Three questions to ask

August 2017 Healthcare (Industry), Cyber Security

In the all-out war for data, the healthcare industry is getting hit the hardest. Experian’s fourth annual 2017 Data Breach Industry Forecast1 states that healthcare organisations will be the most targeted sector for attack, with new and sophisticated attacks emerging. If healthcare organisations and their IT teams aim to keep data safe, they need to take a step back to assess the overall security landscape and the security processes currently in place on a macro level.

Here are a few critical questions that all health IT professionals should ask themselves as they think about data security now and in the future.

1. Have we created a culture of security awareness?

Healthcare data security professionals generally agree that the most vulnerable point in a security framework is the users accessing and handling data on a daily basis. Whether it is data loss as a result of a phishing scam, hacked devices brought in from the outside or general carelessness when accessing sites or apps while on the network, there are a number of different ways employees can jeopardise patient data.

For this reason, health IT professionals should first build up cyber-awareness within the organisation to minimise future threats. That being said, successfully instilling cyber-awareness can be a challenge, as human nature leads individuals to believe they’re impervious to attacks. IT teams can attempt to change this mindset by educating and training the workforce.

While there are a variety of ways healthcare organisations can work to establish a more secure workplace culture, here are a few steps all should take:

• Lead by example: executives and directors should be a model for the rest of the organisation.

• Regularly schedule data training and education sessions throughout the year to provide the latest security trends to the organisation and to remind everyone that protecting data is everyone’s responsibility.

• Hold unscheduled inspections. Look for unattended and logged-in devices, usernames and passwords posted near (or under) devices, disabled security tools, unapproved network devices (such as wireless routers) and the use of proper protocols when logging in and out of multi-user devices.

• Recognise security success and remediate failure. Offer gift cards or other small incentives to those who pass an inspection or a phishing test while requiring additional security awareness training for those who don’t. Some organisations start with short remedial training that requires a 100 percent score on the follow-up quiz, then progressively longer training sessions for those who continue to fail. A formal reprimand in the employee’s yearly review is also an option at this point.

2. Are our current data security solutions equal to the threat?

Employee awareness is critical, but without cybersecurity solutions in place, deterring threats and minimising the number of attacks on your organisation will be next to impossible. To help lay the foundation for data security, organisations should first think about conducting a cyber threat assessment. This assessment will allow your organisation to validate the network’s current security accuracy, analyse traffic across the environment and monitor network performance.

Once this assessment has been completed, your organisation will have a better understanding of its current security posture and what steps to take next. Evaluating the data security systems and processes in place should be a recurring process. This is essential, as changes in healthcare networks and the threat landscape often happen at a rapid rate.

3. Are we in sync with health tech transformation?

The healthcare industry is in the midst of a technological transformation with the goal of improving patient care, and IT needs to be ready to support this progression.

More specifically, the Internet of things (IoT)2 has had a significant impact on the industry, forcing organisations to seamlessly connect both wired and wireless devices to their network. It’s also important to know whether legacy systems and technology are keeping pace with security changes and whether they’ll be protected against the next wave of attacks.

For these reasons (and more), healthcare IT professionals looking to improve data security should consider a security solution that hosts a centralised architecture and an established advanced threat protection (ATP) framework that can be accessed and managed in one place. Next-generation security solutions can help keep healthcare data protected and allow for the expansion of new patient care delivery models.

A strategy for success

The healthcare industry is making great technological strides to offer exceptional patient care, convenience and comfort, but these strides often create greater cyber vulnerability.

As we move through 2017, healthcare data will remain a top target within the cybercriminal community. However, if you and your team address the above questions and establish a robust cybersecurity defence plan, threats can be effectively reduced and attacks can be mitigated in a timely manner.

1 www.experian.com/assets/data-breach/white-papers/2017-experian-data-breach-industry-forecast.pdf

2 blog.fortinet.com/2016/09/12/healthcare-cybersecurity-risks-in-the-internet-of-medical-things




Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

The enemy within – insider ­security threats
May 2019, Wolfpack Information Risk , Editor's Choice, Cyber Security, Financial (Industry)
Insider threats in today’s financial world are insidious and destructive and your defence against insiders should start long before the person assumes his/her position.

Read more...
Visibility is key, and lacking
May 2019 , Editor's Choice, Cyber Security
Cybercriminals are most likely to be caught on servers and networks, but detecting their time and point of entry remains a mystery.

Read more...
Insiders: who are they?
May 2019 , Security Services & Risk Management, Cyber Security
The 2018 Insider Threat Report by Cybersecurity Insiders reports that more than 51% of companies are concerned about unintentional insider attacks.

Read more...
Biometrics in future healthcare
May 2019 , Healthcare (Industry), Access Control & Identity Management
The idea of using biometrics in the healthcare sector is not new, but it is one that hasn’t been explored or exploited to its full potential.

Read more...
Hybrid cloud and hyper-converged data protection
May 2019 , IT infrastructure, Cyber Security
Arcserve Unified Data Protection extends disaster recovery and backup technologies to prevent downtime and data loss for hyper-converged and SaaS-based workloads.

Read more...
Vivotek strengthens cybersecurity
May 2019 , CCTV, Surveillance & Remote Monitoring, Cyber Security
Vivotek has announced the availability of comprehensive protection in its Cybersecurity Management Solution under the strategy of its 'Security within Security' campaign.

Read more...
When cybercrime affects health and safety
April 2019 , Editor's Choice, Cyber Security
The threat of a category-one cyber-attack is that everything could seem right – the readings on the meter could be fine, checklists would be followed, and equipment would work – yet danger could still unfold.

Read more...
Cyber/physical perils in hospitality
April 2019, Wolfpack Information Risk , Editor's Choice, Cyber Security, Entertainment and Hospitality (Industry)
How can we prepare for our holidays and avoid becoming the victim of a scam or data breach?

Read more...
Rethink security priorities
April 2019 , News, Cyber Security
Cryptocurrency mining is up 237%, phishing attacks increase by 269%, business email compromise attacks have gone up by 28%.

Read more...
Overcoming the 2019 cyberthreat
April 2019 , IT infrastructure, Cyber Security
The flexibility of remote working is good, however, the wider a network perimeter has to stretch, the more scope exists for security breaches.

Read more...