more OT management and monitoring to the cloud.

Adopting a New Approach to Purdue

As noted above, the Purdue diagram isn’t dead, but it does need an update. Standards such as ISA/IEC 62443 offer a solid starting point for computer-integrated manufacturing frameworks, with a risk-based approach that assumes any device can pose a critical security risk and that all classes of devices across all levels must be both monitored and protected. Finally, it takes the position that communication between devices and across layers is necessary for companies to ensure CIM performance.

This requires a new approach to the Purdue model that removes the distinction between IT and OT devices. Instead of viewing these devices as separate entities on a larger network, companies need to recognize that the addition of IP addresses in Layer 2 and even Layer 1 devices creates a situation where all devices are equally capable of creating network compromise or operational disruption.

In practice, the first step of Purdue 2.0 is complete network mapping and inventory. This means discovering all devices across all layers, whether they have a MAC address, IP address, or both. This is especially critical for OT devices because, unlike their IT counterparts, they rarely change. In some companies, ICS and SCADA systems have been in place for 5, 10, even 20 years or more, while IT devices are regularly replaced. As a result, once OT inventory is completed, minimal change is necessary. Without this inventory, however, businesses are flying blind.

Inventory assessment also offers the benefit of in-depth metric monitoring and management. By understanding how OT devices are performing and how this integrates into IT efforts, companies can streamline current processes to improve overall efficiency.

Purdue Diagram

 

Controlling for Potential Compromise

The core concept of evolving IT/OT systems is interconnectivity. Gone are the days of Level 1 and  2 devices capable only of internal interactions, while those on Levels 3, 4, and 5 connect with networks at large. Bolstered by the adoption of the Industrial Internet of Things (IIoT), continuous connectivity is par for the course.

The challenge? More devices create an expanding attack surface. If attackers can compromise databases or applications, they may be able to move vertically down network levels to attack connected OT devices. Even more worrisome is the fact that since these OT devices have historically been one step removed from internet-facing networks, businesses may not have the tools, technology, or manpower necessary to detect potential vulnerabilities that could pave the way for attacks.

It’s worth noting that these OT vulnerabilities aren’t new — they’ve always existed but were often ignored under the pretense of isolation. Given the lack of outside-facing network access, they often posed minimal risk, but as IIoT becomes standard practice, these vulnerabilities pose very real threats.

And these threats can have far-reaching consequences. Consider two cases: One IT attack and one OT compromise. If IT systems are down, staff can be sent home or assigned other tasks while problems are identified and issues are remediated, but production remains on pace. If OT systems fail, meanwhile, manufacturing operations come to standstill. Lacking visibility into OT inventories makes it more difficult for teams to both discover where compromise occurred and determine the best way to remediate the issue.

As a result, controlling for compromise is the second step of Purdue 2.0. RedSeal makes it possible to see what you’re missing. By pulling in data from hundreds of connected tools and sensors and then importing this data into scan engines — such as Tenable — RedSeal can both identify vulnerabilities and provide context for these weak points. Equipped with data about devices themselves, including manufacturing and vendor information, along with metrics that reflect current performance and behavior, companies are better able to discover vulnerabilities and close critical gaps before attackers can exploit OT operations.

Put simply? Companies can’t defend what they can’t see. This means that while the Purdue diagram remains a critical component of CIM success, after 30 years in business, it needs an update. RedSeal can help companies bring OT functions in line with IT frameworks by discovering all devices on the network, pinpointing potential vulnerabilities, and identifying ways to improve OT security.

When Moving to the Cloud, Don’t Overlook Resources On-Premises

/by

Today’s cloud infrastructure is complex and constantly evolving. In the cloud, security controls are implemented by developers and DevOps teams while on-premises controls are implemented by the firewall/network operations teams. These can create significant knowledge gaps, leading to unknown attack points.

Most security spending these days is focused on the cloud and treated as a silo, but you can’t afford to ignore your on-prem resources and how the two entities work together.

Challenges with Protecting Cloud and On-Premises Resources

With resources moving to the cloud, most of the attention moves to cloud security and protecting the cloud perimeter and resources. Yet on-prem resources also have connections and exposure. However, you need a comprehensive security strategy that protects both cloud and on-premises resources.

