In an industry as highly regulated as healthcare, building a single secure and compliant application that tracks patient care and appointments at a clinic requires a great deal of planning from development and security teams. So, imagine what it would be like to build a solution that includes almost everything related to a patient’s healthcare, including insurance and billing. That’s what Highmark Health (Highmark)—a U.S. health and wellness organization that provides millions of customers with health insurance plans, a physician and hospital network, and a diverse portfolio of businesses–decided to do. 

Highmark is developing a solution called Living Health to re-imagine healthcare delivery, and it is using Google Cloud and the Google Cloud Professional Services Organization (PSO) to build and maintain the innovation platform supporting this forward thinking experience. Considering all the personal information that different parties like insurers, specialists, billers and coders, clinics, and hospitals share, Highmark must build security and compliance into every part of the solution. 

In this blog, we look at how Highmark Health and Google are using a technique called “secure-by-design” to address the security, privacy, and compliance aspects of bringing Living Health to life.

Secure-by-design: Preventive care for development

In healthcare, preventing an illness or condition is the ideal outcome. Preventive care often involves early intervention—a course of ideas and actions to ward off illness, permanent injury, and so on. Interestingly, when developing a groundbreaking delivery model like Living Health, it’s a good idea to take the same approach to security, privacy, and compliance. 

That’s why Highmark’s security and technology teams worked with their Google Cloud PSO team to implement secure-by-design for every step of design, development, and operations. Security is built into the entire development process rather than waiting until after implementation to reactively secure the platform or remediate security gaps. 

It’s analogous to choosing the right brakes for a car before it rolls off the assembly line instead of having an inspector shut down production because the car failed its safety tests. The key aspect of secure-by-design is an underlying application architecture created from foundational building blocks that sit on top of a secure cloud infrastructure. Secure-by-design works to ensure that these building blocks are secure and compliant before moving on to development.

The entire approach requires security, development, and cloud teams to work together with other stakeholders. Most importantly, it requires a cloud partner, cloud services, and a cloud infrastructure that can support it. 

Finding the right cloud and services for secure-by-design 

Highmark chose Google Cloud because of its leadership in analytics, infrastructure services, and platform as a service. In addition, Google Cloud has made strategic investments in healthcare interoperability and innovation, which was another key reason Highmark decided to work with Google. As a result, Highmark felt that Google Cloud and the Google Cloud PSO were best suited for delivering on the vision of Living Health—its security and its outcomes. 

“Google takes security more seriously than the other providers we considered, which is very important to an organization like us. Cloud applications and infrastructure for healthcare must be secure and compliant,” explains Highmark Vice President and Chief Information Security Officer, Omar Khawaja. 

Forming a foundation for security and compliance

How does security-by-design with services work? It starts with the creation and securing of the foundational platform, allowing teams to harden and enforce specified security controls. It’s a collaborative process that starts with input from cross-functional teams—not just technology teams—using terms they understand, so that everyone has a stake in the design. 

A strong data governance and protection program classifies and segments workloads based on risk and sensitivity. Teams build multiple layers of defense into the foundational layers to mitigate against key industry risks. Google managed services such as VPC Service Controls help prevent unauthorized access. Automated controls such as those in Data Loss Prevention help teams quickly classify data and identify and respond to potential sources of data risk. Automation capabilities help ensure that security policies are enforced.

After the foundational work is done, it’s time to assess and apply security controls to the different building blocks, which are Google Cloud services such as Google Kubernetes Engine, Google Compute Engine, and Google Cloud Storage. The goal is to make sure that these and similar building blocks, or any combination of them, do not introduce additional risks and to ensure any identified risks are remediated or mitigated. 

Enabling use cases, step by step

After the foundational security is established, the security-by-design program enables the Google Cloud services that developers then use to build use cases that form Living Health. The service enablement approach allows Highmark to address complexity by providing the controls most relevant for each individual service. 

For each service, the teams begin by determining the risks and the controls that can reduce them. The next step is enforcing preventive and detective controls across various tools. After validation, technical teams can be granted an authorization to operate, also called an ATO. An ATO authorizes the service for development in a use case.

