MedVantage's PHI Exposure and Identity Debt
MedVantage is a health insurer with 2,000 employees and 1.2 million members. It runs Active Directory on-premises, a SaaS CRM holding member contact data, and an IaaS data lake with claims and PHI in object storage. An audit finds 14 shared administrative accounts with permanent global administrator rights in the IaaS tenant; three publicly readable object storage buckets, one with 40,000 claim files; impossible-travel sign-ins to the CRM from two countries within 20 minutes; a 90-day patch cycle for internet-facing VMs; and centralized logs retained only 7 days. The CISO has six months and a fixed budget. The business insists that clinician lookup of member eligibility stay under 300 ms, and the CRM vendor supports only SAML federation, not direct directory integration. No breach has been confirmed, but the board wants a prioritized plan, not a tool list.
1. Rank the top three risks and justify the ranking using likelihood, impact, and evidence - not just risk labels.
Read the worked answer
Rank by likelihood × impact and by whether the risk is already materializing.
- Public buckets containing PHI. Likelihood is high because exposure already exists; impact is regulatory, financial, and reputational, with 40,000 claim files in one bucket. This is the only finding with evidence of actual exposure. Confirm scope and preserve logs before remediation.
- Shared permanent global administrator accounts in IaaS. Likelihood of credential compromise or insider misuse is high; impact is full tenant takeover, including the data lake. Permanent global admin also defeats least privilege and makes attribution difficult.
- Impossible-travel sign-ins to the CRM. Likelihood of credential compromise is moderate to high; impact is member contact data and downstream phishing. This is a detected signal, not a hypothesis.
The 90-day patch cycle and 7-day log retention are serious enabling risks: they increase the duration and reduce detection of the first three. But a plan that starts with patching while PHI remains publicly readable has the order wrong. Containment first, then identity, then detection and hygiene.
2. Design the identity and access architecture across on-premises AD, the SaaS CRM, and the IaaS tenant, including break-glass access. Address the 300 ms constraint.
Read the worked answer
Keep AD as the source of truth for employees and put a federation layer in front of the cloud estate.
CRM: use SAML federation from the CRM to the identity provider. The vendor supports only SAML, so do not attempt direct directory integration. Enforce MFA at the identity provider, not per application.
IaaS: federate to the same identity provider and map roles to permission sets rather than assigning permanent global admin. Separate admin accounts from daily-use accounts, require phishing-resistant MFA for admins, and use privileged identity management with just-in-time elevation and approval. No standing global admin.
Break-glass: two emergency accounts, credentials split and stored offline, monitored, excluded from routine automation, and tested quarterly. Document who can invoke them and when.
300 ms eligibility lookup: federation adds a redirect and token exchange, but the latency budget is dominated by the lookup service and its data path. Keep the eligibility service and its data close to the clinician network, or use an on-premises cache with a short TTL and a defined staleness limit. Measure the actual token/session path before assuming federation breaks the target. Do not solve latency by keeping standing admin access or by exposing directory binds to the internet.
3. Sequence the remediation across 30, 60, and 180 days. What residual risk should the CISO explicitly accept, and how does the 300 ms requirement affect the plan?
Read the worked answer
0–30 days: containment. Make the three buckets private, enable access logging and versioning, rotate credentials for the 14 shared admin accounts, and preserve at least 90 days of logs in an immutable store. Confirm the exposure scope for the 40,000 claim files and involve legal/privacy counsel. These are not optional improvements; they stop ongoing exposure.
30–90 days: identity and detection. Federate CRM and IaaS, stand up just-in-time admin, enforce MFA, and reduce internet-facing critical patching to 14 days. Add an impossible-travel response playbook with account lock and user verification. Test break-glass.
90–180 days: least privilege and resilience. Complete role redesign, centralize logging with one-year retention, and run an incident-response exercise. Inventory remaining legacy applications that cannot federate.
Residual risk to accept explicitly: legacy apps that cannot federate, a 14-day patch window for low-criticality systems, and any clinician cache staleness. The 300 ms requirement is a design constraint, not a reason to defer federation; measure and cache where needed. Report residual risk to the board with owners and review dates, rather than declaring the programme complete.