BayCare Health CISO Thien Lam Shares His Insights on Disaster Recovery and Related Issues | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

BayCare Health CISO Thien Lam Shares His Insights on Disaster Recovery and Related Issues

April 13, 2018
by Mark Hagland
| Reprints
CISOs in patient care organizations are facing a tangle of issues around subjects such as disaster recovery, business continuity, and network segmentation

CISOs, CIOs, and their IT colleagues in U.S. patient care organizations are moving forward with alacrity to meet the IT and data security threat vectors accelerating in their direction these days. In that context, as a first-quarter issue special report from Healthcare Informatics noted in February, “If there’s a single IT security strategy that nearly all patient care organizations have implemented at least in part, it’s network segmentation—the purposeful separation of elements of an organization’s information technology network in order to enhance IT security. Yet at the same time, this is an area in which, industry experts say, there is also a vast lack of understanding of the underlying principles and strategies needed to make network segmentation actually help facilitate greater security, in practice.

And of course, the challenges facing the IT leaders of patient care organizations are also facing IT leaders in every type of business organization, in every industry. John Friedman, a managing consultant at the CyberEdge Group consulting firm, puts it this way in his recent white paper, “The Definitive Guide To Micro-Segmentation,” published last year by Illumio, a Sunnyvale, Calif.-based cloud computing security solutions provider: “We can no longer rely on perimeter defenses to keep the bad guys out, and are not doing so well catching them inside the data center either. Most IT security professionals are familiar with frameworks such as Lockheed Martin’s Cyber Kill Chain,” Friedman notes. But, he says, “Statistics show that it is extremely difficult to reduce the “dwell time” of attackers once they have a foothold inside the data center. Virtualization and cloud technology exacerbate this challenge. It is hard to protect applications that can be executing anywhere, with pieces being moved around continually. In this environment, limiting lateral movement within the data center becomes a top priority for IT groups. If a cybercriminal compromises the credentials of an employee who uses application A, can we make sure he can’t reach applications B, C, and D? If a hacker uncovers the password of a system administrator in location X, can we make sure she has no way to connect to systems in locations Y and Z?” That remains a fundamental IT security challenge in healthcare.”

Meanwhile, a companion special report in that issue noted that strategies are evolving forward quickly in the area of disaster recovery and business continuity, even as the leaders of U.S. patient care organizations navigate strategic and tactical complexities in that area.

One of the health system CISOs interviewed for both special reports was Thien Lam, vice president and CISO at the 15-hospital BayCare Health System, based in Clearwater, Fla. Lam spoke with Healthcare Informatics Editor-in-Chief Mark Hagland regarding both of those broad, important subjects. Below are excerpts from their interview, which took place earlier this year.

What are the biggest concerns for you right now as CISO, looking in particular at disaster recovery/business continuity, network segmentation, and related issues?

Webinar

How to Assess IT Risk in a Healthcare Environment

In this webinar, Community Health System’s CISO Scott Breece and Lockpath's Sam Abadir will discuss the unique IT landscape of the healthcare industry and the challenges this presents for IT risk...

The biggest concern for me is incident response, and how mature we are when we respond to incidents, or how we recognize incidents. There are many steps involved. You have detection; you detect that someone’s tried to hack you. And you respond to find out how quickly you can put out the fire. In terms of detection, my biggest concern is that the hackers are usually ahead in terms of technology; and it can sometimes be very challenging to detect an attack, and to get your people engaged and looking into a situation. Most of the time, you’re managing day-to-day operations, but at the same time, you have to be ready to respond when people are knocking at your door. So, definitely incident response is very important. And you have to be able to recognize the many ways in which the hackers can get in. Web traffic can be very hard to see. Another big issue is medical devices. When you talk about network segmentation, most people use the terms network segmentation and network isolation very loosely.

What are you and your colleagues doing in that area?

