Security posture
Northbay Regional HealthSee how Aegis reorders a raw scan into a CISO’s priority list — judgment made visible.
Top priorities
Ranked by business impact and exposure — the CISO judgment layer, not raw severity.
CriticalAEG-0001S3 bucket with PHI exports readable by any authenticated AWS principal
AWSPR.DS-1
S3 bucket with PHI exports readable by any authenticated AWS principal
This jumps to the top of the queue not just for severity but because it is exploitable with a single stolen key and directly triggers breach-notification law — regulatory exposure, not CVSS, sets the priority.
A misconfigured bucket holding patient record exports is one leaked credential away from a reportable HIPAA breach, HHS OCR penalties, and mandatory patient notification for a regional hospital.
Bucket 'nbrh-clinical-exports' has a policy granting s3:GetObject to arn:aws:iam::*:root (any AWS account), and objects are unencrypted at rest (no SSE-KMS).
Remove the cross-account/authenticated-principal grant, enforce a bucket policy denying non-TLS access, and enable SSE-KMS with a dedicated CMK. Confirm no external access via Access Analyzer.
CriticalAEG-0002In progressRoot and admin AWS accounts without MFA
AWSPR.AC-1
Root and admin AWS accounts without MFA
Rated critical despite being 'just an identity setting' because it compounds every other AWS finding — unremediated MFA turns a medium misconfig into a full-estate compromise.
The keys to the entire hospital cloud estate — including every PHI store — are protected only by a password, meaning one phishing hit could hand an attacker total control.
AWS root user has MFA disabled and 3 IAM users in the 'Administrators' group have no MFA device registered; two have active access keys.
Enforce hardware/virtual MFA on root and all admin users via SCP, rotate the exposed admin access keys, and move to federated Okta SSO with no standing IAM users.
HighAEG-0007Publicly shared Google Drive files containing patient information
Google WorkspacePR.DS-1
Publicly shared Google Drive files containing patient information
I prioritize the four files owned by former employees first — data that leaves with people who no longer answer to us is the least controllable and most likely to surface later.
Spreadsheets with patient names and appointment details are shared as 'anyone with the link,' an unmonitored leak path that would count as an impermissible HIPAA disclosure.
DLP scan found 11 Drive files shared link-anyone that match PHI patterns (MRN, DOB, patient name columns), 4 owned by former employees.
Revoke link-anyone sharing on flagged files, enable a Workspace DLP rule blocking external sharing of PHI patterns, and reassign orphaned files.
HighAEG-0008Okta admin roles granted without step-up MFA policy
OktaPR.AC-7
Okta admin roles granted without step-up MFA policy
Identity provider admins are the crown jewels of a modern estate — I hold them to a stricter bar than production systems, because compromising them compromises everything downstream at once.
Okta is the front door to every connected system; weak controls on its administrators mean a single compromised admin can unlock the entire environment, including PHI.
9 users hold Okta Super/Org Admin roles but the admin console sign-on policy does not require phishing-resistant factors; SMS is still an allowed factor.
Enforce FIDO2/WebAuthn for all admin roles, disable SMS as a factor for privileged access, and reduce Super Admin count to the minimum needed.
HighAEG-0005RDS instance hosting EHR data is publicly accessible
AWSPR.DS-2
RDS instance hosting EHR data is publicly accessible
Public + PHI is a combination I never leave open past the day I find it; exposure over the internet moves this ahead of internal-only misconfigs regardless of matching severity scores.
A database backing electronic health records is reachable from the open internet, dramatically widening the attack surface for the most sensitive data the hospital holds.
RDS PostgreSQL instance 'nbrh-ehr-prod' has PubliclyAccessible=true and a security group allowing 5432 from 0.0.0.0/0.
Set PubliclyAccessible=false, restrict the security group to the application subnet, and place the instance behind a private endpoint only.