by Matt Ferrari
Chief Technology Officer
When I’m on the road speaking with other CTOs or CIOs and I mention that ClearDATA hardens images according to the Center for Internet Security (CIS) Standards as part of our Defense in Depth strategy for customers, I am typically met with a huge sigh of relief. But not everyone understands what an important feature this is and what a cost-saving and time-saving value it brings to our customers, so I’d like to unpack what we mean by ‘hardened images’ here for everybody.
As with all things cloud, we start with VMs – or virtual machines, which are created from a template called a virtual image machine or virtual server image. The CIS, which is the industry standard for secure configuration guidance and standards, defines these as ‘an operating system (OS) or application environment installed on software that imitates dedicated hardware. The virtual image can be accessed by multiple devices and acts like a physical computer. AWS, Google Cloud Platform, and Microsoft Azure all offer virtual machines or virtual images on their clouds, although they refer to them by slightly different names, such as AMI (Amazon Machine Images) or instances, as two similar examples.
Virtual images can be spun up on your choice of cloud to do your routine computing operations without you having to buy hardware or software, resulting in potentially significant cost savings and one of many reasons healthcare is moving to the cloud. They also result in time savings as they can be spun up or down in minutes, not months. Developers like the time saved, and so do CTO and CIOs who don’t have to purchase and set up hardware, much less install the Operating System or supporting software and drivers for each environment.
Now, on to where does ‘hardening’ come into this…
A hardened virtual server image, usually called a hardened image, is this virtual image devoid of everything unnecessary to the specific task at hand.
This intentional ‘tightness’ with permissions and ports is a mindset that ensures you start secure. It’s a key approach to a Defense-in-Depth strategy that protects your organization and limits your security gaps and vulnerabilities.
However, it’s worth noting that all of this doesn’t mean hardening images is an easy thing to do. The CIS tells us that a single OS can have over 200 configuration settings, so you start to see how having ClearDATA expert staff configure and harden the image vs. doing it yourself in house can be a huge value.
Here are some of the actions we take with hardened images to protect your environment:
- Our hardened images are built to CIS Standards
- Images are released monthly, and patched nightly
- We fully automate the system, meaning we can address any critical vulnerabilities if they come up rapidly – within the same day
- These are available across many different operating systems and available from us for all three major clouds: AWS, GCP and Azure
- Many of our customers may have been months behind in patching prior to us hardening their images and now they have built in rolling updates, so their infrastructure is always up to date and defended
- As new operating system images - or instance types - are released, they get automatically hardened within the ClearDATA tooling. This is especially important when an organization is tearing down environments with each application deployment cycle if they are utilizing blue/green or similar types of deployments.
If you were going to do this yourself, you would need to:
- Buy hardened images through a cloud marketplace or harden them yourself
- Figure out how to ensure they’re always up to date – which may mean patching daily
- Make sure nothing breaks as you are updating
ClearDATA has an automated test suite, which runs assessments and makes sure the hardened images work properly and are properly scanned for known vulnerabilities.
End result: you save time and money on hardware, patching, testing, and monitoring and work with the peace of mind knowing we have created an environment for you that is less prone to attack. Just another reason to bring in our healthcare-exclusive cloud expertise to support your organization.