Change Healthcare

Change Healthcare wanted to ensure continued rigorous security and management of their Azure systems through an audit, penetration testing, and subsequent recommendations. When we came on board, they used Microsoft Azure for provision of services in capacity management and staff scheduling for hospitals.

The Change Healthcare team based in New Zealand manage their own Azure environments for New Zealand and Australian hospitals. Our relationship with them (and their precursor companies) goes back to 2007 so we were well acquainted with a good portion of the environment configuration.

We started with a focus on redeveloping the existing systems documentation to cover all the current environments. This included:

• Exporting a detailed configuration from Azure on subscriptions, resource groups, network security groups and virtual machines;
• Recreating detailed network diagrams from our originals to include additional Azure assets and encompass configuration information pertinent to ongoing management;
• Creating standard IT systems documentation for each subscription covering the resources in terms of networks, servers, and backups.

This was followed by recommendations that tied together the details of the various documentation files with discoveries made during the auditing process; including:

• Azure resources still incurring costs but no longer in use;
• General improvements in naming and labelling and documenting practises;
• Specific recommendations around configuration issues, security, and variances with best practices.

The final stage of our work was to estimate overall security through penetration testing of the Azure environments. We completed more than 70 tests over a period of six weeks.