Many organizations and vendors struggle with getting this comprehensive picture. For example, in many companies, in-house teams are responsible for managing on-prem resources while other teams or third-party providers monitor the security of cloud resources. At the same time, you have DevOps teams that are constantly evolving the cloud environment.

Different Languages

The products and tools being used in the cloud and on-premises domains are often disconnected and speak different languages as do the teams using them.

The problem is not people, however. It’s often the tools being used, like having a separate doorman on the front door (cloud) and back door (on-prem), and they both speak different languages and often have competing goals. While security teams are focused on mitigating exposure, DevOps teams are looking for a faster way to bring products to market. Competing goals can only aggravate language barriers.

Even highly skilled teams may not understand how other teams work. The technology is different, the configurations are different, and some nuances require expert interpretation and experience. Few team members will be conversant in both on-prem and cloud resources.

Greater Complexity

More than 90 percent of large organizations already employ multi cloud strategies; 80 percent use hybrid clouds.

This creates an even greater complexity for security and management. For example, Amazon Web Services (AWS), Microsoft Azure, and Google Cloud use different names for instances and virtual machines. Azure calls them virtual machines (VMs), while Amazon has Elastic Cloud Compute (EC2) and Google has the Google Cloud Compute Engine.

Even when the same term is used, it can mean different things. For example, a virtual private cloud (VPC) exists in both AWS and Google, but they are different and operate differently.

This only increases the language barrier that hinders a comprehensive approach to security.

Lack of Understanding of Shared Responsibility

Organizations also assume their cloud service provider (CSP) will protect assets in the cloud. While CSPs such as AWS, Azure, Google Cloud, Oracle Cloud, and others provide robust security for their networks, it’s still the customer’s responsibility to protect their data.

Gartner estimates that 99 percent of cloud security failures are the fault of the customer, not the CSP. The sheer volume of configuration settings and pathways to critical resources makes it difficult to manage security in the cloud. When you add in on-premises data centers or servers that are connected, the infrastructure becomes even more complex.

Constant monitoring and continuous compliance should be a shared responsibility between providers and organizations.

Not Monitoring Resource Misconfigurations

Most vendor security solutions are only as effective as how they’re configured. Yet few are monitoring that and telling you where these configurations are causing potential problems.

You need a comprehensive, end-to-end understanding of your cloud and on-prem infrastructure to analyze every configuration and security policy. While you may have cloud security tools for each environment, you need complete cloud network visibility to protect your infrastructure, look for exposure, and find security gaps.

Are You Seeing the Whole Picture?

Nearly every organization has at least some on-premises that are connected. The challenge often comes when it’s time to configure the right access for communication. You need to ensure that nobody on the cloud side can attack on-prem resources or vice versa. That’s why total visibility is essential.

If you’re not seeing the whole picture, it’s easy to miss attack points. Securing your infrastructure requires you to detail what you have, how it’s connected, and what’s at risk.

You need to:

  • Know what you have in your total infrastructure
  • Understand how everything is connected
  • Determine where your exposure is — all attack paths to cloud and on-premises
  • Uncover what policies or configurations created the exposure

Only then can you remediate problems and plug security gaps. You must understand how your cloud and on-prem resources are all interconnected to determine and mitigate your total risk.

Managing Cloud and On-Prem Resources

Some organizations turn to Cloud Native Application Protection Platforms (CNAPP) as a way to provide visibility amid the complexities and the constant evolution of hybrid resources. Yet all existing CNAPP solutions don’t understand on-Premises and are insufficient to identify access via all attack path and associated risk. Most tools call into the application programming interfaces of cloud service providers, looking for misconfigurations at the compute and container levels. However, they don’t fully understand end-to-end access.

CNAPP is an important weapon in the battle to secure the cloud, but most vendor solutions simply do not provide the total visibility you need across cloud and on-prem resources. RedSeal solves these problems.

RedSeal on-premises and RedSeal Stratus in the cloud provide a complete view of the entire infrastructure. They identify the gaps in your security by pinpointing attack points and any hidden pathways. This analysis also determines the underlying reason why these attack points exist and what needs to happen to remediate them.

RedSeal solutions also work across borders. They provide the platform to speak to DevOps and firewall/network operations teams in the right way, helping eliminate language barriers. This way, you get benefits across borders for cloud and on-prem, enabling you to identify security issues across the entire infrastructure by driving collaborations between the teams and building trust.

