Why Healthcare Needs to Move From Perimeter Security to Zero Trust

Image Source: iStock | Why Healthcare Needs to Move From Perimeter Security to Zero Trust

Healthcare security was built around a simple idea. Keep the bad actors outside and trust everything inside.

A firewall at the edge of the network. Controlled physical access to the building. Credentials that grant access to systems once you are in. The assumption underneath all of it is that the threat is external and the internal environment is safe.

That assumption no longer holds. And the evidence that it does not is not subtle.

88% of healthcare data breaches involve a third-party vendor with legitimate access to the network. Ransomware attacks begin with credentials that were phished or purchased on the dark web, used by attackers who are already inside the perimeter before anyone knows there is a problem. The average dwell time between initial compromise and detection in healthcare is over 200 days.

The perimeter model was designed for a world where the network had a clear edge. That world does not exist anymore. Clinicians access systems from home. Vendors connect remotely. Patient data moves between cloud platforms, mobile applications, and on-premise infrastructure. The edge is everywhere, which means the perimeter is nowhere.

This is why zero trust has moved from a security buzzword to a practical necessity in healthcare.

What Zero Trust Actually Means

Zero trust is a security model built around one principle. Never trust, always verify.

Rather than assuming that anything inside the network is safe, zero trust requires verification from every user, every device, and every application trying to access any resource, regardless of where that request originates. Whether the request comes from inside the building or from a remote location, whether the user is a long-tenured employee or a newly credentialed vendor, the system requires verification before granting access and limits that access to what is actually needed for the specific task being performed.

The term was coined in 2010 by Forrester Research analyst John Kindervag, but it has gained urgency in healthcare specifically because of how dramatically the threat landscape has changed. When the perimeter model was designed, a network had a physical location and a defined edge. Zero trust was designed for the world that actually exists now.

Four principles define a genuine zero trust architecture. First, verify explicitly, every access request is authenticated and authorised based on all available data points including identity, location, device health, and the resource being requested. Second, use least privilege access, users and systems are granted only the minimum access required for their specific function, limiting the blast radius if credentials are compromised. Third, assume breach, the architecture is designed on the assumption that an attacker may already be present, and builds detection and containment into every layer. Fourth, segment continuously, rather than a flat network where a compromised credential can move laterally across all systems, zero trust divides the environment into segments that contain the impact of any individual compromise.

Why Healthcare Is a Particularly Strong Case for Zero Trust

Most industries benefit from zero trust. Healthcare benefits more than most.

The clinical environment creates unique security challenges that the perimeter model was never designed to handle. Medical devices connected to the network range from imaging equipment to infusion pumps to patient monitors, many running firmware that cannot be patched and was never designed with security in mind. These devices cannot authenticate the same way a laptop can, but they need network access to function clinically.

The workforce is distributed in ways that make traditional perimeter security nearly impossible. Physicians access EHR systems from home offices, hospital floors, ambulatory clinics, and occasionally from other institutions when covering for colleagues. Telehealth has added patient-facing access to clinical systems that did not exist five years ago. Travel nurses and locum physicians arrive at facilities with minimal onboarding time and need clinical system access immediately.

The vendor ecosystem is large and diverse. A mid-sized health system may have hundreds of vendors with some form of network access, ranging from major EHR providers to small specialty software companies to biomedical engineers who service equipment remotely. Each of these relationships represents a potential entry point into the network.

Zero trust does not solve all of these challenges. But it addresses the fundamental inadequacy of the perimeter model by building security around identity and access rather than location and network membership.

The Four Pillars in a Healthcare Context

Implementing zero trust in a healthcare environment requires addressing four distinct areas.

Identity and access management. This is the foundation of zero trust and the most mature area of implementation in most health systems. Every user should authenticate with multi-factor authentication. Role-based access controls should limit what each user can access to what they actually need. Privileged access management should apply additional scrutiny and controls to accounts with elevated permissions. Service accounts used by applications and integrations should be governed with the same rigour as human accounts.

Device health and trust. Every device accessing clinical systems should meet a defined security standard before being granted access. Managed devices owned by the health system should comply with security policies including patch management, endpoint protection, and encryption. Personal devices accessing clinical systems through BYOD policies should be assessed at the point of access through mobile device management solutions. Medical devices that cannot be managed in the traditional sense require network segmentation that limits their access to only the systems they need to function.

Network segmentation. The flat network model in which a compromised credential can move freely across all systems is incompatible with zero trust. Clinical systems, administrative systems, guest networks, and medical device networks should be segmented so that access to one does not grant access to others. Micro-segmentation at the application layer goes further, limiting access to specific functions within a system rather than the entire system.

Continuous monitoring and response. Zero trust is not a one-time configuration. It requires continuous monitoring of access patterns, device behaviour, and network traffic to detect anomalies that indicate a potential compromise. User and entity behaviour analytics can identify when legitimate credentials are being used in ways that deviate from expected patterns, surfacing potential compromised accounts before an attacker has time to cause significant damage.

Starting the Journey

Zero trust is an architecture, not a product. No single vendor or platform delivers zero trust, and no organisation implements it fully at once. It is a direction, not a destination.

Most health systems that approach zero trust realistically begin with an honest assessment of where they are. What does the current identity and access management landscape look like? Are multi-factor authentication and least privilege access consistently applied? What is the inventory of devices on the network and how many of them can be assessed for health before accessing clinical systems?

The answers to these questions define the starting point. An organisation with strong identity and access management controls but a flat network topology will prioritise segmentation. An organisation with well-segmented networks but inconsistent multi-factor authentication will address identity first.

What matters is not starting in the right place but starting. The 200-day average dwell time in healthcare breaches means that for most health systems, an attacker has already demonstrated that the perimeter model did not keep them out. The question is what happens after they get in.

Zero trust is designed to ensure that getting in does not mean getting everything.