CyberArk > Case Studies > Boston Children’s Hospital Achieves Compliance by Controlling Access to Privileged Accounts

Boston Children’s Hospital Achieves Compliance by Controlling Access to Privileged Accounts

Customer Company Size

Large Corporate

Region

America

Country

United States

Product

Enterprise Password Vault

Tech Stack

FIPS 140-2 validated cryptography
AES-256 encryption
LDAP authentication

Implementation Scale

Enterprise-wide Deployment

Impact Metrics

Cost Savings
Customer Satisfaction
Productivity Improvements
Digital Expertise

Technology Category

Cybersecurity & Privacy - Identity & Authentication Management
Cybersecurity & Privacy - Security Compliance

Applicable Industries

Healthcare & Hospitals

Applicable Functions

Business Operation

Services

System Integration
Training

About The Customer

Boston Children’s Hospital, located in Boston, MA, is one of the most highly regarded pediatric centers in the country. The hospital offers a comprehensive range of health care services for children from birth through 21 years of age. With an annual revenue of $7,500,000 and over 9,430 employees, the hospital is dedicated to providing world-class medical care, conducting sophisticated research, and offering high-level teaching and training. The hospital’s IT department has created state-of-the-art work and patient care environments to support the evolution and practice of advanced pediatric care. The hospital is committed to ensuring the security and privacy of its sensitive data, particularly the privileged accounts and administrator passwords that allow access to powerful systems within the hospital.

The Challenge

As one of the largest pediatric medical centers in the United States, Boston Children’s Hospital offers a complete range of health care services for children from birth through 21 years of age. To support this world-class medical center, the hospital’s IT department has created state-of-the-art work and patient care environments to support the evolution and practice of the world’s most advanced and compassionate pediatric care, most sophisticated research, and high-level teaching and training. Like many large organizations, Boston Children’s Hospital needed to find a way to automatically administer and protect the most powerful identities in the company – the privileged accounts and administrator passwords. They allow access to a wealth of sensitive data and powerful systems within the hospital and must be managed very carefully. Sharing administrator privileges or allowing people to jot down passwords on sticky notes was simply unacceptable. The hospital wanted a way to not only protect the identities against unauthorized use, but streamline the process of issuing and revoking special privileges and rights. Previously, it was difficult to keep track of not only who had been issued a privileged password, but it was impossible to determine who was using them, when and what they were accessing. In an IT environment involving children’s patient information, it was critical to be able to have greater visibility into the use of powerful system accounts.

The Solution

In 2005, Boston Children’s Hospital evaluated privileged user management solutions and selected the Enterprise Password Vault (EPV) from CyberArk. This application enables the organization to secure, manage, automatically change, and log all activities associated with privileged accounts, such as administrator on a Windows server, Root on a UNIX server, Cisco Enable on a Cisco device, and embedded passwords found in applications and scripts. The EPV creates a central point for storing, accessing, and maintaining administrative accounts of all kinds (e.g., passwords, keys, applications), while creating a detailed audit trail of all privileged activities, including requests, accesses, retrievals, policy application, and reset processes. Today, more than 75 members of the IT staff use the EPV to provision privileged identities, primarily for use by system administrators and help desk staff needing access to workstation passwords that support various areas of the facility. The process is simple. IT professionals simply log into a web client and use a single console to request, access, and manage these identities.

Operational Impact

Instead of storing their privileged accounts in an unsecure location, the hospital has a highly secure repository for protecting these powerful 'keys.' The vault technology uses FIPS 140-2 validated cryptography with AES-256 encryption in accordance with PCI requirements.
The software empowered Boston Children’s Hospital to establish and streamline best practices for privileged user management. For example, the organization can quickly disable accounts for departing employees and enact a system to regularly change privileged passwords—a key tenet of any strong privileged identity management program.
The organization can now instantly provision accounts without cumbersome administrative tasks or resorting to weak policies such as issuing generic, shared passwords.
The hospital staff has responded favorably to the application. 'Our people like the EPV concept and find the software easy to use,' said Mary Travers, a data security analyst for Boston Children’s Hospital. 'The software deployment and rollout was easy, and the folks at CyberArk were on hand for training. Our experience working with their support team has been very positive. They respond quickly even for non-critical issues.'
The hospital IT staff is already looking forward to new ways it can enhance password protection. It is planning to upgrade to the latest edition of the EPV to take advantage of LDAP authentication. The hospital is also considering deploying the Central Policy Manager, a key module for automating and managing password resets on a host of target systems.

Quantitative Benefit

More than 75 members of the IT staff use the EPV to provision privileged identities.
The vault technology uses FIPS 140-2 validated cryptography with AES-256 encryption in accordance with PCI requirements.