* F5 products make Blue Cross and Blue Shield of Kansas City secure and compliant
Blue Cross and Blue Shield of Kansas City went shopping for an application layer firewall and ultimately purchased an application delivery networking product that helped the Missouri organization reduce page-load times by 96% on its healthcare information Web site – while staying compliant with the Health Insurance Portability and Accountability Act.
With nearly 900,000 members in the Kansas City region and some 25,000 unique Web site visitors, BCBSKC needed to ensure performance and security were in tact as the Web site grew in popularity. Specifically, the load, which increased network vulnerability, taxed BCBSKC’s servers and forced the servers to expend processing power on highly sensitive, SSL encrypted traffic – decreasing application performance. The organization was also working to remain compliant with HIPAA, so establishing network and application level security was critical.
“We were originally trying to provide an application layer firewall for our external facing Web application, but at the same time we were seeing performance issues such as slow response time on the Web site,” says Chad O’Neal, Web technical engineer at BCBSKC. “As the Web site worked over time, the speed at which is was serving up Web pages would degrade over time.”
BCBSKC decided to install a trio of products from F5 Networks. First, the Big-IP Link Controller was deployed to maintain ISP redundancy and to improve uptime and performance for the Web site. Second, Big-IP Local Traffic manager was installed to offload SSL processing and to manage traffic on BCBSKS’ DMZ Web servers. Lastly, the organization deployed F5’s TrafficShield to protect its traffic and maintain HIPAA compliance.
With TrafficShield, O’Neal says he plugged the appliance into the network and began reconfiguring traffic to flow through that in a monitoring mode. “We didn’t want to actively block anything to start, but we wanted to record the traffic flows,” he explains. “One of the nice features of this is that it doesn’t impact end users or clients.”
O’Neal says he was then able to apply policies to Web sites and determine what traffic can or cannot be allowed.
“We feel more comfortable that the information we pass on to our end users that is coming into our site because we know we can deliver it securely,” O’Neal says.