For use cases with greater data sensitivity, the Highmark teams validate the recommended security controls with an external trust assessor, who uses the HITRUST Common Security Framework, which maps to certifications and compliance such as HIPAA, NIST, GDPR, and more. A certification process follows that can take anywhere from a few weeks to a few months. In addition to certification, there is ongoing monitoring of the environment for events, behavior, control effectiveness, and control lapses or any deviation from the controls.

The approach simplifies compliance for developers by abstracting compliance requirements away. The process provides developers a set of security requirements written in the language of the cloud, rather than in the language of compliance, providing more prescriptive guidance as they build solutions. Through the secure-by-design program, the Highmark technology and security teams, Google, the business, and the third-party trust assessor all contribute to a secure foundation for any architectural design with enabled Google Cloud services as building blocks. 

Beating the learning curve 

Thanks to the Living Health project, the Highmark technology and security teams are trying new methods. They are exploring new tools for building secure applications in the cloud. They are paying close attention to processes and the use case steps and, when necessary, aligning different teams to execute. Because everyone is working together collaboratively toward a shared goal, teams are delivering more things on time and with predictability, which has reduced volatility and surprises. 

The secrets to success: Bringing everyone to the table early and with humility

Together, Highmark and Google Cloud PSO have created over 24 secure-by-design building blocks by bringing everyone to the table early and relying on thoughtful, honest communication. Input for the architecture design produced for Highmark came from privacy teams, legal teams, security teams, and the teams that are building the applications. And that degree of collaboration ultimately leads to a much better product because everyone has a shared sense of responsibility and ownership of what was built. 

Delivering a highly complex solution like Living Health takes significant, more purposeful communication and execution. It is also important to be honest and humble. The security, technology, and Google teams have learned to admit when something isn’t working and to ask for help or ideas for a solution. The teams are also able to accept that they don’t have all the answers, and that they need to figure out solutions by experimenting. Khawaja puts it simply, “That level of humility has been really important and enabled us to have the successes that we’ve had. And hopefully that’ll be something that we continue to retain in our DNA.”

These days, using a password alone to secure user accounts containing sensitive, identifiable, or private information just isn’t sufficient. Passwords are often subject to reuse and can easily be phished and stolen. 

With this in mind, we recently teamed up with researchers from New York University and the University of California, San Diego to find out just how effective basic account hygiene is at preventing account takeovers. The research showed that simply adding a SMS as a second factor to a Google account can block up to 100% of automated bots, 96% of bulk phishing attacks, and 76% of targeted attacks that occurred during our investigation.

To help you enhance the security of your apps and protect your users, Identity Platform now supports multi-factor authentication (MFA) with SMS in beta.

You can now configure Identity Platform to require users who attempt to login to your application to self-enroll in MFA—also known as two-factor authentication (2FA)—and register a device that is capable of receiving SMS messages. When users attempt to sign-in to your app with their first-factor credential (email/password, social login, SAML, OIDC), Identity Platform will require them to enter the six-digit authentication code that it sends via SMS to their registered devices before they can sign-in to your apps and services. 

Getting started

You can learn more about this new feature by checking out the documentation page. To get started with Identity Platform, enable it in GCP Marketplace, watch our Cloud Next ‘19 presentation, and read the quickstart.

When it comes to cloud security, 2022 will be the year that the past catches up with the future. Trends that businesses have been ignoring for too long will force organizations large and small to confront and control their security debt. 

That’s according to Google Cloud’s own cybersecurity experts, who have identified four security trends that organizations need to watch out for—and get ahead of. We have predictions on what to expect in the coming year from MK Palmore, director of the Office of the CISO; Brian Roddy, vice president of engineering for Cloud Security; Tim Dierks, engineering director for data protection; and Panos Mavrommatis and Vikram Makhija, senior directors of security engineering for Google Cloud.

Supply chain shenanigans

“We will see continued asymmetric attacks from adversaries as they exploit supply chains and other previously ‘trusted’ third-party entities,” says Palmore. 

