SOLUTION BRIEF

Tripwire Cybersecurity
and Compliance forHealthcare Organizations
QuoteIn May 2015, Ponemon Institute and ID Experts conducted a benchmark“Almost half of patients
said they’d find a different
healthcare provider if
informed their medical
records were stolen. Given
the lifetime economic valueof a patient, providers are at
risk of losing $305 billion in
cumulative lifetime patientrevenue over the next
five years due to medical
identity theft.”
The $300 Billion Attack:The Revenue Risk andHuman Impact of Healthcare
Provider CyberSecurity Inactionthat found that, for the first time, criminal attacks are primary cause ofhealthcare data breaches. This is a 125 percent increase over the past fiveyears. Why? Because healthcare organizations and their business partners
obtain and share highly valuable patient data. And, taken as a whole, thehealthcare industry provides a large (and growing) attack surface forcriminals who are eager to exploit this information.
Patient records have most everything
the attacker needs in a single record tocarry out sophisticated insurance fraud
schemes, purchase medical supplies ordrugs, or commit other types of fraud
including outright identity theft. Recent
studies have determined that cybercriminals can sell the comprehensive
identity information found in a healthinsurance or patient record for as muchas $1,000 on the black market. Comparethat to the average cost of a stolen credit
card that fetches about $1 on the blackmarket, and you can see why healthcareorganizations are so frequently targeted.
The deployment of new devices—
especially those categorized as IoT thatuse wireless networks and sensors tocollect and exchange information—isa double-edged sword. While thesedevices offer medical environments
tremendous capabilities to care forpatients and increase efficiencies, eachdevice increases an organization’s
attack surface.

— Accenture, 2015

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONS

Adding to the complexity of thesesecurity challenges are compliance andregulatory frameworks (such as HIPAA,NIST, ISO, PCI and COBIT) typicallyenacted to protect systems and sensitive
data. However, since they frequently
evolve to keep pace with information
technology, industry influences and new
threats to systems and data, healthcareorganizations face multiple moving
targets for managing controls andmeeting requirements.

» Automate all security and compliance

All this said, securing patient, customer
and organizational data must be a
top priority. The high price for patient
records, combined with new andgrowing vulnerabilities, provide a great
impetus for cybercriminals to attack.

compliance with security andprivacy requirements.

How to Keep Your Healthcare
Organization Safe
There are several key measures tofollow that help lower the risks ofbreaches and keep your company’s andcustomers’ data safe.

» Build a risk-aware culture. Thisefforts. This helps to:- Discover and profile all businesscritical assets, such as patientcare systems, medical devices,and payment systems.

- Quickly repair configurations
errors- Adjust security controls basedon system changes and business
impact- Monitor, measure and report» Manage incidents with intelligence
to help your organization to respond
more quickly. To do this:- Implement intelligent analytics to
help monitor operations- Implement automated response
capabilities- Integrate next generation threatintelligence solutions with change
detection for advanced threat
detection and response

Tripwire’s Proactive, Continuous
Monitoring Approach
Tripwire has a significant history helping security and IT professionals in thehealthcare industry harden systems andidentify change and vulnerabilities.

» Tripwire is the trusted endpoint
monitoring solution for businesscritical systems, delivering a best inclass solution built on a foundationof innovation and deep security
expertise. Over 9,000 organizations
use Tripwire across a broad platform
on over one million business critical
endpoints.

» Tripwire delivers 10 of the CIS
Controls—with virtually complete
coverage of the first six—which
provides 80% of your security hygiene» Tripwire offers an open architecturewith APIs and frameworks, such as
STIX, TAXII and CybOX, so you canquickly leverage intelligence from avariety of sources to proactively alert
to new threats as they occur

means:- Thoroughly examine anddetermine where in yourorganizations security risks lie- Educate and communicate
with employees to help themunderstand how they can help
close the gaps- Implement the right toolsthat continuously monitor andidentify vulnerabilities andalert employees so that yourorganization can act quickly toreduce the risks.

» Implement foundational controls andbasic security hygiene.

- According to SANS, implementing
the first six CIS Controls provides
a highly effective and efficientlevel of defense against the
majority of real-world attacks,
and provides the necessary
foundation for dealing with moreadvanced attacks

Table 1 The importance of the first six CIS Controls, based on SANS research.

» Tripwire delivers high-fidelity
detection with real-time, continuous
monitoring and correlation
capabilities to detect changes that canpotentially be a targeted attack» Finally, Tripwire has a single multiservice, highly resilient agent foradvanced detection and monitoring
to preempt cyber attacks. It is morereliable, trusted, stable, accurate
and faster than any other method
for monitoring thousands of criticalservers

Advanced Cybersecurity for
Today’s Threats
The solution to the unprecedented
cyberthreat problem that healthcareorganizations face is to implementfoundational controls that integrate into
other solutions to proactively respondto threats. Tripwire delivers foundational controls (including file integrity
monitoring, configuration management,
asset discovery, and vulnerability andA Larger Attack Surface Equals More Exploits
When SANS Institute examined intelligence data specific to thehealthcare sector it found alarming evidence that supports theclaim made in a study by the Ponemon Institute: 94 percent of
medical institutions said their organizations have been victims
of a cyber attack. The SANS analysis “not only confirmed how
vulnerable the industry had become, it also revealed how far
behind industry-related cybersecurity strategies and controls
have fallen.”
The biggest culprits, says SANS, are IoT (Internet of Things)
devices – from connected medical devices to conferencing
systems to edge security technologies. According to thefindings, it was startling to discover that “some of these devices
and applications were openly exploitable (such as default admin
passwords) for many months before the breached organization
recognized or repaired the breach,” evidence that manyorganizations were out of compliance.
Ultimately, advice from SANS to healthcare organizations is toenforce best practices and controls, including:» Know the hardware and software on your network» Be aware of the many attack surfaces and determine theircurrent state» Secure devices by following industry and manufacturer/vendor
best practices» Continually monitor them for unauthorized change or accessTo read the full SANS Institute report, “Health Care Cyberthreat
Report: Widespread Compromises Detected, Compliance Nightmare
on Horizon,” visit: sans.org/reading-room/whitepapers/analyst/
health-care-cyberthreat-report-widespread-compromisesdetected-compliance-nightmare-horizon-34735

