January 14, 2019

Health industry wake-up call

Deborah Johnson

Health industry cybersecurity solutions need to have the same precision, care, and compassion you expect from your health care professional.

The Department of Health and Human Services (HHS) and the Health Sector Coordinating Council recently published a report on managing cybersecurity threats and protecting patients. The stated goal of the publication is to foster awareness, provide practices, and move towards consistency to mitigate today’s most impactful cybersecurity threats. It explores five threats and provides suggestions for how to mitigate them. The threats are:

  • E-mail phishing attacks
  • Ransomware attacks
  • Loss or theft of equipment or data
  • Insider, accidental or intentional data loss
  • Attacks against connected medical devices that may affect patient safety

What’s in a label?

Arguably, four of the five threats they chose could be labeled as insider threats. When an external threat successfully gains access by exploiting an employee’s legitimate credentials via phishing or ransomware, they look like an insider. The outcomes of each threat, however, are the same - loss of personal health information (PHI) or personally identifiable information (PII), financial loss, tarnished reputation, and/or compromised patient safety.

Other threat and loss examples include:

  • e-mail and unencrypted mobile storage, resulting in data breaches;
  • employees or others inappropriately viewing and/or using patient information;
  • socially engineered insiders giving the external hacker insider accesses, including banking information;
  • patients given the wrong medicines or treatment because of incorrect data in the file;
  • patients taking their business to a competitor; or
  • unauthorized persons (internal or external) gaining remote control of a medical device and compromising patient safety.

Not just an IT problem

The report correctly highlights that this is “not simply an IT problem.” It never has been. Whether addressing an insider threat or network protection, the solution requires a human-centric approach. We expect our caregivers to be knowledgeable, well trained, compassionate and caring. We should expect the same from the solution to this problem. After all, the root of the issue is human beings.

Training and awareness, auditing, data loss prevention, and privileged access management are critical and basic steps (countermeasures) that are well tested and beneficial for any organization. They are easily scaled to fit the needs of the business. For example, small medical practices benefit most from training and awareness and outsourcing fundamental security protections, while large healthcare organizations need a formal Insider Threat program. For the protection of connected medical devices, they may also benefit from the use of cross domain technology used in the government and being explored in the operations technology (OT) world.

Deborah Johnson

Deborah K. Johnson is a seasoned executive leader with nearly 40 years of experience as a recognized insider threat expert, advising C-suite leaders on effective risk mitigation strategies, employee awareness, and strategic policy development.  Prior to joining Forcepoint, she was President of...

Read more articles by Deborah Johnson

About Forcepoint

Forcepoint is the leading user and data protection cybersecurity company, entrusted to safeguard organizations while driving digital transformation and growth. Our solutions adapt in real-time to how people interact with data, providing secure access while enabling employees to create value.