Supply-chain problems in cloud computing should be easily solvable, right? Software versions and any vulnerabilities they contain should be trackable and patchable, but the reality of fixing software is that “just patch it” is hard to execute—just look at the challenges posed by the Log4j 2 vulnerability. Supply chain is such a huge problem that President Biden addressed it in an Executive Order in May 2021. Customers can expect the issue to be top of mind at Google Cloud.

Not exactly many happy returns (to the office)

“Return to office around the world will drive changes as office infrastructure has not been invested in for a year and a half while the focus has been on remote users. This likely will drive a short-term boom in traditional on-prem security, but it will be the last boom for that as people adapt their remote, zero-trust style strategies to a more modern on-prem approach,” says Roddy.

The misconception that on-prem infrastructure is categorically more secure than cloud is driven by the desire to have physical access to servers and backups so that only the organization which owns the data controls it and has access to it, even in cases of a catastrophic failure or successful cyberattack. In the early years of cloud computing, that may even have been true. But the conditions that drove the myth of on-prem security primacy changed years ago, and the needs driving secure cloud infrastructure help ensure that cloud stays more secure. 

Paying down your security debt

“While there’s all the new hotness of cutting-edge concerns, many enterprises still carry security risks and security debt from not yet fully adopting controls which have been broadly accepted as important for years. For example, loads of companies are still not using phishing-resistant two-factor authentication such as FIDO keys,” says Dierks.

Authentication keys such as those made by Yubico and Google’s own Titan Security key support the zero-trust security principles that require user identities to be authenticated, authorized, and then continuously validated before they can access applications and data. Strong authentication is such an important part of contemporary user security that even weaker forms of it that rely on text messages are significantly more secure than not using it at all. That said, why use a less-secure standard when you can reduce risks to your data and bottom line even further by requiring a phishing-resistant hardware key?

Dierks stresses another challenging but important part of eliminating security debt: using social connections to encourage best security practices. “It’s important for CISOs to use their business relationships to emphasize the importance of baseline controls [such as 2FA] for their partners. Enterprises have close relationships that attackers can leverage, so it’s critical that partners hold each other accountable to maintain high security.” 

KYD (Know Your Data)

The impact of a data breach can harm organizations as they currently are as well as far into the future. Current tough-to-crack encryption standards protecting data could become easier to decode in the years ahead, so even if cybercriminals can’t access stolen data now there’s no guarantee that paradigm will hold. This means it’s crucially important that organizations understand what data they’re storing, how they’re storing it, and where they’re storing it, say Mavrommatis and Makhija.

“You can’t secure what you don’t know about, and not all data breaches are equal. Stolen machine logs are not as bad as customer data. But how many security teams know the difference? So you have to crawl your own data to automatically classify and discover where sensitive data lives,” they say.

Makhija adds that the shared fate model requires the cloud providers and cloud customers to have a mutual understanding of the quantitative risks each faces. “Shared fate models will pick up significantly in 2022,” he says, as more organizations move to the cloud, and those already using cloud infrastructure improve their security postures. 

“To date, there’s been a disparate set of tools for understanding your posture. It’s difficult for third-party tools to stitch together what cloud services should be providing from the start,” he says. 

What you can do to make your organization more secure

One cloud security trend that’s ever-present is the ever-increasing importance of keeping cloud deployments secure. As cloud infrastructure becomes more commonplace across businesses and industries of all sizes, it will continue to grow as an attractive target for cybercriminals and other threat actors.

• Because enterprise data has expanded exponentially, the ability to identify and detect threats have become increasingly challenging. To better secure the enterprise software supply chain, use advanced threat detection and analysis tools—especially those designed to catch anomalies. 
• The faster that organizations adopt a zero-trust architecture, the more secure the new normal can be. Zero trust helps limit the blast radius of any potential intrusion, while maximizing new enterprise access expectations. Part of adopting zero trust means many end-users can abandon legacy technology like VPNs, but the benefits of segmentation and context-aware access for both identity and device will make all the difference for large scale enterprises. When coupled with a full zero-trust approach and the use of a zero-trust maturity model for improvement, organizations will be better positioned to manage their digital risks.
• Security debt can come in many forms and one critical payoff that needs to be made is for organizations to migrate en masse to hardware two-factor authentication keys. They make user accounts significantly more resistant to takeovers, and are much harder to circumvent than two-factor authentication over SMS. 
• It’s past time to get to know your data, and a bouquet of flowers and a bottle of red wine won’t help. There are third-party tools that can do this, but for Google Cloud customers who use BigQuery there’s automatic Data Loss Prevention. It continuously monitors existing tables and profiles new ones; it can be customized for selected folders or projects, or for an entire organization; and it generates data profiles in the same geographic region as the original data.

