Phoenix Cyber delivers cybersecurity project management and security engineering expertise to Southwestern U.S.-based Integrated Health System

The Challenge

A Southwestern U.S.-based Integrated Health System that includes multiple hospitals, a multi-specialty medical group with nearly 1000 providers, and a statewide health plan, had many security tactics already in place to reactively defend against cyber threats and attacks. However, facing newly evolved threats and challenges to further ensure the security of their critical healthcare information and data, the integrated health system desired a more proactive approach. They sought out Phoenix Cyber’s technical expertise to assess their current security practices, build a framework to manage their overall security posture and maintain compliance with regulatory requirements, as well as provide direction for their day-to-day in-house cybersecurity projects.

As cybersecurity leads, we work collaboratively across the organization to communicate with senior leadership and key stakeholders, coordinate resources to complete project milestones, provide staffing allocation and support the efforts of third-party security vendors, and provide regular technical expertise and engineering support on various cybersecurity projects. Our solutions are developed, delivered, and maintained while coordinating across security operations, information technology, and key business unit and hospital leadership stakeholders.  

For over a decade, Phoenix Cyber senior cybersecurity consultants have assisted with a number of high profile initiatives for the healthcare organization to fortify their security defenses: 

• Cybersecurity Program Assessment and Build Out: Our governance and risk security experts delivered an ISO 27001 risk assessment to help the integrated health system identify, analyze, and evaluate weaknesses in their information security processes. The team created a roadmap to fortify the weaknesses identified during the assessment and then managed many of the corresponding security initiatives to completion. 
• Identity and Access Management: We provided program-level management and technical support in the successful transition and and mass deployment of a two-factor authentication solution for the entire healthcare organization.  
• Data Security: Our security consultants completed a data protection initiative, working collaboratively with internal teams to identify and define various important sensitive data types and then develop the processes for the extraction and consumption of large volumes of data from the cloud. Once extracted, we provided high-level reporting, enriched the data, and provided the analysis findings to help the integrated health system better understand where and how sensitive information was being stored, transmitted and consumed throughout the organization.  
• Network security: Our cybersecurity consultants spearheaded the retirement and migration of VPN solutions, ensuring that all of the integrated health system’s remote users could leverage the new product and that all applications were in working order throughout the migration. In addition, our consultants laid the groundwork for upgrades and deployments of various network access controls by managing both the overall project preparation and configuration and a cross-function team of internal and third-party vendor resources.  
• Governance, Risk, and Compliance (GRC):  After reviewing the integrated health system’s current cybersecurity standards and policies for completeness, our security architects mapped them back to specific cybersecurity standards and frameworks, such as NIST and ISO 27001.  This helps to provide direction on the next steps for the organization’s day-to-day in-house security initiatives. 
• Security Automation: We implemented a security orchestration, automation and response solution for a phishing use case and brought security automation capabilities into the organization. 
• Endpoint Security: Our cybersecurity consultants managed the migration from one endpoint detection and remediation tool to another, while ensuring business continuity throughout the migration.  

After conducting the initial security program assessment, the integrated health system has gained a comprehensive understanding of their cybersecurity risks and potential weaknesses. The implementation of foundational security controls reduced vulnerabilities and enhanced the organization’s overall security posture. The focus on network, data, and authentication security controls, including multi-factor authentication and data loss prevention provides robust protection of critical patient data. By implementing a GRC practice and aligning information technology and security operations with business objectives, the organization is more effectively managing risk, meeting regulatory compliance requirements, and improving governance processes. 

In addition to increased cybersecurity effectiveness, the integrated health system has realized financial savings by  rapidly migrating to new, more scalable products and removing outdated third-party solutions. The organization can now better manages third-party vendors and hold them accountable in delivering on their promises by getting the products to production quickly and based on best practices as Phoenix Cyber consultants take the lead on project delivery.  

Lastly, many of these security initiatives have led to more efficiencies across the integrated health system’s cybersecurity department. The reports from each assessment have resulted in fortification of the security budget and personnel needs to accomplish the highest priority risk items. Now Phoenix Cyber consultants can act as a force multiplier for the organization’s cybersecurity team and deliver critical projects more quickly and effectively.  

CONTACT US AT [email protected]