Selling Cybersecurity in the Age of Ransomware | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Selling Cybersecurity in the Age of Ransomware

January 18, 2017
by Heather Landi
| Reprints
In the boardroom, CISOs are making the business case for cybersecurity as not just an operational issue, but a patient safety and patient quality issue too
Click To View Gallery

This past year the very real danger that cybersecurity threats pose to healthcare delivery organizations made big headlines—there was the cyber attack on the 10-hospital MedStar Health system and the ransomware attack on Los Angeles-based Hollywood Presbyterian Medical Center. In the case of Hollywood Presbyterian, the attack shut down the organization’s information systems for about two weeks before hospital officials admitted that they agreed to pay a $17,000 ransom.

Most cybersecurity experts predict that data security threats against the healthcare industry will only continue to evolve in 2017 as widespread malicious and criminal hacking poses an increased risk to protected health information (PHI) and healthcare organizations’ information systems. Beyond the financial impact, cyber attacks that shut down information systems, such as electronic health records (EHRs), can disrupt clinical operations and pose significant patient safety risks.

And while these headlines about ransomware attacks against hospitals have been a disturbing wake-up call for the industry, many hospitals and health systems are still not doing enough to strategically address data security, according to many cybersecurity experts. “There are organizations adopting a more proactive approach to data security, but for the most part, we’re still a very reactive industry,” says Mac McMillan, CEO of the Austin, Tex.-based CynergisTek consulting firm.

“Ransomware will continue to be a threat, as long as it’s effective,” he says. “I think I would broaden it beyond ransomware, and I would say, any attack that presents an opportunity for the attacker to disrupt services and data and extort the victim. So, it could be ransomware or a zero day attack. At the end of the day, as long as the attacker can use it to extort money, they are going to continue to use it.”

Webinar

Components of Strong Cybersecurity Program - A Closer Look at Endpoint Security Best Practices

Endpoint protection remains a core security challenge for many healthcare organizations and it is more important than ever for healthcare organizations to actively manage their full range of...

Mac McMillan

According to cybersecurity experts, there is some good news. Healthcare delivery organizations are increasing their investments in technologies and solutions to help improve malware detection on their networks and to quickly mitigate when a problem arises to limit the damage.

Gregg Mohrmann, a director with The Chartis Group, a Chicago-based consulting firm, who focuses on the strategic and operational use of IT, says he sees three major data security risks facing healthcare organizations that are getting their boards’ attention due to the financial and patient safety risks. “There are data breaches and the notifications to HHS (U.S. Department of Health and Human Services). The HHS Office for Civil Rights’ wall of shame reported 328 reportable incidents in 2016, a 21 percent uptick from the previous year. And, the cost to remediate a breach is $350 per record and there’s often fines, which are expensive. There’s medical identity theft and there were about 3,100 incidents serviced by Experian in 2014 and 81 percent had some sort of employee negligence. And, then, of course, ransomware.”

Gregg Mohrmann

John Petersen, an Albany, N.Y.-based consultant with The Chartis Group and senior manager leading the consultancy’s cybersecurity capabilities in the informatics and technology practice, says the total cost impact of ransomware to healthcare organizations is significantly less than other issues, such as data breaches and medical identity theft. “Some of these ransoms have actually been very low, and not a motivating factor for healthcare organizations to do anything about it other than pay the ransom,” he notes.

Chief information security officers (CISOs) and CIOs face significant challenges in their work to strengthen data security, and one major challenge is that, despite the very real threat of internal and external data breaches, investments in data security can be a tough sell.

“Security, like any other non-revenue producing function, has the pressure of being a cost center, for the business,” McMillan says. “In other words, the people who are trying to make decisions on how best to spend dollars that they have are looking at options that can generate more revenue and more business. These organizations are running against very tight budgets, they are running up against very low reimbursement and they are running against a lot of the financial pressures that healthcare has today. And, they are asking for dollars that don’t contribute to production of revenue,” McMillan says.

Making a Strong Business Case for Cybersecurity

Many CISOs report that board-level discussions about data security threats and security strategies have increased and become more involved in the past few years, likely due to the high profile ransomware attacks.