Understanding and managing the security challenges of cloud infrastructure helps maximize its benefits, and makes for a safer security landscape in 2022—and beyond.

Want to know the latest from Google Cloud? Find it here in one handy location. Check back regularly for our newest updates, announcements, resources, events, learning opportunities, and more. 

Tip: Not sure where to find what you’re looking for on the Google Cloud blog? Start here: Google Cloud blog 101: Full list of topics, links, and resources.

Week of May 24-May 28 2021

• Google Cloud for financial services: driving your transformation cloud journey–As we welcome the industry to our Financial Services Summit, we’re sharing more on how Google Cloud accelerates a financial organization’s digital transformation through app and infrastructure modernization, data democratization, people connections, and trusted transactions. Read more or watch the summit on demand.
• Introducing Datashare solution for financial services–We announced the general availability of Datashare for financial services, a new Google Cloud solution that brings together the entire capital markets ecosystem—data publishers and data consumers—to exchange market data securely and easily. Read more.
• Announcing Datastream in Preview–Datastream, a serverless change data capture (CDC) and replication service, allows enterprises to synchronize data across heterogeneous databases, storage systems, and applications reliably and with minimal latency to support real-time analytics, database replication, and event-driven architectures. Read more.
• Introducing Dataplex: An intelligent data fabric for analytics at scale–Dataplex provides a way to centrally manage, monitor, and govern your data across data lakes, data warehouses and data marts, and make this data securely accessible to a variety of analytics and data science tools. Read more. 
• Announcing Dataflow Prime–Available in Preview in Q3 2021, Dataflow Prime is a new platform based on a serverless, no-ops, auto-tuning architecture built to bring unparalleled resource utilization and radical operational simplicity to big data processing. Dataflow Prime builds on Dataflow and brings new user benefits with innovations in resource utilization and distributed diagnostics. The new capabilities in Dataflow significantly reduce the time spent on infrastructure sizing and tuning tasks, as well as time spent diagnosing data freshness problems. Read more.
• Secure and scalable sharing for data and analytics with Analytics Hub–With Analytics Hub, available in Preview in Q3, organizations get a rich data ecosystem by publishing and subscribing to analytics-ready datasets; control and monitoring over how their data is being used; a self-service way to access valuable and trusted data assets; and an easy way to monetize their data assets without the overhead of building and managing the infrastructure. Read more.
• Cloud Spanner trims entry cost by 90%–Coming soon to Preview, granular instance sizing in Spanner lets organizations run workloads at as low as 1/10th the cost of regular instances, equating to approximately $65/month. Read more.
• Cloud Bigtable lifts SLA and adds new security features for regulated industries–Bigtable instances with a multi-cluster routing policy across 3 or more regions are now covered by a 99.999% monthly uptime percentage under the new SLA. In addition, new Data Access audit logs can help determine whether sensitive customer information has been accessed in the event of a security incident, and if so, when, and by whom. Read more.
• Build a no-code journaling app–In honor of Mental Health Awareness Month, Google Cloud’s no-code application development platform, AppSheet, demonstrates how you can build a journaling app complete with titles, time stamps, mood entries, and more. Learn how with this blog and video here.
• New features in Security Command Center—On May 24th, Security Command Center Premium launched the general availability of granular access controls at project- and folder-level and Center for Internet Security (CIS) 1.1 benchmarks for Google Cloud Platform Foundation. These new capabilities enable organizations to improve their security posture and efficiently manage risk for their Google Cloud environment. Learn more.
• Simplified API operations with AI–Google Cloud’s API management platform Apigee applies Google’s industry leading ML and AI to your API metadata. Understand how it works with anomaly detection here.
• This week: Data Cloud and Financial Services Summits–Our Google Cloud Summit series begins this week with the Data Cloud Summit on Wednesday May 26 (Global). At this half-day event, you’ll learn how leading companies like PayPal, Workday, Equifax, and many others are driving competitive differentiation using Google Cloud technologies to build their data clouds and transform data into value that drives innovation. The following day, Thursday May 27 (Global & EMEA) at the Financial Services Summit, discover how Google Cloud is helping financial institutions such as PayPal, Global Payments, HSBC, Credit Suisse, AXA Switzerland and more unlock new possibilities and accelerate business through innovation. Read more and explore the entire summit series.
• Announcing the Google for Games Developer Summit 2021 on July 12th-13th–With a surge of new gamers and an increase in time spent playing games in the last year, it’s more important than ever for game developers to delight and engage players. To help developers with this opportunity, the games teams at Google are back to announce the return of the Google for Games Developer Summit 2021 on July 12th-13th. Hear from experts across Google about new game solutions they’re building to make it easier for you to continue creating great games, connecting with players and scaling your business. Registration is free and open to all game developers. Register for the free online event at g.co/gamedevsummit to get more details in the coming weeks. We can’t wait to share our latest innovations with the developer community. Learn more.

