Cloud computing is now a fundamental aspect of modern business operations, making the security and protection of cloud-based systems more necessary than ever, especially for government agencies like the Department of Health and Human Services (HHS). However, a recent audit by the HHS Office of Inspector General (HHS-OIG) has uncovered gaps in HHS's cloud security controls, prompting a call for immediate action to address these vulnerabilities.
The HHS-OIG report noted a lack of documented procedures for verifying the accuracy and completeness of cloud system inventory. System owners and System Security Officers within the HHS OS failed to properly identify some of their information systems as cloud-based, leading to their exclusion from the official inventory.
Without a complete inventory of cloud systems, the HHS OS may be unaware of misconfigured cloud systems or vulnerabilities, leaving this data and infrastructure at an increased risk of compromise. Limited visibility into the full scope of the cloud environment can have serious consequences, as cybercriminals may exploit these blind spots to gain unauthorized access or disrupt services.
Read also: A guide to HIPAA and cloud computing
The HHS-OIG audit also revealed that while the HHS OS had implemented some security controls, several controls were incorrect. Control failures were further exacerbated by the HHS-OIG's ability to successfully conduct simulated cyberattacks, exploiting vulnerabilities and gaining unauthorized access to sensitive data and system components.
One of the most concerning security control failures was the lack of multifactor authentication (MFA) for network access on several privileged accounts for a cloud system. MFA is a fundamental security best practice that adds an extra layer of protection to safeguard against unauthorized access, and its absence in this case represents a major vulnerability.
The audit also identified issues with access controls on cloud storage components, where sensitive data was left publicly accessible. Additionally, the HHS OS failed to enforce access control policies on 27 cloud components, exposing sensitive information to potential compromise.
The HHS-OIG report noted that system flaws were not accurately identified, reported, or corrected promptly for cloud components. This delay in addressing known vulnerabilities leaves the HHS cloud environment susceptible to exploitation by threat actors, potentially leading to data breaches or service disruptions.
Another security control failure was the HHS OS's inability to enforce web traffic encryption on a remote server. Unencrypted web traffic can allow attackers to intercept and potentially tamper with sensitive data as it traverses the network, compromising the confidentiality and integrity of the information.
The HHS-OIG audit attributed the security control issues, in part, to the appointment of HHS OS System Security Officers who did not have the necessary skills or training. While the roles and responsibilities were clear, there was no standardized process for ensuring that qualified staff were assigned to these critical positions.
Effective cloud security management requires specialized skills and expertise, including a deep understanding of cloud architecture, security controls, and compliance requirements. Without these competencies, System Security Officers may struggle to properly implement and maintain the necessary safeguards, leaving the HHS cloud environment vulnerable to threats.
The HHS-OIG audit provided several recommendations to address the identified vulnerabilities and strengthen the HHS's cloud security posture:
Related: Ontology for HIPAA compliant cloud services
Cloud information systems refer to cloud computing services that store, manage, and process data over the Internet instead of on local servers. In healthcare, cloud information systems can store and manage protected health information (PHI), offering scalability, flexibility, and cost savings.
Cloud information systems are beneficial because they can enhance data accessibility and efficiency while reducing costs. However, they must be configured and managed to ensure the security and privacy of PHI.
Learn more: HIPAA Compliant Email: The Definitive Guide