“Shift & Lift" Cloud Migration Approach

Accelerating their future migration to the cloud is much more than just flipping the proverbial switch. The company is 100% committed to its transition to the AWS cloud platform in order to experience greater productivity and additional benefits of scale and agility. Initially, with no prior background or in-depth experience in the cloud, the company looked for a cloud partner with shared principles including rapid innovation and focus on customer satisfaction. In the process of migrating to the cloud, the organization understood that they needed to ramp up on concepts such as “Infrastructure As Code,” DevSecOps, compliance, and shared security responsibility. Moreover, the company discovered that the easiest and least expensive way to migrate an existing workload to the cloud was to take the workload as-is and run it on cloud-native resources via a “Lift & Shift” approach. In essence, this involved transitioning existing workloads/applications and data from on-premises deployments to the AWS (cloud provider) infrastructure.

In a standard “Lift & Shift” cloud migration, there are no significant architecture changes, data flow or authentication mechanisms that are required to migrate since the services are being rehosted on the cloud. Applications are effectively “lifted” from the current environment and “shifted” to the new cloud-hosted framework.

Healthcare Compliance, Certifications and Industry Mandates

The company is firmly committed to meeting the key regulations and industry-defined requirements in order to securely protect sensitive personal health information (PHI). They use Amazon CloudTrail, a service that enables governance and risk auditing to facilitate compliance practices. As a result, the company merits the trust of its patients to manage their care and meet the compliance standard mandates and policies for the healthcare industry (e.g. HIPPA, HITRUST, NIST).

Increasing the scale and sophistication of their security controls, demonstrating a mature security posture and meeting stringent certifications requirements are major differentiators. Moreover, this provides a unique competitive advantage for the company, its patients and healthcare providers.

Shared Security Responsibility

Cloud providers such as AWS possess a shared responsibility model, whereby both this digital healthcare company and the cloud provider have a shared responsibility to protect sensitive data assets. The company needed to understand the types of factors that were specific to the cloud environment and to work towards a solution to address each issue.

An outstanding issue was encryption threats to AWS S3 (Storage) bucket data exposure, since data can potentially (by default) still be stored unencrypted. Prior to migrating to the cloud, there were policies and processes to enforce encryption at rest. Hence, the organization made sure that they automated the bucket encryption in all instances and that they were able to identify any changes made to the S3 bucket and correct accordingly. The design pattern that they utilized can be replicated for all other S3 concerns. Previously, when on-premises, the company relied on firewalls and network security. In today’s cloud environment, potential threat vectors include ports made sensitive due to the relative ease of spinning up a server, exposing those ports to the entire internet. The organization ensured all ports were locked down via auto-correction using technologies they invented and shared with the community as open source.

Security as Code: Automation with Contrast Security and AWS

An innovative, automated blueprint to garner success for the organization was necessary in order to automate, scale, and protect. As the company continues to innovate at breakneck speed, one strategic area of focus has been in deep learning and artificial intelligence. Moving to a secure cloud infrastructure via the “Lift & Shift” approach was identified early on as the most efficient path to remove IT bottlenecks and security barriers. Contrast Security and AWS played a critical role in allowing the organization to move rapidly while allocating resources more effectively and securing assets.

Results

The Doctor will See You Now

Contrast Security and AWS enabled this digital healthcare company to employ a more layered security posture than they had previously, helping them transition more securely to the cloud. The organization’s synchronous technology has significantly reduced patient wait time to just 24 hours. This has helped redefine them as they expand their footprint.

• Reduced costs and greater operational efficiencies
• Less time and cost maintaining their infrastructure
• Reached the highest levels of compliance in healthcare (SOC 2 Type II, HITRUST)
• Reduced the inefficiencies of manual work through automation
• Drove further innovation enabling the businessc

As a Digital Healthcare and Technology company providing online medical care, appointment, and booking scheduling services, the organization has ambitions to optimize and elevate the patient and healthcare practitioner experience. By migrating and utilizing Amazon Web Services (AWS), the company was able achieve these goals with flexibility, reliability, security, compliance, and scalability. The AWS offerings have helped the company launch and integrate new applications quickly and effectively, accelerating time-to-market and providing a key competitive advantage. Implementing Contrast as part of their DevSecOps initiatives enabled the company to further integrate security into existing Agile and DevOps workflows and tools. This allowed them to secure and protect patient and healthcare practitioner data, innovate and deliver products and services to the marketplace much faster, more securely, and at reduced cost.

Amazon Web Services (AWS) Products & Services Used

• AWS Guard Duty
• AWS S3 buckets
• CloudTrail
• CloudWatch
• Dynamo
• EC2 (Servers)
• ElastiCache
• Elastisearch
• Fargate
• Kinesis
• Lambda
• RDS
• Redshift

Contrast Security Products Used

• Contrast Assess

Contrast Integrations

• AlienVault
• Team City
• Slack