5 things to consider when designing a security strategy for the Cloud William Crank, MEDHOST, Blake Sutherland, VP, Enterprise Business, Trend Micro

5 things to consider when designing a security strategy for the Cloud William Crank, MEDHOST, Blake Sutherland, VP, Enterprise Business, Trend Micro May 2015

Speakers Blake Sutherland, VP Enterprise Business, Trend Micro With over 25 years of security experhse, Trend Micro is recognized as the market leader in server security, cloud security, breach detechon and small business content security. We make the world safe for exchanging digital informahon. William Crank, MEDHOST MEDHOST provides sonware and services to about 1,000 healthcare facilihes nahonwide, from large mulh- facility hospital systems to independent community facilihes and IDNs.

The Cloud is changing healthcare improving pahent health, engagement and wellness 6000 Apps in itunes Telemedicine, e- Health Internet of Things Medical Devices Cloud Portals Mobile Clinician Copyright 2015 Trend Micro Inc. 3

But healthcare is at risk of data loss, breaches and gaps in security Fall 2014: 4.5 million records stolen from a healthcare organizahon Spring 2015: Another breach at a healthcare insurer has 80 million records affected Spring 2015: A third major incident affechng 11 million customer records including medical and financial data ConfidenHal 2015 Trend Micro Inc. 4

Cloud usage in Healthcare is healthy, but security could use improvement! In the latest SANS Healthcare study, 60% of respondents indicated that they are either using or planning to use the cloud for mulhple applicahons containing sensihve data New Threats Drive Improved PracHces: State of Cybersecurity in Health Care OrganizaHons, December 2014, SANS In a recent Trend Micro study, less than 40% of surveyed companies felt that their cloud applicahons were secure or very secure Trend Micro Healthcare Security Survey, February 2015 68% state that their security budget will DECREASE in the next 12 months! Trend Micro Healthcare Security Survey, February 2015 ConfidenHal 2015 Trend Micro Inc. 5

Payment Card Industry (PCI) Protected Health InformaHon (PHI) INFORMATION HAS BECOME YOUR MOST STRATEGIC ASSET Intellectual Property (IP) Personally IdenHﬁable InformaHon (PII)

Payment Card Industry (PCI) Protected Health InformaHon (PHI) 552 90 % $3.7M COMMERCIAL EXPLOIT KITS INSURANCE AVERAGE NEW ORGANIZATIONS NOT THREATS EVEN CAREATED WARE HAVE OEF VERY USED BY VIRTUALLY A PAYOUT LL MALWARE FROM DATA SECOND ACTIVE INTRUSIONS EASTERN EUROPEAN CYBERCRIMINALS BREACH Intellectual Property (IP) Personally IdenHﬁable InformaHon (PII)

Healthcare Cloud AdopHon What is healthcare doing in the cloud? UHlizing SaaS offerings from third- party vendors. MigraHng crihcal/sensihve workloads to the cloud leveraging PaaS and IaaS providers. Why are they doing it? Total Cost of SubscripHon (TCS) Scalability and Availability Accessibility Speed and Flexibility Copyright 2015 Trend Micro Inc. 9

Data ProtecHon What does this mean? EncrypHon (at rest, in transit) SegregaHon RedacHon (if necessary & capable) Geo- PoliHcal boundaries Data classificahon & retenhon Integrity What you should do? This includes both process and data work and includes technologies that can assist you Copyright 2015 Trend Micro Inc. 11

OperaHons What does this mean? Asset Management Back- Ups Patch Management Threat & Vulnerability Management Network Security What should you do? Ensure regular maintenance and schedules of operahonal systems. Apply virtual patching if you have legacy systems or not able to do immediate updates and upgrades Copyright 2015 Trend Micro Inc. 12

Access Control What does this mean? Access Control List s (whitelishng & blacklishng) User Access (Provisioning, Change, Removal) Role Based Access Control (Permission and AuthoriHes) What should you do? Managing access control for roles, locking down systems, having ability to control what makes it through or not Copyright 2014 Trend Micro Inc. 13

Logging, Monitoring & AlerHng What does this mean? Security Incidents Data Access AlerHng Incident Response Team/Process What should you do? Includes process and technology soluhons that can provide instant alerts and help understand when an issue is present, what to do about it, or resolve issues that require inveshgahon and going backwards in Hme Copyright 2014 Trend Micro Inc. 14

Legal & Contractual considerahons What does this mean? Business Associate Agreements Data Use Agreement Policy Policies & Procedures What should you do? With assistance from legal and policy makers, ensure paperwork and processes are in place. Follow compliance regulahons and simplify your security management with tools that will help you maintain this type of obligahon easily Copyright 2015 Trend Micro Inc. 15

Trend Micro has soluhons to address mulhple Healthcare Issues CENTRALIZED VISIBILITY & CONTROL Legacy Systems PaHent Portals EMR/EHR Security Breaches Phishing Avacks Gaps due to Medical Devices Data Loss PrevenHon Endpoints, Mobile Malware, AV