New cloud-based machine learning tools offer programmatic approach to security

For years, many healthcare organizations tended to be skeptical and resistant (if not outright hostile) to the idea of storing their data, particularly protected health information, in the cloud. IT and security decision-makers had deep reservations about stashing such sensitive data anywhere but their own on-premises servers, safe under their own watchful eyes.

But not too long ago that changed, and seemed to change quickly. To the surprise of many, over the past few years, it appears that many healthcare providers have been getting markedly more comfortable putting their trust in the cloud.

“If you had asked me in 2011, I would have predicted that healthcare would still be one of the slower moving industries,” said Jason McKay, chief technology officer of Logicworks, a managed hosting company that helps organizations in many sectors build and manage cloud infrastructure. “We were surprised at the uptake.”

Part of that is the obvious benefits of speed and agility that remote hosting has to offer. Partly it has to do with the recent attention paid to healthcare’s very specialized needs by giants such as Amazon Web Services, IBM, Google and Microsoft Azure, such as their willingness, only in the past several years, to sign onto HIPAA-compliant business associate agreements and gain HITRUST certification.

Yet another reason seems to be that, as the relentlessness and creativity of malware, ransomware, spyware and other cybersecurity exploits have ramped up in recent years, these major cloud players have been upping their own games – rolling out advanced artificial intelligence and machine learning capabilities to combat those threats to protect their clients’ hosted data.

Now the answer seems obvious to many: Who’s more likely to have a handle on the myriad threats to sensitive patient data? A small hospital with a dozen or so capable but overmatched IT staffers? Or a global hosting company with hundreds of security and AI experts, laser-focused on protecting information assets?

The trust level in the cloud has evolved to the point that Beth Israel Deaconess Medical Center CIO John Halamka, MD, put it: “I predict that five years from now none of us will have data centers. We’re going to go out to the cloud to find EHRs, clinical decision support, analytics.”

For his part, McKay – who, as CTO of Logicworks, works with major cloud companies – has some advice for hospital CIOs and CISOs looking to avail themselves of some of the recent AI-driven innovations in healthcare security.

It’s not just a matter of adopting new technologies such as Amazon‘s Macie and GuardDuty, he said. As useful as those tools are in their approach to stopping threats, it’s important to have good processes in place for enterprise-wide infrastructure security, because often those capabilities will still require some tough decisions about the risks they sniff out.

With Macie, Amazon deploys artificial intelligence to automate the discovery, classification and protection of sensitive data in the AWS cloud. The tool can detect sensitive data such as protected health information or Social Security numbers and, with dashboards and alerts, offers visibility into how the data is being accessed or moved in the cloud. The technology looks out for anomalies and can issue alerts when it finds unauthorized access or data leaks.

GuardDuty, meanwhile, is described by Amazon as a managed threat detection service that scans continually for any malicious or unauthorized behavior. Its threat intelligence uses machine learning to find anomalies in the account and workload activity – looking for unusual API calls, for instance, or potentially unauthorized deployments that could point toward an account compromise. When a potential threat is detected, the service delivers a detailed security alert to the GuardDuty console and AWS CloudWatch Events to help make alerts more actionable.