Health-ISAC shares zero trust implementation guide for CISOs

Zero Trust Architecture can increase efficiency for healthcare CISOs, but not without unique challenges. Challenges with adopting a zero trust security model in healthcare boil down to two key issues: the rapid expansion of IoT devices and authentication complexities tied to “the roaming nature of some healthcare workers,” according to a new white paper from the Health-ISAC.

The new whitepaper adds zero trust components to the Health-ISAC Framework for Managing Identity released in 2020. The framework has been updated with zero trust concepts and “incorporate additional controls to deliver core elements of a zero trust architecture,” including standards for securing communications, asset monitoring, perimeters for granting access, policy-based authorization, and adding devices to target systems and resources.

Core Tenets of Zero Trust for Healthcare​

• Tenant 1: All data sources and computing services are considered resources.
  • Explanation Networks may be made up of multiple types of devices from cloud services, laptops, mobile devices, even personal devices that could be used to access resources.
  • Healthcare implications: Healthcare organizations have multiple types of devices – echocardiograms, infusion pumps, blood oxygen measurement, sending data to central monitoring stations.
• Tenant 2: All communication is secured regardless of network location.
  • Explanation: Network communication is secured regardless of whether it is inside or outside of the perimeter. All communication should be done in the most secure manner available, protect confidentiality and integrity, and provide source authentication.
  • Health care implications: Communication with the network and all devices – including IoT devices – must be secure via encryption or other secure method.
• Tenant 3: Access to individual enterprise resources is granted on a per-session basis.
  • Explanation: Trust is evaluated before access is granted with least privilege in mind.
  • Health care implications: For caregivers and individuals accessing multiple applications at different times their access rights need to be evaluated and sessions established appropriately.
• Tenant 4: Access to resources is determined by dynamic policy and may include other behavioral and environmental attributes.
  • Explanation: An organization protects resources by defining its resources, its members, and the resources those members need to access. In addition to authentication and authorization at the time of request, zero trust may also look at behavioral attributes – i.e., device analytics and environmental factors, such as network location, reported activity.
  • Health care implications: For caregivers and individuals accessing multiple applications at different times their access rights need to be evaluated and sessions established appropriately.
• Tenant 5: The enterprise monitors and measures the integrity and security posture of all owned and associated assets.
  • Expanation: Constant monitoring of all devices on a network to detect potential breaches or vulnerabilities.
  • Health care implications: In a health care setting the number of devices present on a network is more than what a typical enterprise may see and securing all of these different devices that use different standards could be challenging.
• Tenant 6: All resource authentication and authorization are dynamic and strictly enforced before access is allowed.
  • Expanation: All devices must have identities and roles within the enterprise to access only the necessary resources.
  • Health care implications: Individuals and devices must have restricted access based on least privilege.
• Tenant 7: The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications and uses it to improve its security posture.
  • Expanation: Constant monitoring of all individuals, devices, and the network to spot anomalous or suspicious behaviors.
  • Health care implications: Monitoring all employees and devices on a network to prevent unauthorized behavior.

Read the Full Whitepaper​

The whitepaper includes the following topics:

1. A definition of zero trust
2. How zero trust fits into the Health-ISAC Framework for managing identities
3. Core Tenets of zero trust and the implications for healthcare organizations
4. Healthcare specific challenges with zero trust
5. Steps to begin implementing zero trust

Reference Stories​

• H-ISAC article announcing the Whitepaper
• SC Magazine's Story
• Health IT Security's Story

ModernCyber's Zero Trust Assessment​

Whether you are just starting, in the midst, or completed your zero trust journey, ModernCyber's Zero Trust Assessment evaluates your current zero trust architecture and capabilities for all zero trust domains. Schedule some time to speak with one of our experts.