An important initiative at the U.S. Navy Medical Information Management Center (NMIMC) in Bethesda, MD, has been to empower its healthcare community by pioneering the virtual organization. This entails securely sharing a substantial amount of medical information, such as medical benefits, newsletters and e-mails, with more than 100,000 users worldwide, across every, conceivable technological environment.
Due to the size, cost and complexity involved in this project, NMIMC had to look beyond traditional VPN and secure extranet solutions. “Security was an absolute priority and every solution we looked at was reliable in this aspect,” says Lt. Rick Nickerson, head of security at NMIMC. “The real difficulty was to find a secure remote-access solution that could effectively work for this many remote users with unpredictable PC configurations. These users are generally not very technical and have minimal or no technical support.”
NMIMC manages a large volume of medical information–used to plan, coordinate and provide cost-effective information management throughout the world for Navy personnel and their families. Information is accessed through a variety of means, including e-mail, files, Web applications, terminal applications and traditional client-server applications. Recent efforts have been made to centralize, standardize and simplify access to more of this data using standalone or centralized Web servers.
The scale and nature of this secure remote-access problem demanded unique features beyond just high security to protect sensitive military and medical data. The widely dispersed, unpredictable and often unsupported PC configuration of remote users meant the solution could not assume anything about the client beyond the existence of an Internet connection and a browser. In addition, the sum of all direct, hidden and on-going costs had to remain reasonable, while scaling with tens of thousands of users.
NMIMC briefly considered traditional VPNs, with proprietary clients often using IPSec to securely communicate over insecure networks like the Internet. “We didn’t need or want all the functionality of traditional VPNs, and the cost and complexity involved made them unworkable,” says Nickerson.
A traditional extranet was NMIMC’s next choice. A basic Web portal-based extranet could eliminate most of the technical barriers of the traditional VPN client.
“Extranets can be complex, costly and time-consuming to build and maintain,” suggests Nickerson. “We already had the data and applications we wanted to share on our existing network and didn’t have the time or the resources to build another extranet network. All these additional systems, servers and clients just add more cost, failure points and management headaches for us.”
NMIMC eventually chose the Secure Extranet Appliance (SEA) solution from SafeWeb of Emeryville, CA. The solution integrates traditionally disparate standalone extranet technologies within a simple plug-in network appliance. By reducing the entire “extranet” to an appliance, there is no significant network reconfiguration, nor additional hardware and software required.
A secure extranet is built with the SEA in four broad steps. First, it is connected to the network and configured like any other network device, with information like the IP address and network gateway. Second, either internal or external authentication directories are defined to determine user and group access.
Third, internal resources like e-mail, file and Web servers are defined with granular access rules. Finally, the administrator determines which user has access to which resources via a customizable dynamic portal.
The SEA enables companies to set up a complete, secure extranet within a day, instead of months or years. The solution was implemented at NMIMC at a onetime cost of $90,000, with no annual license or other additional fees required.
“Our old system proved far too difficult to implement, manage and use. It didn’t provide us with centralized auditing capabilities or allow us to easily control user access,” says Nickerson. “The SEA has greater functionality and allows us to extend our service to all Navy medicine personnel without compromising security.”
NMIMC’s SEA currently gives secure remote access to more than 55,000 naval reservists in a high-availability, fail-over configuration, in conjunction with RadWare, a SafeWeb partner. This project is being extended to more than 100,000 active and reservist Navy personnel to provide them access to additional medical benefits and related information.