“The questions are getting deeper,” Ron Mehring, CISO at Dallas-based Texas Health Resources, says, regarding executive-level discussions. “The board is asking more follow-up questions and so are the executive leaders. Where five years ago we might have been talking about passwords, and simple, access management concepts, now we’re talking about deep technical attacks and how things are getting broken into with big healthcare delivery networks. They want to understand risk profiles and where do we really stand. Questions such as, ‘what is our real risk posture in that area? Are we vulnerable to a phishing attack, or are we not? What are the three to five things we need to do better?’”

Mehring, who has served as CISO at Texas Health Resources for the past five years, says he has not “had to do a ton of selling to the board.” He says, “The board and the membership has just been very tuned into the subject of security and have a good head for it.”

“The difficult thing has been making sure I’ve got the things that we need to take care of problems today, and being up front and articulating the problems that we need to take care of today, and then also articulating the things that we can wait, perhaps one, two and three years, and presenting it in a good work plan. That’s important because those things influence budgets and influence the allocation of manpower to fix things or to manage risk.”

Given the evolving, ongoing threats, Mehring says rather than reacting to every threat, CISOs and executive leaders need to have a disciplined, programmatic approach to managing risk over a longer period of time.

However, before approaching the board, there is some groundwork that needs to be done, he says. “There’s some good work that has to be done with the executive leadership team so you can go in as a team and have these good discussions,” he says.

Ronald Mehring

“The next thing is great storytelling,” he says. “It is a complicated subject matter. In many cases, it’s a very deep, technical realm and a lot of deep, technical subjects that require a bit of finesse to explain to a group that might not understand the day-to-day work. You can use good data visualization to tell a story through that data and that can guide them down a very complex path and get to where you both understand the work that needs to be done.”

McMillan says it’s critical for the CISO to understand the hospital or health system’s business objectives. “What is the hospital trying to accomplish—is it trying to grow through acquisitions, is the hospital trying to increase its footprint by outreach efforts to patients through things like telehealth and population health, and what is the business trying to accomplish? And how risk adverse is the business with respect to things like its reputation and avoiding cost?”

Secondly, the CISO needs to translate what the threats are into credible risks against those business objectives. “You should be able to say, ‘these are the kinds of things that we need to be aware of and we need to protect against because it directly impacts our ability to do x, y and z as a business, then that means much more to those executive leaders or board members that you are talking to,” he says.

Petersen agrees, noting that the CIO or CISO needs to be able to translate cybersecurity jargon into some sort of a board-level understanding and quantify those cybersecurity mitigation efforts to dollars saved or how it supports a key business strategy. “And, you need to be able to tie it back to patient care and patient safety. Based on my previous experience working with healthcare clients and putting a business case together, that’s a key line item that we include in there—how does this support patient care and patient safety?”

He adds, “If [board members] don’t understand what you’re trying to sell, because you’re talking all the acronyms and can’t relate it to dollars and sense and how it supports those key business strategies, you’re going to have a long battle and sometimes those individuals aren’t able to get those initiatives approved.”

Mohrmann adds, “You’ve got to come with data that really ties out the risk and tying that to what is the impact to both your operations and the bottom line.”

John Petersen

Foundational to building a business case for cybersecurity investments, according to Petersen, is developing the effective situational awareness by performing a risk analysis. “This is fundamental to understanding your environment, to understanding what your security program needs to be, how are those risks going to impact the organization and putting a security program together that’s really going to identify what are these additional systems or processes or controls that need to be in place. If don’t do that risk analysis, then you don’t have anything to support your request when you do go to the board.”

Petersen, who served as an IT director at a medical center prior to his consultant work, added, “When I did this before, I was able to very confidently go to the board and say, we’ve done our risk analysis, as defined by NIST and as required by HIPAA, we know we have some gaps in our program, and these are the most critical ones that need to be addressed because they have the most impact to the organization and they have the highest probability to occurrence.”

Many CISOs and cybersecurity experts agree that it’s important for CISOs to develop a three-to-five year roadmap outlining the organization’s long-term data security strategies and priorities.

