The Need

As a community-based hospital, Fort HealthCare was in search of a security partner that would assist in the development and execution of a comprehensive cybersecurity program within a reasonable budget. Specifically, Fort HealthCare was in search of a company that would assist in building out the fundamentals of a solid security program that would guide the tactical actions the organization would need with respect to patch management.

Given Fort HealthCare’s resource limitations, it was also important that any security program that was created would guide their team directly to areas that would have the biggest impact on their security posture.

Jamie Smith, manager of Technology Systems, heads a small yet versatile team of IT professionals for Fort HealthCare that often gets pulled in many directions. To optimize the team’s time and efficiency, the organization needed meaningful security information that is easily accessible and prioritized with actionable next steps.

This need was fully evident on the weekend of May 12, 2017 when “WannaCry” – the largest ransomware cyberattack in history – began infecting numerous corporations, governments and healthcare providers. In fact, during the crisis, the United Kingdom’s National Health Service was forced to temporarily cease operations and divert patients at some locations. However, through the efforts of Jamie and his team, along with Fortified’s support, Fort HealthCare was prepared.

The Solution

For close to two years, Fort HealthCare IT department had been leveraging Fortified’s Vulnerability Threat Management (VTM) solution to get regular monitoring and remediation insights. The VTM managed service was one component of the comprehensive Virtual Information Security Program (VISP) Fortified developed in partnership with the health system, which gave the organization’s leaders confidence to know they are being watched over and informed by a team of cybersecurity experts.

In the instance of WannaCry, Fortified’s routine monthly scan of Fort HealthCare’s network along with the detailed analysis and risk stratification completed by a Fortified security analyst identified the need to install the Microsoft patch months prior to the ransomware attack. Fortified prioritized this patch, and the team members worked to gather important documentation needed for a successful patch implementation.

The VTM service employed a standard, continuously improving process, which included the following:

  1. Ordering a pre-configured appliance and shipping directly to Fort HealthCare
  2. Providing detailed guidance on appliance installation and final configuration
  3. Monthly scans to determine vulnerabilities and develop trends
  4. Dedicated analyst reviews and prioritizes patches to maximize Fort HealthCare’s efforts
  5. Monthly technical calls to review trends, priorities and develop an action plan

Fortified’s VTM solution and expert services team helps the organization effectively monitor and facilitate the remediation of some of today’s top cyber threats and exploits.

The Outcome

Fort HealthCare vulnerability threat management service began in conjunction with an information security risk assessment and an external network penetration test. Within the first month’s vulnerability scan, the health system identified vulnerabilities that were previously unknown. Fort HealthCare’s team immediately formulated a plan for remediation on most exploitable vulnerabilities.

Although vulnerabilities fluctuate from month-to-month based on the timing of patches, Fort HealthCare experienced a greater than 50 percent reduction in critical and high vulnerabilities within six months of engaging Fortified. Fortifed’s customized vulnerability scan dashboard contains graphs and trending charts, which gave Fort HealthCare the ability to measure vulnerabilities over time. In most cases, the graphs and reports showed a drastic downward trend in the amount of critical and high information asset vulnerabilities.

In the wake of WannaCry, while many healthcare providers worked 24-hour shifts trying to resolve vulnerabilities, Fort HealthCare saw no major incidents and patient care was not impacted.

“Fortified gives us confidence to know we adhere to the latest cybersecurity best practices,” says Smith. “Their proactive insights offer knowledge and resources we may not have on our own, while also keeping us focused on the most pressing needs. They’re on top of their game.”