As part of our efforts to democratize Zero Trust, Google Cloud has designed our BeyondCorp Enterprise solution to be an extensible platform where customers can choose to integrate signals from other technology vendors and incorporate these into their Zero Trust access policies. Following our integrations announcements earlier this year, we are excited to announce a new BeyondCorp Enterprise integration with Microsoft Intune, now available in Preview.

This integration allows organizations to craft Zero Trust access policies and protect private applications and SaaS applications, including Office 365, based on data collected from the Intune graph API, including device posture and other trust signals. It can also be leveraged to configure context-aware access policies for Workspace applications.

These policies can be applied across end-user devices, no matter where they are located. The ability to leverage device information to make access decisions is a critical component of a Zero Trust approach. Intune is a widely used mobile device management (MDM) tool and many of our customers will be able to benefit from this integration to help ensure that their distributed workforce can appropriately access corporate resources.

The BeyondCorp Enterprise integration with Microsoft Intune collects data from Intune using the Microsoft Graph API. End-user device information collected by the connector is then fed into Access Context Manager, a component of BeyondCorp Enterprise, to gate access to resources based on policies and access levels.

Customers are already seeing the benefits of the BeyondCorp Enterprise integration with Microsoft Intune. For example, one of our customers, a global ecommerce vendor, uses it to ensure their corporate-owned devices comply with internal policies before they are able to connect to corporate resources. With the Intune integration, they are then able to quickly and easily configure context-aware access policies with an attribute that company-owned devices must be in compliance in order to access the specific applications.

Previously, without the integration, they would need to set up a custom integration and manage both the code and the infrastructure where it was running. This integration not only alleviates the need to create custom code, but the customer has also seen a reduction in the time it takes to onboard new devices and build these policies.

If you’re interested in learning more or joining the preview, a full reference guide to the Intune integration can be found in our documentation here.

We believe that customers should be able to leverage their existing technology investments to build a more secure ecosystem. BeyondCorp Enterprise can help ensure that the right people have access to the right resources—only authorized users should be able to access only the resources that they have been approved for, based on their identity and device information. Google Workspace customers can also incorporate signal information from other vendors, including Intune, to create context-aware access policies for securing Workspace applications.

Earlier this year, we announced Netskope as a new member of the BeyondCorp Alliance to enable integration of a user’s risk score between Netskope Cloud Exchange and Google Cloud. We also announced new integrations with Jamf Pro for MacOS, which shares the Jamf-determined compliance state with BeyondCorp Enterprise so admins can incorporate this information into context-aware policies to restrict or allow access to protected applications.

You can learn more about BeyondCorp Enterprise integrations by registering for Google Cloud Next ‘22 on October 11-13, and attending the “What’s New in Zero Trust” session. Google Cloud will also be featured at the upcoming Jamf Nation User Conference (JNUC), September 27-29, to discuss BeyondCorp Enterprise integrations with Jamf.