Information Security & Firewall: coverage in Porto Alegre - RS

Health data changes the requirement, not just the recommendation

Health-related information is sensitive personal data under LGPD, Brazil's data protection law, and that shifts segmentation from good practice to an obligation for whoever processes the data.

Four measures translate that requirement into configuration. Segmentation, separating the clinical, administrative, equipment, and guest networks. Individual credentials per person, never shared, because without them there is no way to know who accessed what or to revoke the access of someone who left. Access logging with a defined retention period, which is what makes it possible to answer a question after the fact. And control over what leaves, restricting the paths data can take out of the environment — the most neglected part, because attention tends to focus entirely on what comes in.

The lifecycle of external access

The problem with legitimate accesses is not granting them: it is ending them. The physician who stopped seeing patients, the vendor whose maintenance contract expired, the auditor whose engagement ended — all of them remain active unless someone switches them off.

The treatment is authenticated access with individual credentials, a second factor, permissions restricted to what the person actually needs to reach, and an expiration date whenever the access is temporary. Access that expires is the difference between granting and forgetting, and the initial assessment of an environment that has never been reviewed always finds a few of these still live.

Analytical equipment in its own segment

Analytical and diagnostic equipment tends to run software the manufacturer rarely updates, and touching it without technical authorization can void the warranty or the validation. You cannot protect it through patching.

You protect it through isolation: a dedicated segment, communication allowed only with the system it needs to talk to, no browsing, and no reach into the administrative environment. The vendor's calibration access becomes restricted, temporary, and logged, instead of a permanent door left open since installation.

The payoff is contained blast radius. A vulnerable instrument in isolation is a vulnerable instrument; on a flat network, it is the path to everything.

Distributed networks: small units, equal exposure

Collection points and satellite consulting rooms handle the same sensitive data as the main unit with a fraction of the infrastructure. Nobody technical works there, and the network edge is frequently whatever box the carrier left behind.

What changes that picture is standardizing the edge: the same equipment, the same policy, the same configuration at every unit, administered from a single point. That has three practical effects — the security policy applies equally everywhere, a change is applied once, and the small unit stops being the weak point through which everything else is reached.

And the interconnection between units stops being ordinary internet traffic: what flows between them is internal and is treated as such, with the data traveling over a controlled path.

SD-WAN for an operation that cannot wait

In a distributed clinical operation, the link is part of the care delivery chain: without it, the collection point cannot look up a patient record, transmit material, or confirm a result. An outage does not delay work — it interrupts care.

The secondary path does not need to replicate the primary. It sustains the essentials: patient records, result transmission, insurer integration, and telephony. And it is worth more if it runs on a different technology from the primary, because then it fails for different reasons — two links riding the same infrastructure tend to go down together.

With two paths in place, SD-WAN chooses between them continuously by measuring latency and packet loss, and switches automatically when one degrades. That also covers partial degradation, which is the most common scenario and the hardest to diagnose without measurement.

Prioritizing what interrupts over what can wait

When bandwidth gets tight and there are no rules, everything competes as equals and the most sensitive traffic loses. The order that works puts what interrupts care at the front — patient records, medical charts, reporting, integrations, and telephony. Then what delays without interrupting: billing, reports, file access. Last, what tolerates waiting: backups, updates, and general browsing.

Exam imaging deserves its own note: the files are large, and transmitting them uncontrolled consumes the entire link. Handling them at intermediate priority with a preferred window keeps a single study transfer from taking down the front desk.

The sectors that drive demand in Porto Alegre

Professional services, healthcare, technology, and B2B retail form the capital's profile. Healthcare concentrates the sensitive-data requirement and the equipment segment. Professional services weigh in on confidentiality and access logging. Technology firms need per-team policies and separation between environments. B2B retail depends on the link for ordering, billing, and customer integration.

How the deployment is run

It starts with the assessment: links, edge equipment at each unit, inherited rules, active remote accesses, administrative privileges, and actual traffic. A firewall deployed without that map blocks what the operation uses and leaves open what nobody noticed.

Then comes the design — segmentation across clinical, administrative, equipment, and guest networks, per-segment policy, authenticated external access with expiration, and log retention definitions.

Activation is scheduled with someone who knows the rhythm of the day, because work on the network edge interrupts connectivity for a few minutes and that cannot coincide with care in progress. Afterwards the rules are tuned against observed traffic and the links go under continuous watch — without which nobody notices when the secondary path quietly stops working.