SSH Keys: Security Asset or Liability for Healthcare?

With the extensive network systems found in the healthcare industry, SSH keys are widely used to provide privileged administrative access and to secure machine-to-machine automation for important business functions. However, SSH keys are routinely untracked, unmanaged and unmonitored. This lack of visibility and control can create HIPAA violations by not adequately restricting access to Electronic Protected Health Information (ePHI). If SSH keys are not surely managed, the organization does not know who has access. In this session, we’ll examine SSH study results that reveal widespread lack of security controls for SSH keys in the healthcare industry. We’ll discuss the common mistakes that almost all healthcare organizations make around security, policy, and auditing practices when managing SSH keys.