Executive Collaboration and Information Sharing

Many CISOs and cybersecurity experts emphasize the need for collaboration with other executive leaders in the organization in order to build relationships and credibility.

“Because CISOs can’t do this alone, they really need to have built relationships with other senior executives who stand behind them—the CFOs, for example, as they want to make sure the financial data is protected. So it would be a good idea for the CIO to partner with the CFO to make sure they have the necessary security controls in place, and tag-team that,” Petersen says. “Building a cross functional security committee is very beneficial and can help to drive things forward.”

It’s also critical for CISOs to share ideas and strategies, and this can be facilitated through industry organizations, such as HITRUST or HIMSS.

“Talk to your peers and ask them about their experiences, so you don’t have to cross the same ground,” Mehring says. “I have a good peer group and I can ask them, have you used this technology solution or tested it? That helps to narrow down some of the noise in that [vendor solutions] space and gets you to a manageable level of vendors to work with. Information sharing, and peer grouping, I can’t say enough about how important that is because of how complex the cybersecurity world is.”

He adds, “There’s a saying that we shouldn’t have to compete on the security side. We all might be in the same market competing against each other for market share, but when we talk about security, we should never have to compete on that because we’re all trying to solve the same problem and take care of those patients and caregivers and do what our health systems are designed to do."


The Health IT Summits gather 250+ healthcare leaders in cities across the U.S. to present important new insights, collaborate on ideas, and to have a little fun - Find a Summit Near You!


/article/cybersecurity/selling-cybersecurity-age-ransomware
/blogs/mark-hagland/cybersecurity/assessing-new-cybersecurity-practices-publication-why-small-and

Assessing the New Cybersecurity Practices Publication: Why Small and Medium-Sized Care Organizations Have Reason to Rejoice

| Reprints
A new set of voluntary cybersecurity practices just released by HHS offers practical advice and conceptual supports that fill information gaps
Click To View Gallery

How helpful will the new set of voluntary cybersecurity practices that the Department of Health and Human Services (HHS) released in late December, be, to the leaders of patient care organizations? Only time will tell, as part of the value of the release will only be made manifest as the leaders of patient care organizations move forward to implement some of those practices, and the potential success of such implementations is in some way measured and benchmarked.

But the release is a first start, at least. As Healthcare Informatics Associate Editor Heather Landi reported on January 2, HHS released the set of practices in the form of a publication “that marks the culmination of a two-year effort that brought together over 150 cybersecurity and healthcare experts from industry and the government under the Healthcare and Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership.”

“Cybersecurity is everyone’s responsibility. It is the responsibility of every organization working in healthcare and public health.  In all of our efforts, we must recognize and leverage the value of partnerships among government and industry stakeholders to tackle the shared problems collaboratively,” Janet Vogel, HHS Acting Chief Information Security Officer (CISO), said in a statement published with the release of the new publication.

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP), the primary publication of the Cybersecurity Act of 2015, Section 405(d) Task Group, aims to raise awareness, provide vetted cybersecurity practices, and move organizations towards consistency in mitigating the current most pertinent cybersecurity threats to the sector,” HHS officials stated. “It seeks to aid healthcare and public health organizations to develop meaningful cybersecurity objectives and outcomes. The publication includes a main document, two technical volumes, and resources and templates.”

The overall publication consists of several sections, the first being the HICP, which “examines cybersecurity threats and vulnerabilities that affect the healthcare industry. It explores five current threats and presents 10 practices to mitigate those threats; “Technical Volume 1: Cybersecurity Practices for Small Health Care Organizations,” which offers cybersecurity practices for small healthcare organizations; “Technical Volume 2: Cybersecurity Practices for Medium and Large Health Care Organizations”; the “Resources and Templates” portion, which “includes a variety of cybersecurity resources and templates for end users to reference”; and a Cybersecurity Practices Assessments Toolkit, which “helps organizations prioritize their cyber threats and develop their own action plans using the assessment methodology outlined in the Resources and Templates volume”—that last section being still under development as of Jan. 2.