Protect Your Entire Infrastructure

On-premise and cloud resources cannot be protected in a silo. Working in tandem with a shared responsibility model, a hybrid solution with RedSeal provides continuous monitoring and compliance across both on-prem and cloud resources, identifies gaps, and helps you protect your entire infrastructure.

RedSeal CEO, Gregory Enriquez

RedSeal Announces New CEO, Gregory Enriquez, to Lead Next Phase of Growth

/by

MENLO PARK, Calif., January 31, 2023 — RedSeal, whose award-winning cyber management platform helps companies measurably reduce their cyber risk across all network and cloud environments, announced today the appointment of Gregory Enriquez as Chief Executive Officer.

With more than 25 years of experience leading information systems technology companies in executive management, Go-To-Market (GTM) leadership, solutions deployment and business development, Enriquez brings a wealth of knowledge and expertise to the company.

As CEO of RedSeal, Enriquez will lead RedSeal into its next phase of growth with on-premises and cloud network security for government agencies and enterprise companies. RedSeal’s sophisticated technology gives security and management teams the most holistic understanding of their organization’s cyber risks—across physical, cloud, and virtual networks—helping them know what they don’t know, understand and remediate vulnerabilities, and establish and maintain compliance with internal and external requirements.

Enriquez is a proven leader with deep experience in cyber security, but also a wide range of core infrastructure technologies, including AI/ML application development, DevSec-Ops, Networking, Cloud and SaaS solutions. He comes with a successful track record of helping some of the world’s largest enterprises and government agencies enhance their security posture, leading the go-to-market efforts of the leadership team that scaled Mandiant to over $100M of ARR leading to their acquisition, and then later as Vice President, Worldwide Advanced Technology Group at FireEye after their acquisition of Mandiant. Other successful sales leadership roles include worldwide sales leadership positions at Lastline (Network Detection and Response, acquired by VMWare) as well as Symantec following 20+ years of leadership and sales positions with IBM.

Prior to becoming CEO at RedSeal, Enriquez was the CEO of startup Test.ai which delivered AI-powered software tools for software testing and dev ops, and prior to that, he was CEO of TrapX (acquired by Commvault) which was a leader in deception based cyber security defense. He holds a Bachelor of Science degree in Business Administration from the University of Southern California.

“I am excited to join RedSeal at an exciting time in the company’s journey. They have excellent capabilities to help enterprises and governments manage the potentially unmanageable complexity of modern network and cloud environments, and with their increasingly advanced capabilities in cloud security, the opportunity to build a market leading franchise in cyber security management,” said Enriquez. “I look forward to working with the talented team at RedSeal to drive growth and innovation in the industry.”

“Greg is a strong, growth oriented leader with a superb record of building some truly impressive franchises in other cyber security companies. He is an excellent match for RedSeal at our current inflection point with the growth of our core business and the introduction of our cloud-native Stratus capability, and his customer success oriented model will build on the foundations laid by Bryan Barney” said J.T. Treadwell, Managing Director at Symphony Technology Group. “To that extent, we do wish Bryan well at his new role as CPO of Everbridge, as we are a stronger company thanks to his efforts and thank him for is partnership with RedSeal.”

About RedSeal

RedSeal helps government agencies and Global 2000 companies see and secure their on-premises and cloud environment. With RedSeal, enterprises improve their resilience to security events by understanding what’s on their networks, how it’s all connected, and the associated risk. RedSeal protects enterprises by validating that resources are securely configured and continuously monitors compliance to internal and external security mandates. The company is based in Menlo Park, Calif.

Tales from the Trenches: Vol 6 — Barely-Passive Aggressive

/by

Since 2004, RedSeal has helped our customers See and Secure their entire complex network. And while those customers may have understood the value of understanding their environment, how it was connected and see what’s at risk, there is often an “Aha” moment when the true significance is clear. The stories of these moments are lore within the walls of RedSeal. But these tales so clearly illustrate the value of RedSeal beyond just theory that we think they’re worth sharing. In the words of our team in the field, the ones working directly with our customers, this blog series will share the moments where it all gets real.

In this edition of the series Bill Burge, RedSeal Professional Services shows the network as configured, not necessarily as designed, with RedSeal.

