Securing Healthcare Data on Mobile Devices

Transcription

1 Securing Healthcare Data on Mobile Devices Michelle Cook, Healthcare Mobility Specialist Keith Glynn, CISSP, Sr. Technical Solutions Engineer October 31, 2013

2 Poll Question #1 Has your organization deployed an MDM and/or NAC solution? A. Mobile Device Management B. Network Access Control C. A combination of NAC and MDM D. Not using either at this time 2

3 Today s Speakers Michelle Cook Healthcare Mobility Specialist MaaS360 by Fiberlink Keith Glynn, CISSP Sr. Technical Solution Engineer ForeScout Technologies 3

4 Today s Agenda Mobility security risks in Healthcare IT Network access control 101 Managing mobility with MDM How MDM and NAC provide total control 4

5 Healthcare: Quick Stats 91% of physicians use smartphones and 62% tablets EPG Health Media and Manhattan Research Each small piece of data shared is its own separate infraction HIPAA Omnibus Rule $12 billion the annual cost to U.S. hospitals for data breaches Ponemon Institute $1.5 million the new maximum penalty for a HIPAA violation HHS

6 Risk in Healthcare IT Unknown devices No standards for non-standard equipment Unpatchable systems Identity and access management Lower Revenue means less IT spend on risk mitigation Mobile devices Personal devices

7 How do you secure healthcare data on mobile devices? 7

8 Network Access Control (NAC) 8

9 Non-Standard, Corporate and Personal Devices Medical Devices are evil doers friend Medical devices have no technology standard by which they are developed FDA certifies functionality ONLY! Securing will not decertify! (regardless of what the vendor tells you) Guidance finally released after 7 years They connect in wired and wireless configurations Corporate devices Greater level of access to sensitive data User based Access Data can be stored locally Personal devices Access based on user Potentially store data locally Less access to sensitive data

10 ForeScout CounterACT Platform Endpoint Compliance Real-time device intelligence Find and fix security gaps Enforce policies Agentless Knowledgebase Network Access Control Register guests Block unauthorized users and devices Limit access ForeScout Real-time Security Platform. Mobile Security Enable BYOD Secure device, app and data use Integrate with Wireless and MDM Unique Network Presence Extensible Interoperable Threat Prevention Block intrusions Detect infected machines Stop targeted attacks Scalable

11 Foundation for Continuous Monitoring and Mitigation Continuous Visibility Endpoint Remediation Endpoint Authentication & Inspection Network Enforcement Information Integration

12 The Correct People to the Correct Data Access Web CRM Medical Staff Employee Guest

13 Poll Question #2 Are you currently enforcing any role-based access to network connected BYOD devices? A. Yes B. No C. We do not allow BYOD devices on the corporate network

14 Open Platform Interoperability MDM Vulnerability Assessment SIEM Endpoint Protection Endpoints Network Infrastructure Advanced Threat Detection Identity Data Providers ControlFabric Integration Open, standards based API Web Service (client or server), SQL, LDAP, syslog Bidirectional integration Data Consumers

15 About ForeScout ForeScout is a leading global provider of pervasive network security solutions for Global 2000 enterprises and government organizations. Foundation California headquarters 215+ employees 200+ global channel partners Enterprise Deployments global implementations Financial services, government, healthcare, manufacturing, retail, education

16 Gartner on the NAC Market *Magic Quadrant for Network Access Control, December 2012, Gartner Inc. *This Magic Quadrant graphic was published by Gartner, Inc. as part of a larger research note and should be evaluated in the context of the entire report. The Gartner report is available upon request from ForeScout. Gartner does not endorse any vendor, product or service depicted in our research publications, and does not advise technology users to select only those vendors with the highest ratings. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Garnter, Inc. "Magic Quadrant for Network Access Control," Report G , December 3, 2012, Lawrence Orans, John Pescatore.