log management) to strengthen yoursecurity and compliance posture. Oursolutions are based on high-fidelity
asset visibility and deep endpoint intelligence, combined with business context.
Together, these solutions automate andintegrate security and IT operations.
Each solution has core capabilities indifferent areas in the information security space. They help solve your mostcomplex security and compliance challenges, and help you make better, more
informed decisions. Tripwire even offers
unique monitoring and support for electronic healthcare record (EHR) systems.

Key benefits of Tripwire solutions
include:» An integrated approach to threatprotection based on consolidated
vulnerability and change intelligencethat dramatically accelerates
threat detection and prioritization.
This allows customers to detectcyberthreats sooner by identifying
network “hot spots” indicative of an
attack—places where risk is high andsuspicious changes are occurring.

» Continuous attack surface analysis
that makes it possible for users
to rapidly and proactively identify
the most critical security issues
using business impact and visualvulnerability risk matrix scoring.

- Tripwire® IP360™ facilitates
this analysis by enablingcustomers to discover every
device, software and application
for a comprehensive view of
the network. The solution uses
advanced analytics and a uniquequantitative scoring algorithm
based on several factors—
including the vulnerability
score and business-relevant
asset value—to prioritize thevulnerabilities for remediation.
The result is actionable data thatenables IT security teams to focus
on the tasks that will quickly andeffectively reduce overall network
risk with the fewest possible
resources.

» Significant reduction of enterprisesecurity risks through rapididentification and response to specificvulnerabilities and malware (likeShellShock and Heartbleed) froma continually updated library ofover 100,000 conditions, including
vulnerabilities, configurations andoperating systems, and more than
15,000 applications.

» Improves operational efficiency byprioritizing remediation efforts on thegreatest risks.

» When it comes to compliance,
Tripwire Enterprise offers morethan 800 policies for almost any
platform or device, and for themultiple compliance mandates facedby organizations. Organizations canassess configurations to learn where
they fall short of compliance, getguidance to fix issues, and establish
and maintain configurations in acompliant and secure state. It thendetermines when changes occur tothat compliant and secure state andassesses them to determine if they
introduce non-compliance or security
issues. When Tripwire Enterprisefinds an undesirable change it
offers remediation advice to returnsystems to a compliant state. Tripwire
Enterprise monitors EPIC systems forchange on critical data on the EHR
system while avoiding flooding theprocess with distracting, unhelpfulchange information.

“Tripwire’s automateddiscovery and granularrisk scoring enabled us
to prioritize remediation
around threats faster.
Tripwires’s scaling wascritical since we have awide geographic coverage.”— Large healthcare
insurance provider» Eliminates extensive manual work,saving time and resources, byautomating common responses.

» Additionally, Tripwire solutions
integrate with a number of othersecurity solutions for analytics,forensics, SIEM and threat response.
With these integrations, they deliveractionable reports and alerts andenable the integration of valuable
endpoint intelligence into operational
systems like change managementdatabases, ticketing systems, patch
management and security solutions.

- Tripwire Log Center ® integrates
data from Tripwire Enterprise andTripwire IP360, which provides
organizations with insight into therelationships between suspicious
events, system changes, weak
configurations and current
vulnerabilities. It reduces theworkload and costs associatedwith traditional SIEMs andsecurity analytics solutions by
pre-filtering data and identifying
anomalies and patterns known
to be threats and early indicatorsof breaches. This allows TripwireLog Center to forward only
actionable, relevant data to SOC
staff and third-party tools (suchas threat intelligence solutions).

Good Security Delivers
Effective Compliance
If an organization has implemented good
security processes and controls, they
could be well on their way to meeting
multiple compliance and/or security
standards. Tripwire supports manycompliance mandates (including HIPAAand FDA), and guidelines from NIST.
That support, combined with Tripwire’s
advanced cybersecurity and compliancesolutions, you get proven, industry-recognized security and the ability to meetalmost any compliance mandate. All
while helping you detect and respond to
any threat to your organization’s—andcustomers’—data.

What Next?
To learn more about
Tripwire’s solutions forhealthcare organizations,visit tripwire.com/
solutions/solutions-byindustry/healthcare or
request a demo at
tripwire.com/contact/
request-demoTripwire is the trusted leader for establishing a strong cybersecurity foundation. We protect the world’s
leading organizations against the most damaging cyberattacks, keeping pace with rapidly changing techcomplexities to defend against ever-evolving threats for more than 20 years. On-site and in the cloud, ourdiverse portfolio of solutions find, monitor and mitigate risks to organizations’ digital infrastructure—all
without disrupting day-to-day operations or productivity. Think of us as the invisible line that keeps
systems safe. Learn more at tripwire.com
The State of Security: News, trends and insights at tripwire.com/blog
Connect with us on LinkedIn, Twitter and Facebook©2021 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360, Tripwire Axon and others are trademarks or registered trademarks of Tripwire, Inc. All other product and company
names are property of their respective owners. All rights reserved.
SBHS3a2102