How Stratasan Addresses Its Growing Security & Compliance Needs for Healthcare IT and Services Using Threat Stack

Stratasan provides web-based software and professional services that are designed to help healthcare organizations maximize strategic growth through convenient access to useful information on healthcare markets. Healthcare providers, specifically hospitals and hospital systems, struggle to discover the best opportunities in their market for strategic growth, find the right patient populations in their service area, and track their performance and progress against their strategic growth goals. 

By delivering intelligence through proprietary web-based software and a team of seasoned healthcare professionals, Stratasan establishes a foundation for growth in strategic planning, marketing, physician relations, and expansion. Partnering with nearly 1,000 hospitals across 40 states, Stratasan helps them achieve efficiency and effectiveness in their strategic planning initiatives. 

This blog post outlines how Stratasan uses Threat Stack to gain the visibility, multiple tiers of monitoring, and auditable data, it needs to address its growing security and compliance needs.

Initial Challenges

Stratasan’s need for a cloud-native security solution emerged about five years ago, driven by the fact that they work with PHI under HIPAA regulations and have to complete a third-party audit every year. After reaching out to several peers in the healthcare sector, Brian Dailey, Stratasan’s Co-Founder and CTO, followed up on a recommendation to adopt Threat Stack’s Cloud Security Platform® . (Now known as F5 Distributed Cloud App Infrastructure Protection (AIP) Advanced.

For Stratasan, which was then a 15-person company with limited personnel and financial resources, Threat Stack was a perfect fit: It not only met their number one requirement — the ability to provide host-based intrusion detection as required by HIPAA — but also came with easy-to-follow documentation for setup and use. According to Brian, “Any Devs on our team could have set it up. The platform was straightforward, well documented, and as a result, we had it rolled out within a couple of weeks of deciding to adopt it.”

Increasing Requirements & Growing Benefits

Although Stratasan’s initial usage amounted to little more than a basic checkbox response to HIPAA, Threat Stack delivered increasing value as Stratasan made a commitment to using the platform more systematically. 

Better Communication & Increased Visibility

Shortly after adopting Threat Stack, Stratasan integrated it with Slack, which increased visibility into their systems without the need to continually log into Threat Stack. This also significantly increased the level of communication on their team. Simply by using Slack, they could receive real-time notifications if a machine had been accessed, a file had been changed, etc. — and communicate with each other on how to follow up.

While admitting that improved communication is hard to quantify, Brian points out that once you’ve seen its impact on your day-to-day, you realize it’s essential: “You don’t have a security breach every day or something that requires further investigation, but you do talk to your team each day. So you’ve got to have effective communication to address issues, improve operations, and ensure that dev, security, and operations are all working together to drive common business goals.”

Audit Records for HIPAA

Having auditable data is a requirement in the healthcare sector, so Stratasan relied heavily on Threat Stack’s ability to help with HIPAA: “We have to make it easy for an assessor to validate that we’re doing what we say we’re doing, and Threat Stack provides insights into who is doing what, where, and when — along with an audit trail and reports that can be passed along to an auditor.”

Containerization & Full-Stack Visibility

While Stratasan doesn’t necessarily intend to become fully containerized, they have adopted containers to create a pattern of repeatability across different environments from Development through to Production.

Having secure EC2 hosts initially allowed Stratasan to identify threats in real time and distinguish between normal behavior and events that needed investigation. Going on to leverage Threat Stack’s container monitoring capabilities, gave Stratasan observability throughout its stack and SDLC, strengthening security at all levels and phases. Being able to rely on multiple tiers of monitoring throughout its environment gives Stratasan confidence that they’re “not just crunchy on the outside and soft on the inside.”

Third-Party Expertise

The recent addition of Threat Stack’s Oversight℠  (aka Distributed Cloud AIP Premium) Service has provided third-party security insights and expertise, enabling Stratasan to keep all of its in-house resources focused on the company’s core competencies. As Brian points out, “We’re a small team, we’re budget conscious, and we don’t have a dedicated security person, so we rely on our Dev team to be familiar with our security practices. In light of this, having third-party experts watching our operations is both cost-effective and helpful.”

As Stratasan’s needs have grown from the initial requirement for host-based intrusion detection and support for HIPAA to its current roster of technical, compliance, and operational demands, the company has derived ever more value from the Threat Stack Cloud Security Platform and Oversight Service. 

Brian Dailey is confident that the relationship between Stratasan and Threat Stack will continue. Asked whether he would recommend Threat Stack’s platform to others in the healthcare sector, he spoke about its suitability “for similar size organizations with a cloud presence, that are using containers, and that may or may not have a dedicated security person.” He went on to say that Oversight “augments a team in a compelling way, especially if you’re in healthcare. To gain continuous high-level visibility into what’s going on, it definitely makes sense to have an extra set of eyes at your disposal.”

As Stratasan continues to evolve its technical infrastructure, scale its data processing capacity, and expand its customer base, it plans to stay with Threat Stack as a means of strengthening its security and compliance, optimizing its operations, and achieving its overall business goals.

If you’d like to learn more about the Threat Stack Cloud Security Platform or the Threat Stack Cloud SecOps Program℠, which includes the Oversight Service, please contact us for a demo. Our experts are looking forward to discussing  your specific compliance and security requirements.