Security that spread across every team, one rotating engineer at a time.

Situation

RelayHealth recruited me as its Principal AppSec Architect. A number of development teams were building across the exchange on a Microsoft stack hosted on Azure, carrying a FedRAMP Moderate authorization. The exchange hosted health records and passed them between medical facilities. My architecture review found many gaps: no federated authentication, and a backlog of code deficiencies that engineering time was not allocated to fix.

Objective

Protect the health records on the exchange against HIPAA violations, close the architecture gaps, advance the federal-compliance posture, and get the code backlog remediated.

Approach

• Federated authentication. The exchange did not have it, so I designed the system to support it.
• HIPAA protection of health records. Core to the authentication work, including federation for customers, was enforcing protection of the health records hosted on the exchange and passed between medical facilities. We enforced encryption in transit and encryption at rest. Leading application security architecture here was critical to protecting RelayHealth and its customers against HIPAA violations.
• The federal direction. I worked closely with the lead of the FedRAMP engagement, which the Air Force sponsored. I also explored what was coming as the US government moved toward a sliced-off, unified gov-internet with its own CAs and access control, the FedRAMP High and GovCloud direction.
• Training and reference code. I ran training on preventing XSS and SQL injection, and wrote the model code for parameterized, protected SQL queries as the reference pattern.
• The rotating security engineer, the move I’m proudest of here. I requested and got to hire an engineer, then offered each engineering manager a deal: this person is a taskable resource for up to 50% of their time on your feature work, and the other 50% is dedicated to security fixes and to coaching your staff on remediation. The engineer rotated to a new team every 2 to 3 sprints, so security fixes and skills spread across the whole org.
• New-engineer security onboarding. I gave the standing intro when engineers joined. It covered the OWASP Top 10 and house rules like “only a lawyer calls something a breach.” A whole section covered the need to protect health records and enforce that protection, including making sure RelayHealth’s own staff could not view the data passing through the exchange.

Net results

• Remediation got done, and developers got better.
• The rotating security engineer worked extremely well, spreading security fixes and skills across the whole org.
• Health records on the exchange were protected with encryption in transit and at rest, and the federal-compliance posture advanced.

In early 2016 I joined Nike’s cybersecurity program.

Takeaway: if you can’t buy developer time, create a resource managers want.

Scope and technologies

Microsoft stack on Azure. HIPAA. Encryption in transit and at rest. FedRAMP Moderate, with an eye to the FedRAMP High and GovCloud direction. Federated authentication architecture. SAST and secure-coding practice. Parameterized-query reference code. OWASP Top 10-based developer training.