CUSTOMER CASE STUDY MAINEGENERAL HEALTH

Sophos Inspires Healthcare
Provider to Take Its Security to an
Advanced Level of Endpoint andNetwork Protection
MaineGeneral Health is a not-for-profit healthcare provider serving patients in 88
municipalities throughout the Kennebec Valley, which covers more than 5,000 square
miles from central Maine to the Canadian border. MaineGeneral Health offers a broad
spectrum of services, including inpatient and outpatient care, at its Medical Center andone comprehensive outpatient center, state-of-the-art outpatient cancer treatment,
physician practices, nursing homes, home healthcare, and even retirement livingoptions. It is also the largest private employer in the Kennebec Valley.
Senior Information Systems Security Specialist Joshua Dostie has had a long history
with MaineGeneral Health. He initially performed volunteer IT work there when he wasin high school and, after completing his computer science degree, joined the company
as a systems engineer. For Dostie, security has always been a deep-rooted hobby and apassion. He has always made a point of staying on top of the latest malware and security
technologies. When MaineGeneral Health decided to expand its security initiatives in2017 and assigned him to lead the charge, Dostie had the opportunity to turn his passion
into a career.

CUSTOMER-AT-A-GLANCE
MaineGeneral HealthIndustry
Healthcare

Websitemainegeneral.org
Number of Users
3,800

Sophos Solutions
Sophos Intercept X Advanced with EDR
Sophos Intercept X Advanced for Server
Sophos SafeGuard Encryption
Sophos XG Firewall
Sophos Sandstorm for Web Protection Advanced

PARTNER CASE STUDY MAINEGENERAL HEALTH

Challenges
Ì Attaining buy-in to replace out-of-datesecurity with a modern, integrated solution
Ì Educating users and stakeholders about
the importance of proactive security
Ì Safeguarding sensitive health datato comply with the Health Insurance
Portability and Accountability Act (HIPAA)
and protect patient information
Ì Building an in-depth yet easy-to-manage
defense against known and unknown threatsÌ Bridging the gap between prevention andresponse with an automated security solution
Ì Implementing full-coverage network protection

Where do you start when you are
faced with outmoded protection
and a culture that requires security
awareness?
Dostie began by reviewing the state of security
in the organization and discovered that there
was a general feeling that continuous security
improvements within the division was essential.
His goal was to bridge that gap to help make it amore comfortable, recurring topic. Dostie finds
that, in general, healthcare organizations typically
perform a HIPAA risk assessment annually,
internal audits for Payment Card Industry (PCI)
compliance if needed, and some penetration
testing of their existing defenses—but theyrarely take a proactive approach to uncovervulnerabilities. This is largely due to the amountof work that comes with the field that is difficultfor even a fully staffed team to accomplish.
Dostie took on the role of risk advisor and went
deeper, showing IT stakeholders and otherdepartments at MaineGeneral Health the harmthat could ensue from a serious ransomware
attack or breach. Dostie’s motto has always been:“When you are informed, you’ll be secure. For me,
the best way to make people aware is simply toshare knowledge with them.” As an example, hebrought in the Sophos team to show stakeholders
how crippling a ransomware attack could beand how Sophos Intercept X could successfullyblock the threat and mitigate the damage.
The educational and advisory work initiatedby Dostie in 2017 was an eye-opening
experience. Once IT and upper management
became more aware of the potential impact ofcyberattacks, they knew they had to increase
funding to include expanding staff and investingin more advanced security solutions.

How does Sophos help defend anorganization against known andunknown threats?
Fast forwarding to today, the security program
has matured, made great strides, and expanded
significantly, with two additional IT staff
members and an advanced, comprehensive
security solution. MaineGeneral Health now
has a full complement of Sophos solutions
that cover endpoints and the network.
Since his initial call with Sophos, Dostie
was convinced. The level of automation and‘Sophos is
working 24
hours a day, so
I don’t have to.’Joshua Dostie
Senior Information Systems Security
Specialist
MaineGeneral HealthCUSTOMER CASE STUDY MAINEGENERAL HEALTH‘The biggest driver for us was having singlepane-of-glass management to see what’s
going on. The thing with Sophos is that it is
so in-depth – so granular, and yet so simple.’
Joshua Dostie
Senior Information Systems Security Specialist
MaineGeneral Healthintegration that Sophos brings to the table iscompletely in sync with Dostie’s mindset.
“People purchase antivirus to protect what theyknow; we partnered with Sophos to protect
what we don’t know,” says Dostie. “Plus, I can’t
always be at a user’s desk to respond to anincident. Sophos is working 24 hours a day,so I don’t have to – whether there’s a breachor not. The automated processes bridge thatgap between prevention and response.”

How does Sophos security
management make cloud migrationeasier and more seamless?
Another big motivation for moving to theSophos platform was MaineGeneral Health’s
cloud migration initiative, which has goneso smoothly that users hardly notice thechange. Dostie points out that the cloudbased centralized management console,
Sophos Central, perfectly complements thenew cloud infrastructure. Previously Dostie
had to juggle 10 different security consoles,
whereas now he can gain immediate visibility
into his organization’s security postureon premises and in the cloud, along withalerts, all on a single, intuitive dashboard.
“The biggest driver for us was having singlepane-of-glass management to see what’s
going on. Sophos is so in-depth, so granular,
and yet so simple,” affirms Dostie.

What are the Sophos endpoint
technologies that are instrumental
in reducing risk to users, sensitive
healthcare data, and systems?

