One of the most pressing issues in healthcare information technology today is the challenge of securing organizations that operate in the cloud.

Healthcare provider organizations increasingly are turning to the cloud to store sensitive data and back up confidential assets, as doing so enables them to save money on IT infrastructure and operations. 

In fact, research shows that the healthcare cloud computing market is projected to grow by $33.49 billion between 2021 and 2025, registering a compound annual growth rate of 23.18%.

To many in healthcare, the shift to cloud computing seems inevitable. But it also brings unique security risks in the age of ransomware. Indeed, moving to the cloud does not sanctify organizations from risk. 

More than a third of healthcare organizations were hit by ransomware attacks in 2020, and the healthcare sector remains a top target for cybercriminals due to the wealth of sensitive information it stores.

Healthcare IT News sat down with P.J. Kirner, chief technology officer at Illumio, a cybersecurity company, to discuss securing a cloud environment in healthcare and how the zero-trust security model may be key.

Q. Healthcare provider organizations increasingly are turning to the cloud. That is clear. What are the security challenges that the cloud poses to healthcare provider organizations?

A. While healthcare cloud growth comes with certain advantages – for example, more information sharing, lower costs and faster innovation – the proliferation of multicloud and hybrid-cloud environments has also complicated cloud security for healthcare providers in myriad ways. And things will likely stay complicated.

Unlike companies that can move to the cloud entirely, healthcare organizations with physical addresses and physical equipment – for example, hospital beds, medical devices – will permanently remain hybrid. 

Though going hybrid might seem like a transient state for some organizations, most healthcare organizations will find that they need to continuously adapt to a permanent hybrid state – and all the evolving security risks that come with it.

In a cloud environment, it's often difficult to see and detect security risks before they become problems. Hybrid-multicloud environments contain blind spots between infrastructure types that allow vulnerabilities to creep in, potentially exposing an organization to outside threats.

Healthcare providers that share sensitive data with third-party organizations over the cloud, for example, may also be impacted if their partner experiences a breach. Additionally, these heterogeneous environments also involve more stakeholders who can influence how a company operates in the cloud.

Because those stakeholders might be in different silos depending on their specialties and organizational needs – for example, the expertise needed for Azure is not the same as the expertise needed for AWS – this makes the infrastructure even more challenging to protect.

If you're a healthcare provider, you handle sensitive information, such as personally identifiable information and health records, on a daily basis, which all represent prime real estate for bad actors hoping to make a profit.

These high-value assets often live in data center or cloud environments, which an attacker can access once they breach the perimeter of an environment. Because of this, as more healthcare organizations move to the cloud, we're also going to see more attackers take advantage of the inherent flaws and vulnerabilities in this complex environment to gain access to sensitive data.

Q. When it comes to securing healthcare organizations in the cloud, you contend that adopting a zero-trust architecture – an approach that assumes breach and verifies every connection – is vital. Why?

A. We're living in an age where cyberattacks are a given, not a hypothetical inconvenience. To adopt zero trust, security teams need to first change how they think about cybersecurity; it's no longer about just keeping attackers out, but also knowing what to do once they are in your system. Once security teams embrace an "assume breach" mindset, they can begin their zero-trust journey in a meaningful way.

Zero-trust strategies apply least-privilege access controls, providing only the necessary information and access to a user. This makes it substantially more difficult for an attacker to reach their intended target in any attempted breach.

In practice, this means that ransomware cannot spread once it enters a system because, by default, it doesn't have the access it needs to move far beyond the initial point of entry.

Another crucial component in a zero-trust architecture is visibility. As I mentioned, it's difficult to see everything in a cloud environment and detect risks before they occur. The weak spots in an organization's security posture often appear in the gaps between infrastructure types, such as between the cloud and the data center, or between one cloud service provider and another.

With enhanced visibility – for example, visibility that spans your hybrid, multicloud and data center environments – however, organizations are able to identify niche risks at the boundaries of environments where different applications and workloads interact, which gives them a more holistic view of all activity. 

This information is vital for cyber resiliency, and for a zero-trust strategy to succeed – only with improved insights can we better manage and mitigate risk.

In a year where more than 40 million patient records have already been compromised by attacks, it's more imperative than ever for healthcare organizations to make accurate assessments in regard to the integrity of their security postures. 

We'll see more healthcare organizations leverage zero-trust architecture as we head into the new year and reflect on the ways the cybersecurity landscape has changed in 2021.

Q. Zero-trust strategies have gained traction in the past year, especially in tandem with the Biden Administration's federal stamp of approval. From your perspective, what do you think it will take for more healthcare chief information security officers (CISOs) and chief information officers (CIOs) to go zero trust?

A. While the awareness of and the importance placed on zero-trust strategies have grown in the last year, organizations still have a long way to go in implementing their strategies. In 2020, only 19% of organizations had fully implemented a least-privilege model, although nearly half of IT leaders surveyed believed zero trust to be critical to their organizational security model.

Unfortunately, a ransomware attack is often the wake-up call that ultimately prompts CISOs and CIOs to rethink their security models and adopt zero-trust architecture. We've seen an upsurge in cyberattacks on hospitals over the course of the pandemic, threatening patient data.

By leveraging zero-trust solutions for breach containment, healthcare organizations can mitigate the impact of a breach; that way, an attacker cannot access patient data even if they manage to initially breach the system.

Healthcare teams are starting to understand that proactive cybersecurity is essential for avoiding outcomes that may be even worse than compromised data: If a hospital system is impacted by a ransomware attack and needs to shut down, they're forced to turn patients away, neglecting urgent healthcare needs.

Healthcare CISOs and CIOs are beginning to realize that the traditional security measures they've had in place – detection and protecting only the perimeter – aren't enough to make them resilient to a cyberattack. 

Even if you haven't been breached yet, you're seeing attacks seriously impact other hospital systems and realizing that could happen to you, too.

Healthcare CISOs and CIOs who recognize the limitations of a legacy security model against today's ransomware threats will understand the need to adopt a strategy that assumes breach and can isolate attacks, which is what the zero-trust philosophy is all about.

Twitter: @SiwickiHealthIT
Email the writer: bsiwicki@himss.org
Healthcare IT News is a HIMSS Media publication.