In terms of network segmentation, we’ve created a separate network for the medical devices, so that the medical devices don’t talk directly to the production network; they have their own VLAN. Also, we have devices that we put in front of the medical devices—they’re like a mini-firewall, to make sure the medical devices aren’t vulnerable to an attack. And there are many, many different types of medical devices. Many don’t have an OS (operating system). But most do. And some can be upgraded, and some cannot. And sometimes, you have medical devices that are current, and some that are out of date.

And they may be on XP or on an OS [operating system] that cannot be upgraded or patched. And the issue is that, most of the time, the manufacturers themselves don’t provide patches. They’ll ask you to upgrade a device or replace an old one, but that can cost millions of dollars. So with regard to network segmentation, we want to make sure that we put the medical devices on a VLAN, so that they can’t talk directly to the Internet. At the same time, we micro-segment them by putting a mini-firewall in front of each medical device, and we’ve also locked USB port on the device. You put in a USB key. So we protect them physically also, and also protect the medical devices from the rest of the network.

What is your overall segmentation arrangement or plan?

We have a plan moving forward that we’re in the process of executing on. Most of us have had flat networks, with everything can talk to everything—your network at home, your car, everything—we’ve spent 20 years creating that connectivity. Now, with all the incidents taking place, it’s clear that that’s no longer a good idea. So now we have to look at this from a role-based standpoint. What we’re planning to do is that we’re going to segment by facility. So if there is an infection within one facility, we want to isolate that facility from the rest of the network, so that the malware or ransomware can’t spread.

The good thing for us is that our EMR is centralized in one location, via the data center. So if we isolate a facility, then that location will not be able to connect to that centralized EMR. So will we plan to segment based on the role or function of a user? We’re not there yet. In the future, potentially, we’ll go down that path. There’s some discussion of looking at, say, if you’re in Human Resources, you shouldn’t have access to the medical device network, for example. We’re not there yet, but we’ll get there.

We also have network access control, which can detect at normal traffic; if traffic is excessive, we can potentially stop that device from connecting to the network. We may not go to the user level, but we may go to the device level.

How do you see the interrelationship between disaster recovery and business continuity? CISOs and other healthcare IT leaders have a diversity of opinions on that.

Business continuity planning is more operational; it is more than just about IT systems. IT systems are just a component of data availability. We live in Florida, which has a hurricane season every year that we have to plan for. And to me, you have to plan for BCP beyond just IT. Because if a hurricane comes, it’s not just the IT system that will be affected, but your generator, your electricity, your water, etc. So my take is that BCP needs to be much broader than just the IS system. The IS system will be just a component of that. Someone needs to own the BCP for the entire system. And that’s true, too, of disaster recovery. Disaster recovery is not just an IT function, it’s a business concern, too.

And in terms of disaster recovery?

We’ve hired a third party to work for us in that area. They’re 1,000 miles away. We have a data center locally and a data center in the Northeast. And we have a disaster recovery plan, so that if we’re ever in a disaster situation, we can switch to our second system 1,000 miles away. We do two tests a year. We simulate the primary data center being down, and we switch to the second data center, and the team makes sure we have connectivity and flow, and the business signs off on the DR test. And every time you do a DR exercise, you identify an issue or issues, and we correct those.

On the business side, we have a disaster recovery plan for the business. And we’ve done testing, but we haven’t done it regularly. The operational side may do it more regularly than that.

What advice might you like to share with your peers on network segmentation and disaster recovery and business continuity?

Per network segmentation, you definitely need to do it. I would be cautious not to try to do it too quickly. I would take time to do it and plan it out, and make sure that we’re creating a plan that will benefit the system. Have a good plan in place, and be prepared to identify challenges along the way. Before we do network segmentation, we need to make sure we understand what businesses would be impacted, and the outcome of that. Because it can really impact a lot of them. I think network segmentation is a good thing. But at the same time, I would tell my colleagues to do it carefully.