At MaineGeneral Health, endpoints areprotected by Sophos Intercept X Advanced with
EDR. This solution combines multiple nextgeneration technologies, including machinelearning, a form of artificial intelligence, tocombat ransomware, emerging threats, andthe latest hacker techniques. It also includes
endpoint detection and response (EDR),
which provides guided investigations toprioritize threats and enable deep analysis.
Dostie finds that the product accelerates
forensics: “What I like about Sophos EDR
technology is that, if it detects something like amalicious attachment, I get the alert in minutes
and it paints the whole picture for me so I canfocus on remediation and preventive measures. I
get a snapshot of the affected device right fromthe screen. It basically offloads the heavy lifting.
What would normally take hours is done in less

CUSTOMER CASE STUDY MAINEGENERAL HEALTH‘Having Sophos here is like having an
additional security operations center(SOC) under our control because it’sdoing so much of the work for us.’
Joshua Dostie
Senior Information Systems Security Specialist
MaineGeneral Healththan five minutes. Realistically, these days, wedon’t have to respond to that much anymore
because Sophos does all that work for us.”
When it comes to servers, Dostie and his team
operate under the assumption that they houseor eventually will house sensitive information,
including protected health information (PHI). Heensures that every single server follows HIPAA
guidelines. The team has also deployed theserver version of Sophos Intercept X Advanced,
which has server-specific features and controls
to protect applications and data on servers fromransomware, zero-day threats, credential theftand more – all without impacting performance.
Dostie has taken all these precautionary
measures to reduce risk to MaineGeneral Health.
To further boost endpoint and data security,
Dostie also implemented Sophos SafeGuard

Encryption, an enterprise-strength, alwayson solution that encrypts sensitive data whenit’s created and ensures seamless, securecollaboration. Sophos SafeGuard Encryption
provides both full-disk encryption for Macs andPCs and encryption for individual files. Thisassures Dostie and his team that, even if files
are transferred to a shared folder, removable
USB drive, or the cloud, they will stay encrypted.

security allows us to simplify and consolidate.
In terms of savings, it’s just more efficient forus. Adding in Synchronized Security madesense because we are making the most of what
we have on the network and on the endpoint,”
expresses Dostie. Built-in Sophos Synchronized
Security allows endpoints and the firewall
to communicate with each other and share
information on threats and security posture.

What are the elements required forcomplete network security?

“Sophos Intercept X detects ransomware on aworkstation and sends that information to theSophos XG Firewall, which then blocks internet
or network access. Having Sophos here is likehaving an additional security operations center(SOC) under our control, because it’s doing somuch of the work for us,” observes Dostie.

For network protection, Dostie recently deployed
four Sophos XG Firewalls. These next-generation
appliances provide him with expanded visibility
into the network. “XG Firewall has provided ourentire organization next-generation visibility andprotection. Moving to Sophos for our network

Sophos Sandstorm, which is available onSophos XG Firewall, is a cloud-based sandbox

CUSTOMER CASE STUDY MAINEGENERAL HEALTH

environment that adds an extra layer toMaineGeneral Health’s security. Powerful, cloudbased, next-generation sandbox technology anddeep learning analysis mean Dostie and his team
can quickly and accurately detect, block, andrespond to advanced persistent threats (APTs)
and zero-day threats.

have never been in before? I’ve learned thatit’s critical to communicate with people andmake them feel safe and comfortable. Before
you deploy solutions on your production
systems, put them on a test box and let people
try them out and learn the process. If yourusers are invested, they will support you.”“Sophos does a great job at protecting what
is known, but when you’re wondering about
how to protect against what we don’t know,
Sophos Sandstorm is the answer. When it
discovers unknown software, Sandstorm
looks at its behavior before it even gets tothe internet. I believe Sophos Sandstorm is
an extra sanity check. It helps us feel more
comfortable about giving users access to theweb,” Dostie explains. “Now pretty much every
way into our network is protected by Sophos.”For Dostie, communication and close
collaboration with vendors is also vitally
important. One of the things he likes about
Sophos is the availability of informative, quality
resources like the Sophos Naked Security blogspace and open communication with Sophos
Labs. “If I have something I think is potentiallymalicious and I don’t think it’s getting detected,
I can send the malware sample right over toSophosLabs for analysis, and they get back tome with an assessment. With Sophos, you havethat constant stream of communication that you
really don’t see with other vendors,” he notes.

Why is communication so essential
in the process of transforming
information security?
Throughout this successful journey to the cloud
and a modernized security program, Dostie
has emphasized the value of communication
with the IT team, users, and management.
When it comes to launching a new security
initiative or transforming existing practices,
Dostie shares these words of wisdom withhis peers: “Communication is often the mostdifficult hurdle. If you can’t get buy-in, eventhe greatest initiative in the world won’t go
anywhere. Who wants to drive a car they

Dostie is eager to share his experiences withothers and believes Sophos has provided
many benefits that extend beyond securing
MaineGeneral Health. “When I have aconversation with somebody from Sophos, Ifeel truly inspired to do something new or try
something different. Not only does Sophos
talk the talk, they also walk the walk. Sophos
has just made my career so enjoyable. It’s
gratifying to see how Sophos solutions integrate
and how we can make a positive impact
on both our company and our community,”emphasizes Dostie, with great satisfaction.

Copyright 2020 Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UKSophos is a registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

‘With Sophos,
you have that
constant streamof communicationthat you really
don’t see withother vendors.’
Joshua Dostie
Senior Information Systems Security Specialist
MaineGeneral HealthStart your free trial ofSophos Intercept X
Advanced with EDR today.