Cybersecurity impacts business risk, patient safety, & privacy

Cyber Security Assessments (CSA)

We conduct adversarial-based assessments designed to find holes in your defenses, demonstrate their potential business impact, and show you how to close them.



Learn More

Web Application Security Assessments (WASA)

Our testing team will provide a current snapshot of the security posture of specific website(s). Our goal is to identify, contain, and remediate any exploitable vulnerabilities that can be fixed before an attacker can discover and utilize them for further attack.


Learn More

Product Security Assessments (PSA)

Using a range of unique penetration testing tools for testing connected devices, Tangible's product security testing mimics real-world hacking tactics and techniques that uncover hidden vulnerabilities in your device or application and provide realistic insights and practical results.

Learn More

Remote Access Security Assessments (RASA)

Tangible Security will assess the implementation of systems and procedures that have been deployed for your growing remote workforce in order to identify weaknesses that put your information at risk, provide recommendations to remediate those risks, and provide piece of mind that organizations are protecting both their sensitive data as well as the data of their clients.

Learn More

Security Program Assessments (SPA)

Using standards such as NIST, ISO, and COBIT as a starting framework, Tangible will work with you to examine the quality and effectiveness of your program, identify and understand weaknesses and vulnerabilities, and evaluate your readiness to defend and respond to today’s cyber threats.


Learn More

Virtual Cyber Security Office (vCSO)

Clients receive fixed number of consulting hours per month with seasoned executives and technical specialists to help assess, prioritize, plan, and/or execute their security program.


Learn More

Security Awareness Training

We help transform your employees from unwitting targets to human firewalls. They become obstacles to hackers rather than conduits. The initial testing, training, and ongoing testing combine to not only elevate your users’ preparedness but sustain and institutionalize it.


Learn More

SDLC Services

We help clients overcome the challenges of implementing secure development lifecycle (SDLC) best practices as well as provide professional services that supplement your development teams with hard-to-find special skills and 3rd party independent reviews.



Learn More

ProV

Software that auto-provisions (and de-provisions) Active Directory user accounts for people with trusted smart cards so they can instantly get to work within your Windows network.





Learn More

Cyber crime & digital complexities
elevate patient safety & privacy issues to ever higher risk levels

Patient electronic health records are worth ten times more than credit card numbers

Ransomeware extortionists are targeting healthcare providers

IT & Operational Security

Complexity, scale, and constant-change amplify cyber risks for interconnected healthcare systems.

Skilled and experienced cybersecurity personnel are scarce and costly

Healthcare cybersecurity programs are complex

Seemingly avoidable data breach causes continue to plague the industry

Mobility in healthcare increases attack surface

Identification, containment, & response to incidents must be rapid and decisive

Patient safety, privacy, & data security are often at odds

Ongoing infrastructure tests to identify vulnerabilities seldom find nothing

IoT & ICS Security

Network-connected medical devices deployed in clinical environments greatly increase the attack surface.

Medical device manufacturers need to add security testing into development lifecycle

Hospitals need to identify vulnerabilities of connected devices

Responsibility falls on both the device manufacturer and the healthcare providers

Hospitals are subject to ICS and SCADA mandates

Providers must ensure security throughout their supply chain

Regulatory Requirements and Mandates

Regulations as well as legal and financial penalties never seem to stop evolving.

HIPAA mandates that providers maintain adequate and up-to-date risk assessments

The entire supply chain of business associates & suppliers falls under OmniBus Rule

The HITECH Act mandates timely reporting of protected health information (PHI) breaches of 500 records or more

Compliance does not equate to security

Failure to comply with HIPAA and PCI requirements results in fines, legal entanglements, loss of patient trust, & more

The FDA views cybersecurity risks just as seriously as defective product risks

The Threats and Consequences are Real

Anthem — 78.8 million records — February 4, 2015 — Unauthorized database access, attacks may be linked to a state-sponsored attack out of China

Anchorage Community Mental Health Services (ACMHS) — December 2014 — 2,743 records — $150,000 fine — Due to malware compromising the security of its information technology resources, failing to regularly implement available patches and for running outdated, unsupported software

New York Presbyterian Hospital and Columbia University — May 2014 — 6,800 records — $4.8 million fine — Due to lack of technical safeguards, server deactivation resulted in ePHI being accessible on Google

Premera — 11 million records — January 29, 2015 — Attacks may be linked to a state-sponsored attack out of China

Parkview Health System, Inc. — June 2014 — 5,000 to 8,000 records — $800,000 fine — Cardboard boxes of these medical records left unattended on the driveway of a physician’s home

Concentra Health Services — April 2014 — 870 records — $1.73 million fine — Failed to manage encryption policies, identify which assets needed to be encrypted and document why encryption was not reasonable for certain cases