Barely-Passive Aggressive

While working with a global reach chip manufacturer, a new member was added to those who helped manage RedSeal.

He had spent over a dozen years working his way up the Network Operations group to become one of their top network architects, and his knowledge of the network was determined to be of great value to the Security Architecture group.

As we were reviewing some of the RedSeal findings and giving him a tour of the capabilities of the deployment, it was pretty obvious he was neither impressed nor entertained. With his history of designing, building, and managing the network; he was almost offended that some product could tell him ANYTHING that he didn’t already know about his network.

Reviewing Model Issues, specifically Overlapping Subnets, I’m explaining how there can be multiple reasons why they might exist, but many times they are a simple typo in a netmask. We found such an example.

He proceeds to dig into the config with the intent of showing us how “RedSeal got it wrong”. (I’m preparing for this to spiral into a very bad scene.)
He finds the line, and he finds the typo.

The room gets REAL quiet and I’m holding my breath. Finally, he sits back in his chair and visibly deflates. He then offers “That’s probably been in there for over a DECADE!”
Then he starts laughing and says “I’m probably the person that put it in there!”

After that, he wanted to see “everything!”
He says “There’s 18 months worth of work to fix just the things I’ve seen today!”  His teammates point out to him: “Yes, but it’s not YOUR job anymore to fix it.” (Big smile.)

Interested in how RedSeal can help your team? Click here to set up a demo or an introductory call.

How to Navigate the Shifting Healthcare Cybersecurity Landscape

/by

Cyberattacks and data breaches in the healthcare sector are increasing at an alarming rate, especially during the pandemic when patient communications and records moved online.

Between March 2021 and February 2022, over 42,076,805 healthcare records were exposed. Businesses lose an average of $10.10 million per healthcare data breach, while lost or stolen protected health information (PHI) and personally identifiable information (PII) cost the U.S. healthcare industry billions of dollars annually.

Valuable data makes healthcare organizations a prime target for cybercriminals. Meanwhile, the fast-shifting technology landscape makes it more challenging than ever to keep up with the latest cybersecurity best practices.

Let’s look at the many factors causing today’s cybersecurity nightmare and how you can navigate the changing healthcare cybersecurity landscape with the right technology and processes.

The Healthcare Sector Faces Ongoing Cybersecurity Challenges

The healthcare industry is complex. Various factors have come together in recent years to create the perfect storm for bad actors to breach networks and steal data.

High-Value Target Data: PHI and medical records are sought after by criminals because they’re worth 10 to 20 times the value of credit card data on the dark web. Meanwhile, biomedical and pharmaceutical research and development data drive a $160-billion industry. Criminals can often use the stolen credential to breach multiple targeted systems, giving threat actors many ways to cause damage through lateral movements.

Fast Adoption of New Technologies: The healthcare industry has been implementing connected medical devices (medical IoT) at a rapid pace. The equipment often uses unregulated mobile applications for processing and transmitting PHI and PII. Additionally, many facilities don’t have the proper security protocols to support the proliferation of devices connected to their networks — creating a large attack surface cybercriminals can exploit.

Overworked and Undertrained Personnel: Employee training is key to preventing social engineering schemes, phishing scams, and ransomware attacks — after all, it takes only one staff member to open one malicious attachment to infect the entire system. However, many healthcare facilities fail to provide sufficient cybersecurity education to their employees. Even end users with the knowledge and best intention often let their guard down because of environmental factors, such as distraction and excessive workload.

Competing Operational Priorities: Operational needs, often urgent, require personnel to prioritize speed of information sharing over data security. Meanwhile, facilities must comply with large-scale data portability regulations that require them to make health records and other sensitive information available in digital and sharable formats. These processes can increase the risks of data breaches if providers don’t have the proper security measures in place.

Budgetary Constraints: Healthcare organizations have limited IT budgets, and their tech teams are often stretched thin. They spend most resources on acquiring and implementing new technology solutions to stay current and competitive, leaving few to secure and maintain their networks. Many organizations don’t have in-house security teams and often outsource the function without assigning any internal stakeholders to coordinate the activities or monitor the outcomes.

