下载PDF

CyberArk > 实例探究 > Boston Children’s Hospital Achieves Compliance by Controlling Access to Privileged Accounts

Boston Children’s Hospital Achieves Compliance by Controlling Access to Privileged Accounts

技术

网络安全和隐私 - 身份认证管理
网络安全和隐私 - 安全合规

适用行业

医疗保健和医院

适用功能

商业运营

服务

系统集成
培训

挑战

As one of the largest pediatric medical centers in the United States, Boston Children’s Hospital offers a complete range of health care services for children from birth through 21 years of age. To support this world-class medical center, the hospital’s IT department has created state-of-the-art work and patient care environments to support the evolution and practice of the world’s most advanced and compassionate pediatric care, most sophisticated research, and high-level teaching and training. Like many large organizations, Boston Children’s Hospital needed to find a way to automatically administer and protect the most powerful identities in the company – the privileged accounts and administrator passwords. They allow access to a wealth of sensitive data and powerful systems within the hospital and must be managed very carefully. Sharing administrator privileges or allowing people to jot down passwords on sticky notes was simply unacceptable. The hospital wanted a way to not only protect the identities against unauthorized use, but streamline the process of issuing and revoking special privileges and rights. Previously, it was difficult to keep track of not only who had been issued a privileged password, but it was impossible to determine who was using them, when and what they were accessing. In an IT environment involving children’s patient information, it was critical to be able to have greater visibility into the use of powerful system accounts.

关于客户

Boston Children’s Hospital, located in Boston, MA, is one of the most highly regarded pediatric centers in the country. The hospital offers a comprehensive range of health care services for children from birth through 21 years of age. With an annual revenue of $7,500,000 and over 9,430 employees, the hospital is dedicated to providing world-class medical care, conducting sophisticated research, and offering high-level teaching and training. The hospital’s IT department has created state-of-the-art work and patient care environments to support the evolution and practice of advanced pediatric care. The hospital is committed to ensuring the security and privacy of its sensitive data, particularly the privileged accounts and administrator passwords that allow access to powerful systems within the hospital.

解决方案

In 2005, Boston Children’s Hospital evaluated privileged user management solutions and selected the Enterprise Password Vault (EPV) from CyberArk. This application enables the organization to secure, manage, automatically change, and log all activities associated with privileged accounts, such as administrator on a Windows server, Root on a UNIX server, Cisco Enable on a Cisco device, and embedded passwords found in applications and scripts. The EPV creates a central point for storing, accessing, and maintaining administrative accounts of all kinds (e.g., passwords, keys, applications), while creating a detailed audit trail of all privileged activities, including requests, accesses, retrievals, policy application, and reset processes. Today, more than 75 members of the IT staff use the EPV to provision privileged identities, primarily for use by system administrators and help desk staff needing access to workstation passwords that support various areas of the facility. The process is simple. IT professionals simply log into a web client and use a single console to request, access, and manage these identities.

运营影响

Instead of storing their privileged accounts in an unsecure location, the hospital has a highly secure repository for protecting these powerful 'keys.' The vault technology uses FIPS 140-2 validated cryptography with AES-256 encryption in accordance with PCI requirements.
The software empowered Boston Children’s Hospital to establish and streamline best practices for privileged user management. For example, the organization can quickly disable accounts for departing employees and enact a system to regularly change privileged passwords—a key tenet of any strong privileged identity management program.
The organization can now instantly provision accounts without cumbersome administrative tasks or resorting to weak policies such as issuing generic, shared passwords.

数量效益

More than 75 members of the IT staff use the EPV to provision privileged identities.
The vault technology uses FIPS 140-2 validated cryptography with AES-256 encryption in accordance with PCI requirements.