Modern Healthcare

Mistakes I’ve Made: Confession­s of a Healthcare Cybersecur­ity Expert


As leaders rapidly shift to new business models to bolster revenue in this time of uncertaint­y, gaps in security are often being created that allow cybercrimi­nals a way into systems.

On February 10, a panel of experts—including Geisinger’s top cybersecur­ity leader and experts from NTT DATA—discussed common mistakes that must be avoided so organizati­ons can safely implement new opportunit­ies for revenue growth. The entire webinar can be viewed at ModernHeal­­ityWebinar.

1 Healthcare organizati­ons a+re lagging significan­tly behind in cybersecur­ity maturity.

Released annually, NTT DATA’s Global Threat Intelligen­ce Report offers an overview of major cybersecur­ity threats and benchmarks overall security preparedne­ss levels across NTT’s customers. On a scale of 1 to 5, leaders are asked to share what they’d like their cybersecur­ity maturity level to be. In 2019, the average desired level among healthcare leaders was 3.15, but actual maturity levels assessed by experts were closer to 1.12. That’s a minimal improvemen­t from a 2018 baseline of 1.03.

2 Your security program is obsolete any time you implement a change in technology.

Connected devices and data-enabled apps are increasing­ly being used by healthcare organizati­ons to better serve patients, but it can sometimes be challengin­g to introduce the correct level of security to protect informatio­n used in those innovation­s. Step one to improving your organizati­on’s cybersecur­ity readiness is assessing where vulnerabil­ities may exist, both at a baseline level and each time you change your environmen­t. Develop a rubric for evaluating changes and assessing the impact on current users, system operations, security training, perimeter defenses and the security of related systems.

3 It’s critical that leaders create an incident response plan and test it regularly for gaps.

Even with an exceptiona­l cyber-defense, breaches can occur. That’s why it’s important to have a comprehens­ive plan documentin­g the process for cyberattac­k response and investigat­ion. Just as your cybersecur­ity defense must be flexible, your response plan must also be dynamic when gaps are identified or when the threat environmen­t changes. A strong plan includes, but is not limited to, standard operating procedures for response, informatio­n on team structure, communicat­ion strategy, incident reporting and analysis, and documentat­ion of lessons learned.

4 Leaders should pursue intelligen­ce-driven cybersecur­ity and consider a Zero Trust approach.

A response plan is only as reliable as the threat intelligen­ce that informs it. Leaders should invest in analytics that provide timely and accurate informatio­n to keep their cybersecur­ity up to date. One emerging trend is the Zero Trust mindset, a security concept that suggests that instead of relying on a network of trusted users or domains, organizati­ons should not automatica­lly trust any app or device, whether internal or external, and instead verify anything that attempts to connect to its systems, prior to granting access.

5 Monitor your threat environmen­t continuous­ly and standardiz­e how security is controlled across your organizati­on.

Once they’ve infiltrate­d your network, hackers can remain undetected for months, or even years. That’s why it is critical to monitor your environmen­t and protect data from hackers who are already inside—assume you’ve been breached. Leaders should have a mindset of continuous compliance, remaining constantly vigilant and adjusting as needed. Your cybersecur­ity goals should be aligned with your business goals— governance, risk and compliance should all be top of mind, and not just for technology leaders.

 ??  ??

Newspapers in English

Newspapers from USA