Inconsistent Cyber Hygiene: Many healthcare facilities are stuck with legacy systems that are no longer supported by the vendor and can’t be upgraded with the latest security features. As such, they introduce permanent vulnerabilities into the organizations’ networks. Additionally, integrating new and old technology solutions may create interoperability dependencies, network segmentation risks, and blind spots hackers can exploit.

The Pandemic Caused New Issues in Healthcare Cybersecurity

The healthcare industry played a front-and-center role during the COVID-19 pandemic, which necessitated the rapid adoption of digital technologies. While the accelerated digital transformation brought many benefits, it also created various cybersecurity concerns.

An Abrupt Shift to Remote Working: Many non-frontline functions moved to a remote working environment in response to lockdowns. Healthcare organizations lack the time and resources to provide adequate security training to remote workers, implement endpoint protection capabilities, and develop remote system backup and recovery plans to build business resiliency and protect themselves from the consequences of ransomware attacks and data loss.

Rapid Procurement and Implementation of Security Tools: The rapid transition to cloud-based platforms for the new hybrid work environment increased the likelihood of misconfigured security settings and mismanaged security tool deployments. Many organizations also lack plans to maintain and sustain the new platforms and technologies, leading to oversight and creating opportunities for threat actors to strike.

Duration and Scope of the Global Crisis: The pandemic created long-term uncertainty. It increases the stress on individuals and society, which, in turn, raises the population’s susceptibility to social engineering. Meanwhile, the need for coordinated responses from facilities across the nation and authorities around the world requires unconventional partnerships and data-sharing practices that caused chain reactions, increased risk factors, and exposed vulnerabilities.

Navigating the Cybersecurity Nightmare in Healthcare: Today’s complex cybersecurity landscape isn’t easy to navigate, especially in the high-stakes healthcare sector. The rise of remote work and telemedicine, plus the proliferation of connected medical devices, has increased the attack surface dramatically. Budget constraints, competing priorities, and lack of employee training leave a lot of opportunities for hackers to exploit. Also, healthcare providers must comply with increasingly stringent data privacy laws to avoid fines and lawsuits.

A Multi-Layer Approach to Cybersecurity: You need a multi-prong approach to address various challenges. The process starts with gaining visibility across all your network environments to understand who has access to what information. Then, prioritize vulnerabilities and resolve gaps in your scan coverage.

Don’t forget to address all your cloud platforms, especially if you have a hybrid environment that combines cloud applications with legacy software where the connections can become weak links and blind spots. Moreover, you must stay current with all relevant data privacy laws, adhere to the latest security configuration standards, and ensure that your vendors and partners are also compliant to protect your data from supply chain attacks.

RedSeal can help you build a solid foundation by creating in-depth visualizations of your security infrastructure. We then use the insights to prioritize your vulnerabilities and automate your compliance process. Get in touch to see how we can help you assess, remediate, and mitigate your security processes and infrastructure.

How Secure Is Your Pharma Research Data?

/by

The use of big data and advanced analytics is now essential for innovation across the pharmaceutical and healthcare industries. However, working with vast amounts of data — experimental data, clinical trial data, patient data — has become a double-edged sword as organizations face immense challenges in protecting data integrity and ensuring data security in today’s digital environment.

Meanwhile, the global pharmaceutical market will grow above $2 billion by 2028 at a compound annual growth rate (CAGR) of 5.7% between 2022 and 2028. With revenue depending on research and innovation and more of the processes going digital, pharma research data has become a prime target for threat actors who use various means to breach companies’ systems and steal their sensitive information.

Let’s review key data security issues that pharma research companies face and how to protect your sensitive information to help you navigate the complex cybersecurity environment.

Is Pharma Research Data Secure?

Unfortunately, no. The pharmaceutical industry has seen many data breaches in recent years.

In an analysis of 20 pharma companies, five had experienced over 200,000 data exposures and breaches. Some had as many as 400,000 exposures. Another study revealed that over 50% of hospitals, biotech firms, and pharmaceutical companies have more than 1,000 sensitive files accessible to all employees. 33% of these organizations have over 10,000 files exposed to every staff member.

IBM’s Cost of Data Breach 2022 report found that data breaches cost the pharma industry an average of $5.01 million between March 2021 and March 2022. Additionally, the high data regulation environment means these companies see costs accrue years following a breach due to regulatory and legal fees, further impacting an organization’s financial health.

