• Search in Protiviti.com

Leading CRM Provider Improves Configuration Checks on AWS Resources to Comply with HIPAA Framework

Published on June 16, 2023

Challenge

A globally-recognized CRM provider engaged Protiviti to assist them in determining methods to better protect customer data while complying with each customer's unique regulatory requirements. The client needed an efficient method to perform configuration checks on AWS resources to ensure it would remain compliant with the HIPAA framework so that it could grow its footprint in the healthcare industry.

Client Snapshot:

Profile 

This leading CRM provider has built its globally recognized brand by earning the trust of its customers through transparency, security, compliance, privacy and performance to deliver the industry's most trusted infrastructure.

Client Situation 

The client needed to more effectively protect customer data and comply with each customer’s regulatory requirements.

Work Performed 

Protiviti worked with the client to implement AWS Config, manage AWS Config rules, conformance packs, and aggregators to build a comprehensive solution.

Outcome/Benefits 

Provided a master list of all in-scope resources that can enable or disable encryption at rest. Identified risk areas across 50+ AWS resources to be adjusted prior to declaring a HIPAA self-certification.

Solution

The first major concern involved checking encryption across all services. To do so, Protiviti leveraged AWS Config to deploy rules that perform resource checks consistent with HIPAA’s stringent requirements. Protiviti also implemented a custom conformance pack to package desired rules and deploy them across all relevant regions and production accounts within the client’s AWS environment.

Utilizing AWS

Throughout the engagement, Protiviti utilized AWS Config, managed AWS Config rules, conformance packs, and aggregators to build a comprehensive solution. The conformance pack consisted of 27 AWS managed rules and covered 16 services utilized by the client, allowing them to easily package rules for deployment. In addition, an aggregator was configured to centralize results from all production accounts and regions to one location.

Protiviti also developed custom AWS Config rules with AWS Lambda to perform more complex checks on AWS IAM resources to ensure least privilege and company policies are being followed. Lastly, Protiviti leveraged Amazon CloudTrail and CloudWatch to log and monitor API calls to AWS Config.

Outcome

Protiviti provided the client with a master list of all in-scope resources that can enable or disable encryption at rest. The project team also identified risk areas across 50+ AWS resources to be adjusted and re-reviewed prior to declaring a HIPAA self-certification. This process saved the client’s GRC and engineering teams 6000+ hours to perform sampling of various AWS resources across all services in use.

The client's GRC and engineering teams saved 6000+ hours in sampling AWS resources across all its conformance pack services.

Secure your cloud environment with Amazon Web Services (AWS)

Cloud technology is revolutionizing businesses globally and transforming entire industries across sectors and regions. It facilitates the creation of innovative business models, improves customer and partner relations, and enables a smooth transition from outdated systems to flexible, scalable, and efficient IT infrastructure.
Learn More

Automate AWS Digital Identity and Access Management Review

Often, there exists the need to perform one-time and regular reviews of Identity and Access Management (IAM) health to answer some of the basic, yet critical questions security professionals care about: 1) Who is entitled to perform what actions against what resources? 2) Are there orphan identities? 3) Am I granting service access to identities that do not utilize them?
Read More

How Encryption Works in AWS

Encryption is a topic that many people easily recognize the importance of, but often fail to appreciate the complexity around it. And complexity only increases when enterprises shift to a cloud environment because cloud services options are expanding at an exponential rate.
Read More
Loading...