 

 

 


2019 Southern California San Diego Health IT Summit

Renowned leaders in U.S. and North American healthcare gather throughout the year to present important information and share insights at the Healthcare Informatics Health IT Summits.

April 23 - 24, 2019 | Southern California


/article/cybersecurity/baycare-health-system-s-ciso-thien-lam-shares-strategic-insights-disaster
/news-item/cybersecurity/44m-patient-records-breached-q3-2018-protenus-finds

4.4M Patient Records Breached in Q3 2018, Protenus Finds

November 7, 2018
by Rajiv Leventhal, Managing Editor
| Reprints

There were 117 disclosed health data breaches in the third quarter of 2018, leading to 4.4 million patient records breached, according to the Q3 Protenus Breach Barometer report.

Published by Protenus, a cybersecurity software company that issues a Breach Barometer report each month, the most recent data shows that although the number of incidents disclosed in Q3 decreased somewhat from Q2, the number of breached records increased from Q2 to Q3. Also, the number of affected patient records has continued to climb each quarter in 2018—from 1.13 million in Q1 to 3.14 million in Q2 to 4.4 million in Q3.

In Q3, the report noted that the single largest breach was a hacking incident affecting 1.4 million patient records that involved UnityPoint Health, an Iowa-based health system. Hackers used phishing techniques, “official-looking emails”, to gain access to the organization’s email system and capture employees’ passwords. This new incident follows one that took place at the same organization in April when 16,400 patient records were breached as a result of another phishing attack.

For incidents disclosed to HHS (the Department of Health & Human Services) or the media, insiders were responsible for 23 percent of the total number of breaches in Q3 2018 (27 incidents). Details were disclosed for 21 of those incidents, affecting 680,117 patient records (15 percent of total breached patient records). For this analysis, insider incidents are characterized as either insider-error or insider-wrongdoing. The former includes accidents and other incidents without malicious intent that could be considered “human error.” 

There were 19 publicly disclosed incidents that involved insider-error between July and September 2018. Details were disclosed for 16 of these incidents, affecting 389,428 patient records. In contrast, eight incidents involved insider-wrongdoing, with data disclosed for five of these incidents.

Notably, when comparing each quarter in 2018, there has been a drastic increase in the number of breached patient records as a result of insider-wrongdoing. In Q1 2018, there were about 4,600 affected patient records, in Q2 2018 there were just over 70,000 affected patient records, and in Q3 there were more than 290,000 affected patient records tied to insider-wrongdoing.

What’s more, the report found that hacking continues to threaten healthcare organizations, with another increase in incidents and affected patient records in the third quarter of 2018. Between July and September, there were 60 hacking incidents—51 percent of all Q3 2018 publicly disclosed incidents. Details were disclosed for 52 of those incidents, which affected almost 3.7 million patient records. Eight of those reported incidents specifically mentioned ransomware or malware, ten incidents mentioned a phishing attack, and two incidents mentioned another form of ransomware or extortion. However, it’s important to note that the number of hacking incidents and affected patient records have dropped considerably when comparing each month between July and September 2018.

Meanwhile, of the 117 health data breaches for which data was disclosed, it took an average of 402 days to discover a breach from when the breach occurred. The median discovery time was 51 days, and the longest incident to be discovered in Q3 2018 was due to insider-wrongdoing at a Virginia-based healthcare organization. This specific incident occurred when an employee accessed thousands of medical records over the course of their 15-year employment.

More From Healthcare Informatics

/news-item/cybersecurity/survey-reveals-disconnect-between-perception-and-reality-medical-device

Survey Reveals Disconnect Between Perception and Reality of Medical Device Security

November 6, 2018
by Heather Landi, Associate Editor
| Reprints

A recent survey of healthcare IT professionals found a troubling disconnect between IT leaders’ confidence in the visibility and security of their connected medical devices and the effectiveness of legacy solutions to secure connected medical devices.

