Suppose you are an experienced IT professional or consultant working in the private sector. You get a new job working in the US Healthcare industry. On starting your new job, you learn about the Health Insurance Portability and Accountability Act (HIPAA) Security Rule and the consequences of failure to comply with it. As an IT professional, you understand that a crucial component of mitigating cyber threats is to implement server hardening, but how does this relate to HIPAA? You do some research and discover the HITRUST Common Security Framework (CSF). On paper, it provides everything you need to implement and prove that you did it. You download the PDF and are overwhelmed by the size and scope of the document.
This article is the first in a two-part series that introduces you to the CSF, explains its underlying concepts, and shows you how to navigate it to find what you need. The second article will apply this knowledge and show how the CSF applies to server hardening.
What You Will Learn
- What is HIPAA’s Security Rule
- How HITRUST helps you implement it
- What is the HITRUST CSF
- Understand key CSF concepts such as Controls, Objectives, and Specifications.
- How to navigate the CSF and understand how it relates to server hardening
- How CalCom’s Hardening Suite can help you implement and comply with CSF requirements
See how CalCom enabled secure, compliant servers without impacting patient care.
What is HITRUST CSF
As its name suggests, the Health Information Trust Alliance (HITRUST) was created by the US Healthcare industry to ensure HIPAA Security Rule compliance. In practice, this meant that providers were unable to assess the potential threats and vulnerabilities to their IT infrastructure, and they were also unable to meet HIPAA’s legislative requirements. This is why they created the HITRUST CSF.
The HITRUST CSF is a framework that helps highly regulated industries, like healthcare, implement a diverse range of data privacy and IT security standards. CSF builds on and combines elements of federal and state legislation, US government and industry standards, and international regulations, including HIPAA, NIST, the California Consumer Privacy Act, GDPR, and PCI-DSS. Organizations use CSF as a foundation to build customized solutions that meet their specific needs. Once an organization has implemented CSF compliance, HITRUST provides assessment and certification.
Navigating CSF
At over 600 pages, the CSF is a long document. Let’s examine how the CSF is structured, how to navigate its requirements, and how this relates to both HIPAA and cybersecurity.
The CSF is divided into 14 control categories. Each control covers a specific aspect of cybersecurity. Control Category 09.0 deals with Communications and Operations Management.
Each control category is broken down into objectives, each with its unique name. Objective Name: 09.06 Network Security Management covers network security. Its control objective is to:
Ensure the protection of information in networks and network infrastructure.
Each objective is further broken down into control references, each with its control specification. Control Reference: 09.m Network Controls Control specification states:
Networks shall be managed and controlled to protect the organization from threats and maintain security for the systems and applications using the network, including information in transit.
Following the specification, the CSF provides implementation requirements, organization, and regulatory factors. These are prioritized by level (1, 2, etc.). The Level 3 Organizational Factors encompass the number of licensed beds, covered lives, transactions, and admitted patients, among other factors. These are followed by Supplemental requirements that provide specific implementation, such as server hardening, as illustrated by this extract from Level Community Supplemental Requirements 002 Implementation (example):
The organization utilizes a hardened intermediary system, running only a pre-defined set of applications (without Internet access or office productivity applications), to prevent end-users from directly communicating to administrative network zones and control privileged access for administrators, developers, and others who need greater network access than regular end-users, to perform their job duties.
Putting it all Together and Next Steps
The HITRUST initiative was created by an alliance of Healthcare providers struggling to implement HIPAA, specifically HIPAA’s Security Rule. CSF builds on and normalizes a diverse range of sources, including federal and state legislation, US government and industry standards, and international regulations. HITRUST has been so successful that it has been adopted by other highly regulated industries, such as banking. In this article, we introduce you to the HITRUST CSF, explaining basic concepts such as Controls, Objectives, and Specifications. Using these concepts, we demonstrated how to navigate the CSF and identify specific requirements related to server hardening. In the final part of this series, we will delve deeper into the CSF and its relationship to server hardening.
Key Takeaways
- The importance of HIPAA’s Security Rule
- Understand how HIPAA and HITRUST work together and compliment each other
- Learning how HITRUST is structured
- How to use CSF concepts such as Controls, Objectives, and Specifications
- Locate and implement CSF server hardening requirments
- How CalCom’s Hardening Suite can help you implement and comply with CSF requirements
How CalCom Can Help You
The HITRUST CSF is an excellent resource for implementing server hardening. If you want to move beyond running basic hardening scripts and deploy a fully automated, intelligent solution, then CalCom can help you with CalCom’s Hardening Suite (CHS). CHS doesn’t just apply a baseline; it learns your needs, identifies misconfigurations, tests changes, and continuously monitors, all without any disruptions. CalCom is ideal for enterprise environments, those looking to scale, or for low-risk hardening. To learn more, go to our resources page and download our datasheets and white papers.
How to plan and manage your hardening project
