How a healthcare ride platform shut out a former admin and moved to a fully audited cloud
A North American healthcare ride-scheduling platform faced an active insider threat. Triotech removed every back door across 150+ machines, vaulted privileged access, and moved the platform to Oracle Cloud without disruption.
The situation
The platform schedules shared rides for healthcare, connecting hospitals and clinics, transport providers and drivers. When it goes down, patients miss rides to appointments. It also handles health information, so it operates under HIPAA. The company came to Triotech to harden its infrastructure, and the reason was urgent. Its infrastructure had been run by a single offshore system administrator. After he was let go, he deleted the entire staging environment and tried to use his remaining access as leverage against the company. Nobody knew what other access he still had. The platform ran on more than 150 virtual machines (Linux, Windows and Ubuntu) across 6 VMware sites in 2 physical data centres. For years, one person had held the keys to all of it, and nobody had a full picture of what he'd set up.
The constraint
- An active insider threat. A former administrator who knew the systems better than anyone still had unknown ways in.
- 150+ machines to check. Any one of them could hide a back door.
- Hidden access by design. Accounts and remote-access tools had been set up to be hard to find.
- Patient data under HIPAA. Any further damage or exposure would affect hospitals, clinics and patients, not just the company.
- A live service. Rides had to keep being scheduled while every system was locked down.
- Infrastructure tied to one person's knowledge. Six VMware sites and two data centres, with little documentation of how they were set up.
What we did
- Found every way inWe checked each and every machine, all 150+, for anything the former administrator could still use. Hidden local accounts, many of them with administrator permissions. Remote-access tools such as AnyDesk, TeamViewer and other RDP tools, several with unlimited access. Anything else that could serve as a back door. Every one we found was removed.
- Locked down every accountCredentials rotated across the environment, so no username or password he knew still worked. Group Policy lockdown of every account, enforced across the domain with PowerShell automation, so every machine follows the same rules. Multi-factor authentication, so a password alone is no longer enough. Folder-level and application-level restrictions, so users only reach the data their role needs and only approved software can run.
- Put privileged access in a vaultWe deployed Thycotic Secret Server (now Delinea) for privileged access management. Privileged credentials vaulted, no longer known to or held by any individual. Automatic rotation of every privileged credential. Every privileged session logged, with a full record of who did what, and when. No single administrator can ever again hold unchecked keys to the platform.
- Watched everythingWe deployed Graylog, with Sidecar agents collecting logs from every machine into one place. Security event monitoring across the whole environment. Dashboards giving the team one view of activity across every machine. Alerts on suspicious activity, so problems surface in minutes, not when damage is discovered.
- Hardened the VMware sitesWhile the platform was still on VMware, we hardened the virtualization layer itself, closing gaps across all six sites.
- Moved to Oracle Cloud and left VMware behindFor better availability, and to free the company from managing physical servers, we migrated the platform to Oracle Cloud Infrastructure one server at a time, so hospitals, transport providers and drivers kept working throughout. The VMware environment was removed once everything had moved. Two fault domains for the web and application servers, so one hardware failure can't take the service down. Oracle databases in private subnets, unreachable from the internet. Transparent Data Encryption, so patient data is encrypted at rest. A cross-region standby database over a remote peering connection, ready for disaster recovery. Backups to Object Storage through a private service gateway. Cloud Guard, auditing, monitoring and IAM across the whole tenancy.
- Supported the development teamAlongside the security work, we handled provisioning and automation for the client's developers, so they could keep building on the new platform.
How privileged access works now
- 1An administrator needs access to a server or system.
- 2They sign in with MFA.
- 3They check out the credential from Delinea. Nobody holds it permanently.
- 4The session is logged from start to finish.
- 5The credential is rotated afterwards.
- 6Graylog records the activity and alerts on anything unusual.
The result
Technology
Technology
Privileged access: Thycotic Secret Server (now Delinea) Identity and endpoints: Group Policy (GPO) · PowerShell · MFA Monitoring: Graylog · Graylog Sidecar Cloud: Oracle Cloud Infrastructure (Compute, Oracle Database with TDE, Object Storage, Cloud Guard, IAM) Previous platform: VMware vSphere (retired) Operating systems: Linux · Windows · Ubuntu
Related case studies
Find out what your stack is hiding.
If one person holds the keys to your infrastructure, you're one bad day away from an insider incident. Trust isn't a control: vaulted access, full audit logs and systems no single person can take down are. Book a free audit and we'll show you where your keys are.