17 Why Customers Choose ForeScout Easy to use and deploy with low Total Cost of Ownership Agentless approach; works within existing/legacy environment Easy, centralized administration, scalable, non-disruptive Real-time situational awareness All users, devices, applications - infrastructure agnostic Wired, wireless, rogue, VMs, PC, mobile, embedded Rapid results and bi-direction intelligence Customizable templates and controls with robust SIEM, MDM, EPP, VA, ADT and directory integration Enables continuous compliance and mitigation ControlFabric platform: open, extensible, proven

18 Mobile Device Management (MDM) 18

19 Healthcare Mobility Challenges Healthcare transformation Increase of mobile devices and apps Preference for personal devices Access to corporate resources (WiFi, , etc..) Access to health records and diagnostic apps Stringent security requirements HIPAA regulatory compliance Omnibus Rule Inconsistent security across platforms and apps Potential for misuse of confidential data 19

20 MaaS360 Delivers an Integrated Approach Comprehensive Mobile Security Complete Mobility Management One Platform for All Your Mobile Assets 20

21 Know your Environment Full visibility of your mobile environment Know what applications are on there Mobile metrics on potential threats from apps Audit Trail and Custom Alerts

22 Policy Enforcement OTA Configuration Management Passcode settings , Wi-Fi and VPN profiles Device features restrictions Camera icloud Screen Captures App compliance Automated Action on Non-compliant Events Enforce MDM management Minimum OS version Jailbreak / Root detection 22

23 Secure Mail An intuitive office productivity app with , calendar and contacts Contains s and attachments to prevent data leakage FIPS compliant, AES-256 bit encryption for data at rest Restrict forwarding, moving, and screen captures Conduct on-line and off-line compliance checks prior accessing Enforce authentication, cut and paste restrictions, and view-only mode 23

24 Remote Help Desk Support Reset forgotten device passcode Locate lost device Buzz lost device Selective wipe Full device wipe Send message Change policy Remove control 24

25 EMR App Security Enterprise App Catalog App security & compliance management Distribute and update apps Selectively remove managed apps Volume Purchase Program management 25

26 Secure Document Access Securely distribute documents directly to the container Enforce user authentication Add, sync, and remove documents Protect sensitive documents with DLP controls Integrates with SharePoint and other file stores Allow access to corporate intranet sites and network without VPN (e.g. JIRA) Define URL filters and security policies based on categories Block known malicious websites 26

27 Shared Device Support Share a single device with multiple users Log in to apply user specific settings Authentication with Active Directory or MaaS360 local , Wi-Fi, VPN, Apps, Docs Log out to remove settings Maintain an audit trail of users Ideal for a number of use cases such as: An ipad shared amongst doctors and/or nurses on rotating shifts 27

28 Geo-Fencing Capabilities Location-Based Policies Physical location (e.g. Address) Network connection (e.g. SSID) Dynamic Policy Assignment Change policy on: Automated location Check in Automated location Check out Geo-Fencing Rules Take action on: Device leaving specified location Device entering specified location 28

29 Poll Question #3 Is the HIPAA Omnibus Rule influencing your mobility decisions? A. Yes B. No C. Uncertain 29

30 ForeScout + MaaS360 for Healthcare 30

31 MaaS360 Integration with ForeScout NAC Cloud Extender Exchange/ Office 365 AD/LDAP Lotus BES Certs ForeScout MDM Console ForeScout CounterACT Unified visibility Unified access policy Unified reporting Automated MDM enrollment On-access assessment Block malicious activity 31

32 MDM + NAC = Total Endpoint Solution Synergies Device Management (App Inventory, Remote Wipe, etc.) Enterprise App Mgmt (Distribution, Config) Policy Compliance (Jailbreak detection, PIN lock, etc.) Secure Data Containers Inventory Management Cert + Supplicant Provisioning Mobile + PC Visibility of Unmanaged Devices Network Threat Prevention Network Access Control (Wireless, Wired, VPN) Guest Registration MDM + NAC = Complete BYOD Security Device-based control Network-based control

33 NAC, MDM Synergies Visibility MDM Alone NAC Alone NAC+MDM Managed Mobile Devices All devices, basic mobile details Complete Rogue Access n/a Detect/Mitigate Complete Guest Management n/a End to end Complete MDM Enrollment User dependent, or pre-register Network, Policy Automated Both Device Control App, Profile Agent, Agentless Complete Compliance check Polling-based On and post network access More secure Enforcement Remote wipe/lock Block from network Complete Reporting Device, Policy All Devices, Policy Complete +

34 Thank you for joining Follow-up: Try MaaS360 today! Sign up for a 30 day free trial at MaaS360.com Visit ForeScout.com to request a demo today! If you have questions that were not addressed in today s webinar, please visit the MaaSters Center at maasters/forums Upcoming webinars can be found at maasters/webinars so please check back frequently!