The vast majority of healthcare IT professionals (87 percent) feel confident that the connected medical devices in their hospitals are protected in case of a cyberattack. However, the survey also revealed a contradiction between the confidence that healthcare professionals have in the visibility of connected medical devices and security of their networks, and the inefficient and ineffective legacy processes many still rely on to keep them secure.

The survey from Zingbox, a provider of Internet of Things (IoT) security solutions, is based on responses from 400 U.S.-based healthcare IT decision-makers and clinical and biomedical engineers and indicates that there continues to be a widespread misconception that traditional IT security solutions can also adequately secure connected medical devices.

Seventy-nine percent of respondents say their organization has real-time information about which connected medical devices are vulnerable to cyber attacks. And, 69 percent feel traditional security solutions for laptops and PCs are adequate to secure connected medical devices.

“Most organizations are thinking about antivirus, endpoint protection and firewalls, but there are many devices — like medical monitoring equipment — and no one is thinking about securing them,” Jon Booth, Bear Valley Community Hospital District IT director and Zingbox customer, said in a statement. Additionally, as noted in a Gartner report, Market Trends: Five Healthcare Provider Trends for 2018 published in November 2017 notes: “Generally, medical devices are not replaced for at least 10 years, with many running old software that has not been updated or patched.”

And there are other challenges: the Zingbox survey revealed 41 percent of healthcare IT professionals do not have a separate or sufficient budget for securing connected devices.

When asked about inventory of connected medical devices, majority of clinical and biomedical engineers (85 percent) were confident that they have an accurate inventory of all connected medical devices even though many rely on manual audits, which are prone to human error and quickly become outdated.

What’s more, close to two-thirds (64 percent) of responses from clinical and biomedical engineers indicate reliance on some form of manual room-to-room audit or use of static database to inventory the connected devices in their organization. Just 21 percent of responses say their devices receive preventative maintenance based on device usage as opposed to some kind of fixed schedule.

The survey also shows that more than half (55 percent) of responses indicate clinical/biomedical engineers must walk over to the device or call others to check on their behalf whether a device is in-use before scheduling repairs. Many make the trip only to find out that the device is in-use by patients and must try again in the future hoping for better luck, according to the survey.

“Despite the recent progress of the healthcare industry, the survey exemplifies the continued disconnect between perception of security and the actual device protection available from legacy solutions and processes. Unfortunately, much of the current perception stems from the use of traditional solutions, processes and general confusion in the market,” Xu Zou, CEO and co-founder of Zingbox, said in a statement. “Only by adopting the latest IoT technology and revisiting decade-old processes, can healthcare providers be well prepared when the next WannaCry hits.”

 

Related Insights For: Cybersecurity

/news-item/cybersecurity/hhs-opens-rebranded-healthcare-cyber-center

HHS Opens Rebranded Healthcare Cyber Center

November 2, 2018
by Heather Landi, Associate Editor
| Reprints
Click To View Gallery

The U.S. Department and Health and Human Services (HHS) this week officially opened the Health Sector Cybersecurity Coordination Center (HC3), designed to strengthen coordination and cybersecurity information sharing within the healthcare sector and promote cybersecurity resilience.

According to HHS officials, HC3 is an operational cybersecurity center designed to support and improve the cyber defense of the healthcare and public health sector. The center will work to cultivate cybersecurity resilience by providing timely and actionable cybersecurity intelligence to health organizations and developing strategic partnerships between these organizations.

The Administration, under President Donald Trump, has designated the Department of Homeland Security (DHS) as the lead organization to combat cyber threats and develop preventive strategies across the entire economy, with HHS given the role to focus cybersecurity support on information sharing within the healthcare and public health (HPH) sector.

“HHS is proud to work with the health community to better protect Americans’ health data and confidential information,” HHS Deputy Secretary Eric Hargan said in a statement, adding that the announcement “is a recognition of the importance we place on stakeholder engagement as part of our cybersecurity work.”

