How Getvisibility helps a European hospital in securing PII and regulated high-risk personal healthcare information in its data silos.
Healthcare providers and national health services have recently been the frontline victims of aggressive and damaging cyber-attacks. Cyber criminals are now using double extortion ransomware to target healthcare providers, where they steal and encrypt sensitive operational data and sell this data to the highest bidder.
The only way for a healthcare provider to find, understand and protect this data is to use advanced Al and machine learning at scale.
A major cahllenge for a large Hospital is to find its data, understand it and help protect this data whilst keeping the data operational for the provision of its services.
This type of exercise has historically been impossible to do, the amount of data and its dynamic nature alongside the accuracy needed was prohibitive, but Getvisibility's Al based solution has now made this possible.
Our client is a mid-sized European hospital, with over 10TB of unknown unstructured data and more than 30 million files. This hospital is subject to GDPR and has had issues with potential ransomware attacks.
Given the sensitive nature of our case study, we have accommodated their request to anonymise all names and places.
Following news that 550 patient records were leaked from Irish hospitals, a hospital wished to lock down PII and PHI from the outset to avoid a data breach. Massive fines for European hospitals already existed, with the biggest in Switzerland of CHF1.5M, payable by Lausanne University Hospital (CHUV) following a data leak incident in 2013 that affected over 100,000 patients.
Our client did not have a data breach, but also they did not want to risk having one. Hospitals and healthcare organisations deal with huge amounts of sensitive data - information about patients, employees, researchers, and other business-related content. With a high number of staff and a growing amount of research being performed by hospital staff, it is becoming increasingly difficult to manually track and manage sensitive data and its access rights.
Identifying sensitive and regulated data on its own is a complex task. The most popular approach to controlling sensitive data is to create an internal policy, that requires end-users to store sensitive and regulated data in specific locations. However, if anyone copies data from a folder that contains PHI/PII data, it gets spread across the entire organisation, meaning the hospital did not have any visibility into their PHI and PII data
The hospital undertook a thorough search for PHI and PII in order to ensure the security and privacy of patient information in its many unstructured data stores, across multiple platforms, after which, Getvisibility revealed a lot of shocking findings.
Data shared with Everyone group allows any user access to the data. Even a guest user can access such data if there is a network connectivity to a file share. This is the number 1 risk in any organisation until the Everyone group share access is removed. Everyone encompasses all users who have logged in with a password as well as built-in, non-password protected accounts such as Guest and LOCAL SERVICE. Which means any user has access to the critical data that contains subjects' information from the above files.
Administrators have access to most of the sensitive data; however this does not mean that the IT adminis- trators need to have access to the protected medical information. It is a widely adopted practise not to give admins access to all available data on the file servers and manage the access to the file servers via the group memberships and following the least privilege model.
Following the least access privilege model, it is highly recommended to share access rights only via group memberships and only the minimal privileges need to be granted for the users to complete their tasks
Before Getvisibility, the hospital was unable to effec- tively identify who had access to regulated data stored in a multi-tier legacy storage infrastructure. Data for electronic patient records were stored on centralised servers, along with other types of data, which made it difficult to identify where specific data was located. The network had turned into a patchwork quilt of different machines and protocols. This made it extremely time-consuming to correlate personal data with its owner and manage access rights.
In addition, after installing Getvisibility, the hospital found that many access right permissions were set inappropriately, leading to excessive exposure of PII and PHI information. The hospital's risk exposure from cyberattacks such as ransomware and malware was extended beyond the perimeter to unstructured data silos in every department. Getvisibility has an out-of-the-box Machine Learning model for identifying PHI and PII information. Our software is proven to be efficient at a high scale complex on premise, cloud and environments.
We were able to scan 11TB of data within a week and turn around with complete visibility around critical and sensitive data including PHI and PII. A hospital used Getvisibility Focus for legacy data discovery and classi- fication. It is a solution that can be deployed in less than two hours and ready to go with out-of-the-box Al engine to find and classify regulated information. This saves hundreds of hours in configuring a solution and in verifying the results comparing to the alternative solutions.
Create a complete register of all PHI and PII data across all data silos.
Find and remediate PHI and PII data shared with the Everyone Group.
Implement the least access privilege model.
Find and remediate files with direct domain administrator access.
Improve the Active Direc- tory Hygiene by:
Data Taxonomy and Comprehensive Management:
Identification and Protection of Regulat ed Data:
Minimise Attack Surface and Controlled Access:
Data Hygiene and Risk Management:
Getvisibility is a trusted leader in data visibility and cybersecurity, providing organisations with the tools they need to safeguard their data and digital assets. With a focus on AI-driven solutions, Getvisibility empowers organisations to proactively manage cybersecurity risks and ensure compliance.
For more information about how we can transform your organisation's data security check out our cybersecurity use cases or contact us today for a demostration and indepth details on our products.
