With the in-depth application and practice of new generation information technologies such as the Internet of Things, big data, cloud computing in the health industry, medical informatization construction has entered a stage of high-quality and high-speed development. In 2022, policies such as the "14th Five Year Plan" National Health Informatization Plan, and the Measures for Network Security Management of Medical and Health Institutions were released successively, promoting the standardization and systematic development of information security construction of medical institutions.
In the Measures for Network Security Management of Medical and Health Institutions, medical and health institutions are required to determine the level of network security protection at the planning and declaration stages when building new medical and health institutions' operating networks, and security tests should be conducted before the new networks are put into operation. As an important part of medical informatization construction, business system bears the important responsibility of transmitting medical and health information, and all-round security defense is indispensable.
Relying on the technical accumulation of Tianrongxin in the field of network security, Tianrongxin's comprehensive solution for application security in the medical industry forms a comprehensive solution of multi-point integration and collaborative linkage with Web application firewall, web page anti tampering, web vulnerability scanning, website monitoring and other products as the core, integrating risk perception, vulnerability detection, security protection and post recovery, Comprehensively improve the security protection capability of customer websites.
Comprehensive detection, threat awareness
Tianrongxin website security monitoring system
The official portal website of a hospital often undertakes the task of transmitting important information, such as issuing important announcements, publicizing hospital priorities, etc. Especially in the special period of COVID-19, the website needs to operate efficiently 24 hours a day.
The Tianrongxin website security monitoring system integrates various functions such as web system scanning monitoring, website anti phishing monitoring, malicious link detection, domain name detection, etc., which can ensure that relevant personnel can be notified to respond in the first time when the website fails, and can also conduct real-time security risk assessment on the website, providing customers with a 7x24 hour all-weather monitoring capability.
Find out the loopholes before seizing the enemy
Tianrongxin Vulnerability Scanning and Management System
In the informatization construction of hospitals, the normal operation of core business systems such as HIS, LIS, PACS and EMR as well as official portal websites is crucial. Such systems are usually built earlier, and with the development of informatization, there are often more security risks.
The Tianrongxin vulnerability scanning and management system integrates multiple scanning combination means, such as intelligent traversal rule base, pre detection, progressive scanning, login scanning, breadth first crawler, etc., which can quickly and accurately detect the vulnerabilities and weaknesses existing in medical and health application sites, and provide customers with accurate suggestions on vulnerability rectification and repair.
Precise enemy control and efficient protection
Tianrongxin Web application firewall
Hospital intranet applications store a large amount of private information, such as patient identity information, mobile phone number, cases, etc. Once attacked and leaked, it will cause serious harm to hospitals and patients.
The Tianrongxin web application firewall can specifically defend against http website attacks, integrating web security, bot management, CC attack defense and other security capabilities. Through the intelligent learning engine and the active defense engine, it can verify the information data that the medical and health application system continuously interacts with the outside, and effectively prevent SQL injection, XSS, CSRF and other attacks, The security threats defined in OWASP TOP 10 can be immediately blocked, which can provide a full range of web application security protection capabilities for various scenarios in the medical and health industry.
Kernel driver, tamper recovery
Tianrongxin web page tamper protection system
As an external information portal, the hospital's official portal website bears an important responsibility for displaying hospital related information to the outside world. Web page tampering attacks are mostly aimed at tampering with the portal website to destroy its social image and mislead website visitors, so as to cheat, phish, create public opinion and other purposes.
The Tianrongxin web page tamper protection system is the ultimate guarantor of the application security comprehensive solution of the Tianrongxin medical industry. Relying on the third-generation web page tamper prevention technology - system (core) file bottom driven filtering technology and enhanced event triggering technology, once there are operations such as addition, deletion, and modification, the tamper prevention system will immediately block the tampering behavior, Effectively prevent hackers from illegally tampering with and destroying website files, and provide customers with final site security assurance.
A tertiary hospital in Beijing
The customer's web business has grown rapidly, but the new medical website system and official website lack professional web security protection means. In order to address the comprehensive needs of hospital website protection, Tianrongxin deployed Tianrongxin web application firewall in the front end of the website cluster to comprehensively defend against web security threats; Install the Tencent web page anti tamper system client at the website server to immediately block the tampering behavior; Deploy website monitoring in the external DMZ website area, and conduct 24-hour security monitoring on the official website; With the help of the precise scanning capability of Tencent's web vulnerability scanning, we found that there might be potential security risks on the website, formed a multi-point integration, collaborative and linked medical and health application security solution with four major products, solved the difficult problems of customer web security protection, and ensured the smooth progress of the hospital's modern information construction.
Driven by both internal and external factors, such as policy driven, informatization development and hospital internal fine management, the construction of medical informatization is accelerating. The Measures for Network Security Management of Medical and Health Institutions puts forward the basic principles, management division, implementation standards, supervision and punishment requirements for network and data security management in the informatization development of medical and health institutions, and highlights the overall balance between informatization development and overall security needs. The construction of network security and informatization in the medical industry should follow the "three synchronization" principle of synchronous planning, synchronous construction and synchronous use, build a three-dimensional network security defense system, improve dynamically and operate continuously, providing reliable guarantee for medical business development and service quality improvement.
As the leading enterprise of network security in China, Tencent adheres to the overall national security concept, sets up a correct network security concept, strengthens top-level design and standard development, conducts comprehensive systematic thinking from basic compliance, data security, password application, business integration, practical attack and defense, and builds a three-dimensional security system in the face of the network security needs of the intelligent health care industry, Escort the safety construction of customers' smart hospitals.