As Landi reported, “The HICP publication aims to provide cybersecurity practices for this vast, diverse, and open sector to ultimately improve the security and safety of patients. The main document of the publication explores the five most relevant and current threats to the industry. It also recommends 10 cybersecurity practices to help mitigate these threats.”

What’s more, she wrote, “The main document presents real-life events and statistics that demonstrate the financial and patient care impacts of cyber incidents.  It also lays out a call to action for all industry stakeholders, from C-suite executives and healthcare practitioners to IT security professionals, that protective and preventive measures must be taken now. The publication also includes two technical volumes geared for IT and IT security professionals, one focusing on cybersecurity practices for small healthcare organizations, and one focused on practices for medium and large healthcare organizations.”

Among the salient statistics reported in the HICP:

  • Fifty-eight percent of malware attack victims are small businesses.
  • In 2017, cyber-attacks cost small and medium-sized businesses an average of $2.2 million.
  • Sixty of small businesses go out of business within six months of an attack.
  • And, 90 percent of small businesses do not use any data protection at all for company and customer information.

How does that translate into impacts on smaller healthcare organizations? Among other incidents, the HICP notes that:

  • A popular orthopedic practice announced that its computer system was hacked via breach of a software vendor’s log-in credentials. This breach put just under a half-million people at risk of identity theft. Of those, 500 patient profiles appeared for sale on the dark web. The information for sale included names, addresses, social security numbers, and other personally identifiable information (PII). Although not posted for sale, pertinent PHI such as X-ray results and medical diagnoses were also stolen.

 

  • A rural hospital had to replace its entire computer network after a ransomware cyber-attack froze the hospital’s electronic health record (EHR) system. Doctors were unable to review their patients’ medical histories or transmit laboratory and pharmacy orders. Officials were unable to restore essential services and could not pay the ransom for the return of their system. After consultations with the Federal Bureau of Investigation and cybersecurity experts, hospital officials made the difficult decision to replace the entire system.
  •  

Of particular practicality is some of the very basic advice given to the leaders of smaller healthcare organizations. To wit: “Doctors and nurses know that hand sanitizing is critical to prevent the spread of germs. That does not mean health care workers wash up as often as they should. Similarly, we know that cybersecurity practices reduce the risk of cyber-attacks and data breaches. Just as we are able to protect our patients from infection, we should all work towards protecting patient data to allow physicians and caregivers to trust the data and systems that enable quality health care. Just as health care professionals must wash their hands before caring for patients, health care organizations must practice good ‘cyber hygiene’ in today’s digital world, including it as a part of daily universal precautions,” the HICP notes. “Like the simple act of hand-washing, a culture of cyber-awareness does not have to be complicated or expensive for a small organization. It must simply be effective at enabling organization members to protect information that is critical to the organization’s patients and operations. Your organization’s vigilance against cyber-attacks will increase concurrently with your and your workforce’s knowledge of cybersecurity. This knowledge will enable you to advance to the next series of cybersecurity Practices, expanding your organization’s awareness of and ability to thwart cyber threats.”

Meanwhile, both smaller and larger patient care organizations will benefit from the technical supports, including a Security Risk Assessment Tool, a set of recommendations on medical devices and cybersecurity, and an incident response risk management handbook.

What this set of resources does is to fill a gap between theory and technical practice in a key area. Will it shift the entire landscape of cybersecurity for patient care organizations? No, that would be a far-too-ambitious goal. But the healthcare IT leaders of smaller and medium-sized patient care organizations in particular, will welcome practice advice and supports, as they move forward in their journeys around cybersecurity. Any such journey is inherently challenging, and federal publications and resources like these will be of real value in moving patient care organization HIT leaders forward.

 

 

More From Healthcare Informatics

/news-item/cybersecurity/hhs-releases-voluntary-healthcare-cybersecurity-practices

HHS Releases Voluntary Healthcare Cybersecurity Practices

January 2, 2019
by Heather Landi, Associate Editor
| Reprints

In late December, the Department of Health and Human Services (HHS) released voluntary cybersecurity practices to the healthcare industry with the aim of providing practice guidelines to cost-effectively reduce cybersecurity risks.