Jeanette Manfra, assistant secretary for cybersecurity and communications in DHS, said in a statement that HC3 is a “vital capability for the early detection and coordination of information between the private sector and the federal government, and with cyber professionals across the federal government.”

“We believe that when a risk is shared across sectors, the only way to manage that risk successfully is to manage it collectively. We know that the majority of the cybersecurity attacks that occurred over the past year could have been prevented with quality and timely information - and the heightened importance of sharing information cannot be stressed enough,” Manfra said.

The opening of HC3 respresents the second healthcare-focused cybersecurity center in two years. In June 2017, the Healthcare Cybersecurity and Communications Integration Center (HCCIC) launched and was designed to focus its efforts on analyzing and disseminating cyberthreats across the healthcare industry in real time. However, the fledgling HCCIC was almost immediately mired in controversy due to abrupt changes in leadership. In just six months after HCCIC began operations, the HCCIC’s top leaders were reassigned.

In November 2017, there were reports that HCCIC's work was stalled as it was at the center of an investigation into contracting irregularities and possible fraud allegations. The cyber operations center was “paralyzed” by the removal of its top two officials, according to reports. Leo Scanlon, deputy chief information security officer at HHS, who ran the HCCIC, was put on administrative leave in September 2017  and his deputy, Maggie Amato, left the government. The HHS Office of the Inspector General then confirmed, at the time, an ongoing investigation into the reassignment of HCCIC leadership.

About a week letter, the House Committee on Energy and Commerce issued a letter saying it was examining whether HHS retaliated against two key HHS cybersecurity officials and whether those actions weakened the federal agency’s role in responding to healthcare cybersecurity incidents.

During the summer of 2017, HHS officials had touted the center’s success in light of the WannaCry ransomware attack back in March 2017, in which the U.S. healthcare system saw minimal impact. In an interview with Healthcare Informatics this past March, former HHS Deputy CISO Scanlon said the HCCIC, which played such a promising role during the WannaCry incident, had been "derailed" by the leadership reassignments.

There also were rumors back in March that the HCCIC would be rebranded and housed within Homeland Security in order to align with DHS’s information-sharing efforts. Scanlon said at the time that the effort to create a healthcare-specific cybersecurity information-sharing center was now "back to square one.”

It seems those rumors bore out as the new cyber center, HC3, is housed within DHS, whereas HCCIC, which is now gone, was intended to be a standalone entity partnering with NH-ISAC.

In the past year and a half, Congressional leaders have voiced concerns about the lack of clarity on the direction of HCCIC and HHS’ overall cybersecurity capabilities. Back in June, members of the House Energy and Commerce Committee and the Senate Committee on Health, Education, Labor and Pensions wrote a letter to HHS leaders citing concerns about the leadership changes, specifically the reassignment of senior officials responsible for the day-to-day operation of the HCCIC. “HHS’s removal of senior HCCIC personnel has had undeniable impacts on HCCIC and HHS’s cybersecurity capabilities.”

According to HHS and DHS officials, the mission of the new cybersecurity center, HC3, is now more important than ever with the healthcare sector reporting over 400 major breaches from 2017 to 2018. “Within the HPH sector, the threats are significant and hackers covet having the potential to access sensitive medical data, damage medical equipment, secure intellectual property for financial gain, or even conduct terrorist attacks.  The HC3 provides a service to healthcare organizations that enables them to protect their assets and patients,” Administration officials said in a press release.

To address these threats to the sector, HHS has developed a “coordination center” in the HC3 to coordinate the activities across the sector and report to DHS threats, profiles, and preventive strategies. The HC3’s role is to work with the sector, including practitioners, organizations, and cybersecurity information sharing organizations to understand the threats it faces, learn the bad guys’ patterns and trends, and provide information and approaches on how the sector can better defend itself, officials said.

 

See more on Cybersecurity

betebettipobetngsbahis bahis siteleringsbahis