Ransomware attacks involving lateral movement across flat networks makes segmentation essential for limiting blast radius and protecting patient care systems. Traditional segmentation approaches requiring VLAN changes and extensive hardware deployments are too slow and disruptive for healthcare environments with legacy medical devices running unsupported operating systems. The new HIPAA security rule reinforces this urgency by making microsegmentation a compliance requirement rather than a best practice. St. Luke's University Health Network recognized these challenges and pursued an identity-based segmentation strategy that protects their network without touching critical medical devices or disrupting patient care operations.

In this insightful discussion, Richard Hector of Elisity and Daniel Dopsovic of St. Luke's University Health Network discuss:

• Identity-based segmentation for medical devices without agents or hardware changes;
• Proof-of-value deployment achieving production policies within two weeks;
• HIPAA compliance strategies and cyber insurance benefits through microsegmentation.