By Susan Biddle, Sr. Director of Healthcare, Fortinet
Twitter: @Fortinet
In the all-out war for data, the healthcare industry is getting hit the hardest. Experian’s fourth annual 2017 Data Breach Industry Forecast states that healthcare organizations will be the most targeted sector for attack, with new and sophisticated attacks emerging. If healthcare organizations and their IT teams aim to keep data safe, they need to take a step back to assess the overall security landscape and the security processes currently in place on a macro level.
Here are a few critical questions that all health IT professionals should ask themselves as they think about data security now and in the future.
1. Â Have we created a culture of security awareness?
Healthcare data security professionals generally agree that the most vulnerable point in a security framework is the users accessing and handling data on a daily basis. Whether it is data loss as a result of a phishing scam, hacked devices brought in from the outside or general carelessness when accessing sites or apps while on the network, there are a number of different ways employees can jeopardize patient data.
For this reason, health IT professionals should first build up cyber-awareness within the organization to minimize future threats. That being said, successfully instilling cyber-awareness can be a challenge, as human nature leads individuals to believe they’re impervious to attacks. IT teams can attempt to change this mindset by educating and training the workforce.
While there are a variety of ways healthcare organizations can work to establish a more secure workplace culture, here are a few steps all should take:
- Lead by example: Executives and directors should be a model for the rest of the organization.
- Regularly schedule data training and education sessions throughout the year to provide the latest security trends to the organization and to remind everyone that protecting data is everyone’s responsibility.
- Hold unscheduled inspections. Look for unattended and logged-in devices, usernames and passwords posted near (or under) devices, disabled security tools, unapproved network devices (such as wireless routers) and the use of proper protocols when logging in and out of multi-user devices.
- Recognize security success and remediate failure. Offer gift cards or other small incentives to those who pass an inspection or a phishing test while requiring additional security awareness training for those who don’t. Some organizations start with a short remedial training that requires a 100 percent score on the follow-up quiz, then progressively longer training sessions for those who continue to fail. A formal reprimand in the employee’s yearly review is also an option at this point.
2. Â Are our current data security solutions equal to the threat?
Employee awareness is critical, but without cyber security solutions in place, deterring threats and minimizing the number of attacks on your organization will be next to impossible. To help lay the foundation for data security, organizations should first think about conducting a cyber threat assessment. This assessment will allow your organization to validate the network’s current security accuracy, analyze traffic across the environment and monitor network performance.
Once this assessment has been completed, your organization will have a better understanding of its current security posture and what steps to take next.
Evaluating the data security systems and processes in place should be a recurring process. This is essential, as changes in healthcare networks and the threat landscape often happen at a rapid rate.
3. Â Are we in sync with health tech transformation?
The healthcare industry is in the midst of a technological transformation with the goal of improving patient care, and IT needs to be ready to support this progression.
More specifically, the Internet of things (IoT) has had a significant impact on the industry, forcing organizations to seamlessly connect both wired and wireless tech devices to their network. It’s also important to know whether legacy systems and technology are keeping pace with security changes and whether they’ll be protected against the next wave of attacks.
For these reasons (and more), healthcare IT professionals looking to improve data security should consider a security solution that hosts a centralized architecture and an established advanced threat protection (ATP) framework that can be accessed and managed in one place. Next-generation security solutions can help keep healthcare data protected and allow for the expansion of new patient care delivery models.
A Strategy for Success
The healthcare industry is making great technological strides to offer exceptional patient care, convenience and comfort, but these strides often create greater cyber vulnerability.
As we move through 2017, healthcare data will remain a top target within the cybercriminal community. However, if you and your team address the above questions and establish a robust cybersecurity defense plan, threats can be effectively reduced and attacks can be mitigated in a timely manner.