Preverity, Inc. a healthcare analytics firm that offers a risk prediction platform for medical malpractice insurance carriers, needed a way to continuously assess the security of its AWS environment, employ security controls to meet current best-practice standards, and meet the security criteria of customers. Preverity solved this challenge by turning to Mission to conduct an AWS security and best-practices assessment report— followed by implementing security controls and training the IT team on how to manage and monitor the environment. The partnership with Mission enabled Preverity to increase its already significant security posture and implement AWS Security Hub to continuously monitor based on best practices. With these capabilities, the Preverity sales team can now reference the strong security posture on customer RFPs, and IT can respond efficiently and easily to security audits requested by customers.
“Our team possesses the required security expertise, but there were a lot of new technologies for us to learn, and security best practices constantly evolve. To roll out new security controls quickly and meet the needs of our customers, we needed to turn to a cloud security partner.”
Scott Burklund
CIO and Co-Founder
From the start of launching operations in 2016, Preverity began provisioning its medical malpractice risk prediction services on the Amazon Web Services (AWS) cloud platform. As the company experienced steady growth, customers began to inquire about the security posture of the environment.
“Many customers are accustomed to working with service providers who operate on-premises environments, so they want to make sure our cloud environment is secure,” explains Scott Burklund, Preverity CIO and a Co-Founder of the company. “To assure top-notch security management and give our customers confidence in our management of such, we felt it was important for a third party to assess our AWS environment and assist in the deployment of necessary controls to meet current security standards.”
Like many CIOs, Burklund keeps his IT team focused on application and database performance to ensure satisfactory experiences for customers and internal end-users. Taking on the security project internally would present a resource bandwidth challenge.
Because of the breadth of technology services offered by AWS, that’s where Burklund chose to deploy the Preverity IT infrastructure and database. He also values the capabilities of compute resources such as Amazon EC2, Amazon Redshift, and Amazon S3 storage, which Preverity uses to store hundreds of billions of rows of data.
“I experienced good results in using AWS for a previous company I worked for, so I knew the technology services were reliable,” says Burklund. “The cloud is ideal for a company like ours when first starting out that needs the ability to grow quickly. AWS is the dominant leader in providing scalable compute resources.”
AWS also provided a big assist in referring Burklund to Mission as the ideal partner for assessing the security of the AWS environment and recommending tools to increase the security posture. Burklund considered other cloud security experts but quickly realized Mission was his best choice.
“Mission not only offers expertise in all AWS technologies, but also provides a deep bench of resources to immediately start projects and complete the work quickly. The other alternatives we considered would have taken a lot longer to implement security measures, and for the benefit of our customers, we did not want to wait.”
Scott Burklund
CIO and Co-Founder
Mission first performed discovery to assess the current security controls and best practices in play within the Preverity environment. Mission then met with Burklund and the IT team to discuss which enhancement measures needed to be implemented. The discussion included determining the tasks Mission would take on, and which tasks the internal IT team would handle on its own.
“We wanted to share the task workload so we could learn about the implemented security controls,” Burklund points out. “In this sense, instead of Mission fishing for us, they taught us how to fish at the same time so we could eventually become self-sufficient.”
Key AWS tools that Mission and Preverity implemented included AWS Security Hub, which involved configuring AWS services to ingest security access and flow logs from AWS CloudTrail, AWS Config, Amazon S3, and Amazon Virtual Private Cloud. Mission also configured Amazon GuardDuty to generate security reports.
In addition, Preverity benefits from AWS tools such as AWS WAF (Web Application Firewall) to block unauthorized network traffic and the Amazon CloudWatch dashboard for monitoring the environment as well as AWS IAM (Identity and Access Management) to enforce multi-factor authentication when users log in. Mission also made recommendations for configuring the single sign-on architecture and automated patching through AWS Systems Manager.
“The weekly meetings Mission conducted with us were very helpful,” Burklund adds. “They reported on the status of their tasks and answered any questions we had about our tasks. Mission also briefed and trained us on the tools they turned on so we would know how to manage them after the project ended.”
When asked about the cost difference in partnering with Mission compared to handling this type of project with internal resources, Burklund says the effort to analyze the cost is almost moot. “The cost to hire someone with the necessary skills would be a lot higher,” he says. “Mission offers a reasonable budget, and we knew we could deploy security controls much faster with an AWS partner rather than hiring someone, which also carries more risk—we might not need that resource once the project is completed.”
The automated processes set up by Mission save a lot of system admin time for the Preverity IT team, which has followed Center for Internet Security best practices by manually going through the 100-item checklist. “The AWS list of best practices is even longer,” says Burklund. “But Security Hub identifies what we need to change and the ancillary services we need for functions such as protecting storage buckets in S3, updating user account keys and passwords, and encrypting data.”
The use of AWS Security Hub has proven helpful in identifying the strength of the Preverity security posture. The rating of the environment quickly increased following the implementation of all the security measures that Mission recommended. And as AWS introduces new security best practices, AWS Security Hub alerts Burklund on what needs to be done to maintain the strong security posture.
“The tools Mission helped us implement are good for detecting a potential problem and alerting us on how to mitigate it,” Burklund says. “Mission also showed us how to use AWS Lambda to automate step functions and other processes to prevent a similar problem from happening in the future.”
The security controls Mission helped Preverity understand are now implemented during the development stage of new application functions. Data scientists now know which best practices to apply as they write software code so application features roll out with a strong security posture already in place.
For the application and databases in production, Preverity uses Amazon GuardDuty to see if any systems are under a DDoS attack or if a hacker is trying to breach a web server. The Amazon CloudWatch dashboard shows how many incidents occur over a specified time period and helps identify keys and passwords that expire or are more than 90 days old.
The Preverity sales team also appreciates the strong security posture, which they reference on customer RFPs. And the environment is now prepared for a full audit if any customer needs to conduct due diligence before signing a contract.
“Having worked for other companies, I know we are now more secure than most,” Burklund says. “Being in the cloud makes it easier to apply concepts such as least privilege access, zero trust, and to ensure data is encrypted in flight and at rest.”
With the Preverity security posture in solid shape, Preverity has picked up enough knowledge from Mission to monitor and manage their AWS environment. Burklund is now engaging with Mission on an AWS Well-Architected Review. He wants to assess if the company can improve the performance and scalability of AWS resources and reduce cloud costs. Burklund would also like to determine if Preverity can operate databases more efficiently and if the company can implement serverless services, such as AWS Athena, Amazon SageMaker for machine learning, and other tools.
“We are knowledgeable in tools like these, but we don’t have the resource bandwidth to fully understand how they work. That’s where a partner like Mission is truly valuable. AWS offers the widest range of cloud services, and when new services emerge, Mission can help us determine which ones will benefit our cloud environment. As our needs change, we also know we can turn to Mission for any cloud services we might need in the future to manage our security posture and improve the performance of our infrastructure.”
Scott Burklund
CIO and Co-Founder