Although HIPAA does not require a penetration test or a vulnerability scan, risk analysis is an integral part of HIPAA compliance process. HIPAA compliance requires covered entities to test their security controls on a regular basis. Two significant and important methods for testing security controls are vulnerability scanning and penetration testing.
NIST is a widely followed source for industry best practices that has also issued special recommendation for HIPAA that says, “Conduct trusted penetration testing of the effectiveness of security controls in place, if reasonable and appropriate. This validates your exposure to actual vulnerabilities.” It also says to document any deficiencies that are identified in a technically detailed report and include effective, efficient, and clear methods for remediation.
PENETRATION TESTING FOR HIPAA SOLUTIONS
The BreachLock™ cloud platform allows you to evaluate your IT resources and identify vulnerabilities, particularly those that fall under the HIPAA Security Rule Standard. Our manual penetration testing services are aimed at identifying vulnerabilities within your current IT resources and help your organization work toward HIPAA compliance. More importantly, if you are developing an application or infrastructure that will be offered to clients to store or process PHI data, you should execute regular penetration tests and vulnerability scans.
BREACHLOCK™ HIPAA PENETRATION TESTING AND VULNERABILITY SCANNING
BreachLock™ HIPAA penetration testing replicates techniques used by hackers to determine how your system will react to an attack, discover security gaps, and determine what information can be compromised or leaked. Penetration testing is performed against public-facing IT assets and against internal systems from within the network.
Automated scanners are great for identifying vulnerabilities, but penetration tests depend on humans to replicate the attacker mindset when looking at your IT assets. Automated tools do produce quick results but are not exhaustive. A human tester executes manual test cases involving custom tools, scripts, exploits, etc. These efforts should result in the discovery of security gaps that would otherwise be missed. Breachlock™ makes use of both automated and manual penetration testing to ensure you get the best results and can remediate all vulnerabilities.
AUTOMATED SCANNING
Besides manual penetration testing, BreachLock™ also has artificial intelligence aided network and web scanning capabilities. Our web scanner targets and finds common vulnerabilities which affect web applications: SQL injection, XSS, OS Command Injection, Directory Traversal, web server configuration issues to name a few. Our network security scanning capabilities give you capabilities such as continuous network mapping and vulnerability discovery.
INDUSTRY STANDARD METHODOLOGY
Penetration testing methodology and standards are central to the success of any 3rd Party Penetration Testing engagement. Appropriate methodologies and techniques can help security professionals evaluate information security measures in the right and accurate manner. We follow OWASP and OSSTMM.
EXHAUSTIVE REPORTING
BreachLock™ provides in-depth reporting and quality documentation to meet industry standards and compliance requirements. Our example reports of each of the services you need (network, web app, mobile, etc) will ensure you fully understand what to expect as an output of the process. You can also share these sample reports with your auditors to ensure that our final reports will be acceptable to them.
