Cloud computing has dramatically transformed how companies do business within the past decade. Organizations love the increased convenience and productivity possible with cloud computing, but security considerations have been overlooked or neglected.
Based on surveys and focus groups, employees have noticed it. Given the consequences of security failures within the industry, employees and stakeholders have the right to ask, how to improve cybersecurity in healthcare?
How to Improve Cybersecurity in Healthcare: Policy
Many people have a Hollywood-influenced image of cybersecurity, where black-hat hackers sit in a dark room full of computers, feverishly working to break through the security of your firewalls, passwords, and encryption.
Like most things, the movie version is generally far different from reality. Before you think about the hardware needed, you’ll need to consider your security policy. In this case, policy refers to your overall posture or mindset regarding security rather than the specific written principles.
In the past, the prevailing mindset was defensive, like a medieval castle and moat. Everything you wanted to protect was in one place, and you built your walls thick and tall to protect it. Everything inside the walls was considered to be safe.
Today, employees may access your systems from remote locations anywhere in the world. Your castle and moat won’t adequately protect you in this situation.
Zero Trust has become a minimum policy standard in the cloud-based remote systems of today. Zero Trust means that all data and access requests must be verified every time and possibly multiple times.
Verification can be accomplished through multi-factor authentication (another basic standard required to be HIPAA compliant). Still, other activities such as micro-segmentation and least-privilege access support Zero Trust policies. Effectively communicating the company’s cybersecurity policy is vital to creating the employee buy-in that supports a culture that understands and values cybersecurity.
How to Improve Cybersecurity in Healthcare: Process
Once you have decided on your cybersecurity policy, the next step is creating your process. You accomplish this by choosing the practices that will help you achieve your policy goal.
The processes must cover both breadth and depth. Some will be technically focused, such as threat monitoring and security intelligence, while others will be as basic as employee education and risk management.
Be sure that your level of detail matches the requirements of each process. Security monitoring requires more than notification of known attacks. It also needs analytic features to notify you when a system is acting abnormally.
How to Improve Cybersecurity in Healthcare: People
The success of your cybersecurity efforts ultimately hinges on how well your staff understands and follows the processes you have instituted. The obvious first step is choosing the right cybersecurity professionals with the proper expertise. These pros can be employees or outside experts such as Managed Service Providers (MSPs) or Managed Security Service Providers (MSSPs).
But the IT and Security pros can’t do it all. Every employee must be part of the cybersecurity solution; otherwise, you put your systems at risk. Statistics show that 80% of the PHI breaches that result in HIPAA violations are administrative, usually because of people’s failures rather than process. Think of the potential damage caused if someone violated a function by simply opening the phishing email that promised a $100 free Amazon gift card and exposed your systems to a ransomware attack.
How to Improve Cybersecurity in Healthcare: Product
Finally, the discussion turns to product: the actual hardware, software, and services that will make your cybersecurity policy a reality. Today, there are many more options needed than firewalls and antivirus. Cybercriminals use a variety of tactics that require specific tools such as password managers, event management dashboards, and packet sniffers.
Also, be sure that you or your suppliers buy your hardware and software from reputable vendors. Recent stories have reported that some third-party components can put your operational hardware and software technologies at risk. Remember the old axiom, “if it sounds too good to be true, it probably is.”