The “Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients” publication aims to provide guidance to healthcare organizations of all types and sizes, ranging from local clinics to large hospital systems.

The industry-led effort was in response to a mandate set forth by the Cybersecurity Act of 2015 Section 405(d), to develop practical cybersecurity guidelines to cost-effectively reduce cybersecurity risks for the healthcare industry.

According to HHS, the publication marks the culmination of a two-year effort that brought together over 150 cybersecurity and healthcare experts from industry and the government under the Healthcare and Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership.

“Cybersecurity is everyone’s responsibility. It is the responsibility of every organization working in healthcare and public health.  In all of our efforts, we must recognize and leverage the value of partnerships among government and industry stakeholders to tackle the shared problems collaboratively,” Janet Vogel, HHS Acting Chief Information Security Officer (CISO), said in a statement.

While technologies are vital to the healthcare industry and help provide life-saving treatments and improve patient care, these same technologies are vulnerable to myriad attacks from adversaries, ranging from criminals and hacktivists to nation-states, according to HHS. These technologies can be exploited to gain access to personal patient data or render entire hospital systems inoperable. Recent cyber-attacks against the nation’s healthcare industry continue to highlight the importance of ensuring these technologies are safe and secure.

“The healthcare industry is truly a varied digital ecosystem. We heard loud and clear through this process that providers need actionable and practical advice, tailored to their needs, to manage modern cyber threats. That is exactly what this resource delivers; recommendations stratified by the size of the organization, written for both the clinician as well as the IT subject matter expert,” Erik Decker, industry co-lead and Chief Information Security and Privacy Officer for the University of Chicago Medicine, said in a statement.

The HICP publication aims to provide cybersecurity practices for this vast, diverse, and open sector to ultimately improve the security and safety of patients. The main document of the publication explores the five most relevant and current threats to the industry. It also recommends 10 cybersecurity practices to help mitigate these threats.

The main document presents real-life events and statistics that demonstrate the financial and patient care impacts of cyber incidents.  It also lays out a call to action for all industry stakeholders, from C-suite executives and healthcare practitioners to IT security professionals, that protective and preventive measures must be taken now. The publication also includes two technical volumes geared for IT and IT security professionals, one focusing on cybersecurity practices for small healthcare organizations, and one focused on practices for medium and large healthcare organizations.

 

Related Insights For: Cybersecurity

/news-item/cybersecurity/cynergistek-protenus-partner-privacy-monitoring-programs

CynergisTek, Protenus Partner on Privacy Monitoring Programs

December 26, 2018
by Heather Landi, Associate Editor
| Reprints

CynergisTek, Inc., an Austin, Texas-based healthcare cybersecurity firm, is partnering with Protenus, a healthcare compliance analytics company, to combine the companies’ technology tools and services with a focus on patient privacy monitoring programs.

The partnership will grant health systems access to Protenus’ analytics platform that leverages artificial intelligence to gather data related to potential patient privacy risks, along with CynergisTek’s patient privacy monitoring services.

According to the Protenus research, insider incidents accounted for 23 percent of all breaches that occurred at health systems in Q3 2018. This figure will only continue increasing, indicating that now more than ever, health systems need a cost-effective solution to meet the daily challenges of managing patient privacy.

To address this need, CynergisTek and Protenus formed a preferred partnership to combine CynergisTek’s healthcare consulting experience and privacy programs with Protenus’ healthcare analytics technology to offer health systems both the people, processes, and technology components of a strong patient privacy monitoring program, according to the companies.

“As health systems face mounting challenges in creating and maintaining robust patient privacy monitoring programs, we identified a need to partner with a company offering complementary services so that health systems can act on the insights uncovered by our analytics,” Nick Culbertson, CEO and co-founder of Protenus, said in a statement.

 “Data privacy is evolving as a dominate theme in conversations, both in healthcare and other industries, and health systems need to take an end-to-end approach to patient privacy to truly address this complex and mission-critical challenge,” Mac McMillan, CEO and president of CynergisTek, said in a statement.

 

See more on Cybersecurity

agario agario---betebet sohbet hattı betebet bahis siteleringsbahis