What Is an Isolated Recovery Environment?
As ransomware evolved, traditional backup and disaster recovery wasn’t enough. We know that ransomware is on the rise, with attacks growing year over year, and we don’t see that changing for the foreseeable future. So, what else can organizations do to protect themselves? That’s where the connected concepts of vaulting, clean rooms and IREs come in.
Vaulting involves sending backups to an air-gapped, third-party location so they cannot be impacted by a cyberattack or disaster. When the organization is ready to restore operations, it can use a clean room — a secure environment where multiple parties can analyze data and systems collectively without the risk of reinfection. In the clean room, the team can perform restores and analysis to look for markers that show the ransomware didn’t impact the backups. Finally, in an IRE, the IT team can do an actual restore of everything to allow a subset of users back in so the organization can continue operations. It’s not intended to be full production; that comes later once the event has passed.
However, an Epic IRE implementation is unique and functions a little differently from a general IRE. Epic has its own architecture of database mirroring for disaster recovery. Essentially, Epic skips vaulting and uses its IRIS mirroring technology to set up the IRE and keep the data synchronized with production.
Keep in mind that while Epic normally has dozens of integrated third-party applications, those won’t be available in the IRE. It gets rid of those apps and provides only the data to keep operations moving, patient care flowing and revenue incoming throughout the incident. It’s essentially just web access or mobile web access. It could be considered minimum viable Epic.
RELATED: Healthcare organizations must prioritize clinical care resiliency.
What Do Health Systems Need To Know About Setting Up an Epic IRE?
The first thing to consider is whether the organization is using an Epic-hosted IRE environment or is self-hosting in the cloud. The cloud option makes sense for many health systems due to the ability to scale as needed and pay using operational dollars rather than a large capital investment.
For other applications, vaulting and clean rooms are likely needed as part of the recovery process. Many organizations buy products to air-gap their environment and facilitate the vault, clean room and IRE setup.
Another factor to consider is that the majority of Epic systems are tied into Active Directory for authentication. During a cyberattack, it’s likely that Active Directory will be down; the organization will be left with a third-party copy of Epic, with nothing to use for login. This can be a major challenge for organizations, but there are options.
The first is to fail back to Epic’s native authentication. However, this may mean having to go through password resets on a larger scale, and it won’t have multifactor authentication unless it’s turned on within Epic’s native multifactor solution — meaning the organization would have to enroll potentially thousands of people into MFA on the fly.
The other option is fairly new. Epic recently began offering OpenID Connect, which allows the organization to tie Epic with Okta or Microsoft EntraID for easier MFA. This year, we haven’t seen many organizations move toward this, but we expect to see that change over the next year or two as it brings down the barrier of entry and aligns with most identity maturity models.
