myecfirst hitrustlogo PCILogo
HIPAA & HITECH Vulnerability Assessment

slide-inner-va

Hospitals, health systems, physician practices, payers such as insurance organizations, as well as business associates must conduct a comprehensive technical vulnerability assessment exercise to meet HIPAA mandates, including HITECH Meaningful Use requirements for Stage1.

Have you completed a technical vulnerability assessment exercise recently?
ecfirst, Home of The HIPAA Academy™, can address this mandate now.

A key requirement of the HIPAA and HITECH regulations is that covered entities and business associates must conduct a comprehensive and thorough assessment of the potentials risks and vulnerabilities to the Confidentiality, Integrity, and Availability (CIA) of all electronic Protected Health Information (EPHI). These HIPAA and HITECH mandates require that organizations must complete a comprehensive and thorough vulnerability assessment on a regular schedule.

bizSHIELDtm – An ecfirst Technical Vulnerability Assessment Service

ecfirst developed the bizSHIELDtm program to assist Covered Entities, Business Associates, and vendors of Electronic Health Records (EHRs) and Personal Health Records (PHRs) in meeting the requirements of the HIPAA Privacy and Security Rule, The HITECH Act, and all subsequent guidance documentation and settlement agreements.

As a part of the bizSHIELDtm program, ecfirst will list every requirement of the HIPAA Security Rule including every Safeguard, Standard, and Implementation Specification in a risk analysis format that identifies an organization’s state of compliance with the requirement, recommended remediation activity, and associated risk priority. All remediation activities will be listed according to recommended implementation time bands in the bizSHIELDtm Corrective Action Plan (CAP) table. The bizSHIELDtm report is an actionable, documented risk analysis that provides both in depth and executive summary level findings appropriate to all audiences from administrators to the Board of Directors.

Technical Vulnerability Assessment Service

The Office of Civil Rights (OCR) wants to ensure that organizations have identified all of the risks and vulnerabilities to the EPHI that they collect, store, process, or transmit. The ecfirst bizSHIELDtm risk analysis program includes a technical vulnerability assessment to address HIPAA and HITECH mandates with the objective of establishing and prioritizing compliance and security gaps.

The ecfirst bizSHIELDtm Technical Vulnerability Assessment Service supports several distinct components, including:

  • External Assessment
  • Internal Assessment
  • Firewall Assessment
  • Wireless Assessment
  • Social Engineering Assessment
  • Penetration Testing (Express)

When was the last time your organization conducted a risk analysis activity that included a technical vulnerability assessment?

External Vulnerability Assessment

ecfirst will identify vulnerabilities within client’s Internet-facing infrastructure, and attached network systems. The ecfirst testing will analyze client externally accessible servers. Additional IP addresses can be assessed as required.

It is recommended that the testing include the following types of systems:

  • E-commerce servers
  • Internet or DMZ located Database servers
  • Internet screening routers
  • Internet-facing firewalls
  • E-mail server
  • DNS servers
  • Servers storing or processing EPHI
  • Web Applications
  • Other sensitive systems

Internal Vulnerability Assessment

ecfirst will perform an internal network vulnerability assessment on client internal network infrastructure. This testing will verify that the security controls implemented on a sample set of five (5) selected hosts, including servers located in the IT Data Center or desktop PC images and provide an
adequate level of protection against network attacks.

The Internal Network Assessment addresses the following areas:

  • Active Directory
    • Review Identity and Access Management
    • Review passwords in use for complexity
  • Endpoint data loss
    • Review the number of removable mass storage and communication devices connected to company systems
  • SNMP settings
    • Identify systems that respond to default or easy to guess SNMP Community strings
  • SQL servers
    • Identify servers with SQL services listening that allow connections from any host
    • Identify SQL services utilizing default or easy to guess credentials
  • Networked systems
    • Identify vulnerabilities and configuration issues

Firewall Assessment

ecfirst will review the organization’s Internet-facing firewall to identify the current security posture in three critical areas:

  • Rulebase configuration
  • Current IOS (or other operating system) and patch revision release level
  • Vulnerability assessment of configuration file

Rulebase configuration is critical to the integrity and operating security of a firewall. The rulebase should be tied to business requirements. Every rule that is configured on a firewall is essentially a permissible security hole into the company’s network infrastructure. Each of these rules should have a well defined business need for existing. However, many corporations open rules for testing and never close them when the test has completed. Additionally, many rules are opened up because of then-current business needs, but never closed or repaired once that need, or the corresponding business contract, has ended. This results in legacy access and a vulnerability providing a pathway into the internal network.

Wireless Assessment

Wireless networks are particularly vulnerable to attacks because it is extremely difficult to prevent physical access to them. The only advantage they have in this respect is that an attacker must be in relative physical proximity to the network, which can limit the pool of potential attackers. However, with the price of high gain antennas being extremely small, attackers can strike from much further distances with affordable ease. To secure a wireless network, an administrator should know what types of vulnerabilities exist and what types of attacks can exploit them.

During the wireless assessment, ecfirst addresses the following areas:

  • ecfirst will perform a wireless assessment at one location
  • Discovering the Wireless Access Points visible within the location
  • Identify potentially rogue devices – Rogue access points installed by employees without IT departmental consent
  • Determine the existing WiFi Security Infrastructure such as SSID protection; MAC filtering, VPN and encryption mechanism used (if any), and possibly supplicant certificates
  • Attempt to compromise wireless security after sniffing sufficient packets or performing man-in-the-middle attacks

Social Engineering Assessment

Organizations with excellent security programs often spend large amounts of money on capital purchases to implement technical security controls. However, employees or contractors of the entity often prove to be the weak link in the security chain. Employee and contractor education is a key component to any information security program. Authorized members of the workforce have both authenticated access to information systems as well as physical access to facilities and secured areas.

During the social engineering assessment, ecfirst will attempt to gain unauthorized or inappropriate access to facilities, secured areas, documents, credentials, or confidential data. ecfirst security personnel will attempt to bypass security controls that are in-place in order to gain access to various assets. ecfirst will attempt to bypass electronic, personnel, and procedural controls during this assessment. ecfirst will document and present a very detailed record of successes, failures, controls bypassed, access achieved and information obtained during the assessment.

Penetration Testing (Express)

The ecfirst Express Penetration Test is less comprehensive than the full Penetration Test in scope as it only addresses external and internal technical vulnerabilities & threats; physical and personnel vulnerabilities and threats are not evaluated. A detailed technical Corrective Action Plan (CAP) is included in the bizSHIELDtm report to provide actionable directives for addressing the identified deficiencies.

  • External Penetration
    • Reconnaissance phase (including the Google Hacking Database), Web Applications and Networked Systems phases are all performed in 1 day
  • The Internal Penetration (including the Wireless Penetration) is generally performed in 1 day during the onsite visit