Data breaches in the pharma industry can also lead to direr consequences than in many other sectors. For example, leaked intellectual properties and clinical trial data can lead to reputational damage and lost revenue that could take years to remedy.

Top Pharma Research Data Security Issues

Here are the key cybersecurity challenges faced by pharma companies:

Supply Chain Attacks: Pharma research requires collaboration among various parties, such as research institutions, suppliers, contractors, and partners. The complex ecosystem creates a large attack surface threat actors can exploit. For example, they can infiltrate your network via a vendor with a less secure system. Without complete visibility into their environment, many organizations are left in the dark until it’s too late.

Ransomware Attacks: Due to the need to access critical information in their research, pharma companies are prime targets for ransomware attacks. Especially in companies with lax access controls, hackers can infect just one employee’s device with malware to infiltrate the entire network and lock down access to data for the whole company.

Phishing Scams: Threat actors can use social engineering techniques to trick employees, partners, and researchers into giving up their credentials to access the company’s network and exfiltrate data. Again, an organization without proper access control makes it much easier for hackers to move laterally across its systems.

Emerging Technologies: New platforms, cloud technologies, and Internet of Things (IoT) devices are invaluable in accelerating research and development processes. But they also present inherent cybersecurity risks because of the expansive environment and numerous endpoints. If companies spread their data on multiple platforms without mapping their inventory, they could leave sensitive data out in the open.

Mergers and Acquisitions (M&A): The pharmaceutical industry saw 182 M&A deals in Q2 2022. When two companies merge, their IT infrastructures must work seamlessly with each other, including their cybersecurity protocols and monitoring systems. Mapping all the data to maintain visibility and assessing vulnerabilities can be challenging, leaving the new entity at a higher risk of compromise.

How to Protect Pharma Research Data:

Here are some steps pharma companies can take to protect their research data:

  1. Visualize Access Across Your Network Environment: You can’t protect what you can’t see. You must map your environment and all digital assets to connect the dots, identify blind spots, reveal inconsistencies, and interpret access control. You can then prioritize vulnerabilities based on access and eliminate gaps in your scanner coverage.
  2. Deploy End-to-End Encryption for Data Sharing: Use a robust encryption solution to support data sharing within the organization and with third parties. This way, authorized personnel can use sensitive information without risking exposure. Choose a scalable, database-agnostic encryption technology that can be deployed in the cloud or on-premises to help protect data at rest, in transit, and in use.
  3. Enforce a Zero-Trust Policy and Least-Privilege Access: Least-privilege access is a vital component of a zero-trust framework that continuously authenticates a user’s identity to allow access to protected information. Access control is granted based on the principle that end users should see no more than the data they need to do their job. This approach can help minimize damage even if an employee’s account is compromised and limit a hacker’s lateral movement within your network.
  4. Implement a Comprehensive Incident Response Plan: It’s not a matter of if but when your infrastructure will come under attack, and a well-designed incident response plan is key to containing the damage and minimizing loss. Having an up-to-date model of your network can help accelerate incident response by locating the compromised device and determining which digital assets hackers can reach from the entry point.

Protect Pharma Research Data with a Bird’s-Eye View of Your Network

The first step in strengthening your defense is to know where all your data is and who can access the information. The insights can help you identify vulnerabilities, take remediation actions, and implement continuous compliance monitoring. But mapping all the moving parts, including every connection to the internet, is easier said than done.

RedSeal Stratus gives you an in-depth visualization of the topography and hierarchy of your security infrastructure. It helps you identify critical assets inadvertently exposed to the internet and shows your multi-cloud inventory and connectivity, so you can quickly detect changes in the environment.

Get in touch to see how we can help you proactively improve your security posture and protect your pharma research data.

Tales from the Trenches: Vol 5 — Octet Dyslexia

/by

Since 2004, RedSeal has helped our customers See and Secure their entire complex network. And while those customers may have understood the value of understanding their environment, how it was connected and see what’s at risk, there is often an “Aha” moment when the true significance is clear. The stories of these moments are lore within the walls of RedSeal. But these tales so clearly illustrate the value of RedSeal beyond just theory that we think they’re worth sharing. In the words of our team in the field, the ones working directly with our customers, this blog series will share the moments where it all gets real.

