Like many NHS organisations, Nottinghamshire Health Informatics Service (NHIS) has a complex, historic IT estate which makes keeping track of the security and compliance status of all assets a challenge. For NHIS, it involved using several different tools – one for physical IT assets, another for software assets, and then finally one for the network infrastructure. Although NHIS had all the information it required to manage vulnerabilities, the information wasn’t readily available from a single source and it took time to manually collate.

NHIS wanted to simplify the process of vulnerability management and compliance by gaining an independent and more easily accessible view of its infrastructure. It wanted to be aware of its exposure to risk at all times and be able to confidently provide assurance to customers. ‘Any device taking an IP address, I wanted to know about it’, said Mike Press, Chief Technical Officer, NHIS. ‘I knew the information I wanted to present to customers, but I had no mechanism to do so‘.

NHIS turned to ITHealth with whom they have been working for many years and who already support them with remote working, end user and network protection solutions. In this instance, ITHealth proposed an assurance solution that is delivered by ITHealth as a fully managed service.

The first step involved gaining an independent, live and granular view of everything linked to the NHIS network. An agentless scan was used to identify all hardware and software and expose the information in an intuitive dashboard interface. All assets were tracked from workstations, servers, and printers to switches, monitors and software installs. Even medical devices were captured – anything which is IP addressable is displayed on the dashboard. Granular detail is supplied for each asset including, for example, serial number, the last logged on Windows user, and remaining disk space – devices using default passwords are even identified. Plus, all the findings are easily exportable into excel.

ITHealth worked closely with NHIS to customise reports and configure the dashboard so that, at-a-glance, it would display only the most critical security information as defined by the NHIS IT team. The dashboard was set to include: OS versions used throughout the network, anti-virus and windows update status on servers and workstations, encryption status of devices, and a complete asset summary highlighting any new additions to the network. As they become available, ITHealth now also feed in critical NHS Digital CareCERT alerts so NHIS can quickly understand the level of risk that exists within its infrastructure. The dashboard highlights all non-compliant areas so that NHIS and ITHealth know immediately where to focus remediation efforts. Remediation often includes: patching, re-configurations, software upgrades, changes to access rights, and updating out-of-warranty devices. As the dashboard is dynamic, remediation can be viewed in near real-time.

‘I can watch as patches are being released and monitor the uptake of them directly from the dashboard – no more logging in separately to complicated technical patch management tools’, said Mike.

ITHealth provide an ongoing service to NHIS carrying out much of the remediation requirements, including providing NHIS with detailed monthly breakdown reports so changes within the IT estate can be regularly discussed and evaluated.

The dashboard solution provided by ITHealth has resulted in a substantial reduction of time that the NHIS IT team would ordinarily spend on routine, yet key assignments, such as inventory, software distribution, licensing and updates.

It has provided NHIS with a granular awareness of every single asset linked to the NHIS network and how it’s functioning. According to Mike: ‘The amount of unexpected information that we can access from the dashboard is astounding. It has become a go-to-diagnostic tool. Now, if we’re curious about anything on the network, we simply go to the dashboard and within a few clicks we get the answer. It’s so simple.’

In summary, benefits of the assurance dashboard solution for NHIS include:

• Huge time savings for a resource constrained, pressured IT team
• Rapid assessment of infrastructure risk levels following NHS Digital CareCert alerts
• Simplicity to get granular data and then easily report on it
• Ability to remotely spot and fix common problems with assets, e.g. identification of rogue settings that may be preventing a patch
• Complete visibility of an entire network and all pertinent security information in a single view
• Access to ITHealth’s purely NHS focussed technicians who genuinely understand NHS infrastructures and challenges

‘Ultimately, the dashboard acts as an independent witness to everything on the NHIS IT estate. It’s this independent view that makes the dashboard so invaluable to us’, concludes Mike.