In this edition of the series, Bill Burge, RedSeal Professional Services exposes inconsistencies in policy definitions with RedSeal.

Octet Dyslexia

Numbers are a tricky business and more numbers equals more tricky, and sometimes our brains see what they want to see and not what is actually there.

While working on PCI audit prep using RedSeal Zones & Policies with a large manufacturer/distributor/retailer we were going over what Internet access existed from the Internet into their cardholder environment.

The customer had two external address blocks and some were allowed access through this path.

I’ll make up the address blocks, as 12.53.22.0 and 15.43.22.0.  In the table of access results was a block of inbound address that was 12.43.22.0 (or something like that).

I asked the customer about this external address block and they said “yeah, we have two external blocks”.  We did a few laps around this like the old “Who’s on first?” routine.

It wasn’t until I put a sample from this range along with samples from their two ranges that they were finally about to SEE that it was an amalgamation of their two ranges, just enough to fool the hurried mind.

A quick Whois determined that the range belonged to a Chinese university, IN CHINA.

We were able to use other features of RedSeal to determine all the device configurations that referenced this block and submit change requests to get them remediated.

Interested in how RedSeal can help your team? Click here to set up a demo or an introductory call.

 

Tales from the Trenches: Vol 4 — Leveraging the Tools You Already Have

/by

Since 2004, RedSeal has helped our customers See and Secure their entire complex network. And while those customers may have understood the value of understanding their environment, how it was connected and see what’s at risk, there is often an “Aha” moment when the true significance is clear. The stories of these moments are lore within the walls of RedSeal. But these tales so clearly illustrate the value of RedSeal beyond just theory that we think they’re worth sharing. In the words of our team in the field, the ones working directly with our customers, this blog series will share the moments where it all gets real.

In this edition of the series Chris Naish, Sr. Sales Engineer, Federal at RedSeal explores prioritizing your risk mediation with RedSeal.

Leveraging the Tools You Already Have

Sometimes, you just need help understanding what you already have the ability to do…

Often while walking with customers along their RedSeal journeys, they’ll ask me, “Hey, what’s this Risk tab?”…

To prepare them for the coming screen of boxes of different colors and sizes, I preface the conversation by saying, “This might look intimidating at first, but I promise it’s not. It will make more sense shortly.” …

I’ll first take a brief detour to the Vulnerabilities tab in RedSeal and reiterate how on this tab, you’re essentially looking at the vulnerabilities in your environment one at a time. For any selected vulnerability, you’re able to see the related Host Count in the top frame, as well as the actual number of instances in the bottom frame (these counts may differ if the vulnerability in question can affect a host on more than one port).

Next, I’ll move over to the Risk tab and explain that by way of contrast, each of the boxes of different colors and sizes on the Risk map represents one of the hosts in your network. You can select any host and get related details in the bottom frame, including the vulnerabilities on that host.

But *why* are they all different colors and sizes?

The key to understanding the Risk Map layout is to click on Risk Map Controls on the left-hand side. Here you’ll be shown a series of drop-down menus, each with multiple options, which dictate how the host boxes appear, as well as how they’re grouped.

With this foundation laid, I explain that the main use case of the Risk tab is determining Mitigation Priority according to YOUR specific RedSeal topology. Say for example that you’re working with someone new to your patching team, who’s only responsible for Campus hosts. And they’re sitting next to you while you show them RedSeal’s capabilities. After a brief detour to Maps & Views to show them a RedSeal topology map that includes a Campus area, I might go back to the Risk tab and make this distinction: if you show them a simple Risk view, it may be perceived as overwhelming if you have a fair amount of vulnerabilities in your ENTIRE network that need to be patched. By way of contrast, if you INSTEAD manipulate the Risk Map Controls (and save the resulting layout) to display a Topology-based Mitigation Priority View, now the host(s) of concern for the Campus portion of your network can easily be seen. This can be done via the following drop-down menu selections: Group: First By Topology, Then By Primary Subnet; Appearance: Color By Downstream Risk, Size By Risk.

At this point, a customer’s wheels usually start turning and ideas come forth on how to make use of these concepts in THEIR RedSeal model and increase its’ value.

Interested in how RedSeal can help your team? Click here to set up a demo or an introductory call.