The Maturity Paradigm

In healthcare we have an insatiable appetite to adopt new technology

Converging Paths

Patient safety has always been a major concern for healthcare providers but never before has it been so inextricably linked with cybersecurity. This is a subject I have blogged about, lectured to students of healthcare and cybersecurity, and spoken about to audiences of senior healthcare leaders at conferences and summits all over the world. It's a convergence that we all need to become familiar with as enterprise risks change across the industry...

The Cybersecurity Skills Shortage

I read a great article this morning by Dr. Magda Chelly published in the Singapore Independent. The article discussed the cybersecurity skills shortage and the immediate need for more cyber professionals to fill existing job vacancies in Singapore. The shortage of cybersecurity professionals is a global concern however, and Singapore is far from alone in its need for more qualified and experienced technical and managerial security professionals....

A Pattern of Complacency

A recent story which ran on CBS News entitled “How medical devices like pacemakers and insulin pumps can be hacked” highlighted deficient plans and processes by the US Food and Drug Administration for addressing medical device cybersecurity compromises. The report issued by the Inspector General has been disputed by the FDA which says that it has worked proactively on the issue with security researchers and ethical hackers to identity and fix...

Third Party Vendor Risk Management

Richard Staynings addresses the need for better Third Party Risk Management @VAHIMSS18  Lets face it, most Healthcare Covered Entities do a lousy job of managing risk - especially cyber risk in a world where data is flowing everywhere to meet government Meaningful Use requirements. In fact as an industry, we almost myopically interpret risk to refer to clinical procedures or hospital-borne post operative infection rates. In an HDO, risk is...

Strategic Cybersecurity | Making Intelligent Cybersecurity Investment Decisions

Studies show that in the face of cyber-crime costing the global economy ~$450 billion per year, organizations are investing in cyber security safeguards on an unprecedented scale. A 2017 Accenture / Ponemon study indicated that current spending priorities are often misdirected toward security capabilities that fail to deliver the greatest efficiency and effectiveness. The quality of cyber security decision making can be improved dramatically...

Panaceas, Shiny Objects and the Importance of Managing Risk in a Healthcare Environment – Part 3

Is there a more challenging position anywhere in information security than that of a healthcare organization’s cyber risk management leader? If there is, I can’t think of what it would be. Whether your title is CISO, CSO, CTO, CIO or some variation thereof, the task is daunting. As we mentioned in Part 1 of this series, healthcare as an industry has a huge target on its back. Cyber attackers focus on healthcare not only because patient information...

Medical Device Security and CIO Insomnia

During a conversation over drinks with a number of CIOs at a recent healthcare conference, I discovered that the number one concern that keeps most healthcare executives up at night is the security of their medical devices. That was somewhat unexpected, especially following press-grabbing headlines last year about ‘WannaCry’ and other ransomware attacks rendering a large part of the British NHS and other health systems useless for several weeks...

Panaceas, Shiny Objects and the Importance of Managing Risk in a Healthcare Environment – Part 2

Healthcare CIOs, CISOs, and other information risk management leaders face daunting challenges when it comes to deciding where to apply their limited resources to make the biggest difference in their organization’s cyber risk posture. As I mentioned in my previous post, healthcare security leaders can be tempted by shiny new objects – i.e., new security tools – that promise to be the panacea to their most pressing security problems. Cyber...

HIoT and Third Party Vendor Risk

The rising number of non-IT devices plugged in, or connected wirelessly, to hospital networks far overshadows the number of PCs, laptops and workstations in most facilities. What is more, most of these IoT devices have no security protections and cannot easily be patched. Medical devices are growing at 20% per annum and are often owned and managed outside of hospital IT and Security teams. No wonder then, that hospital CEOs are becoming concerned...

Panaceas, Shiny Objects and the Importance of Managing Risk in a Healthcare Environment – Part 1

You’re the CISO of a healthcare organization and you just sat through an amazing sales presentation by one of your security vendors. You are considering cutting a PO to purchase that new security tool. You’ve been thinking for some time about purchasing tools to close security gaps that you’re aware of and this particular tool appears to address a critical area of weakness in your information security program. At the same time, you’ve got...

Security Tools and SaaS

With between 45 and 65 different security vendors' tools in the average hospital CISO's tool box, healthcare providers need to make sure that third-party tools work well together and do not create unwanted complexity or introduce their own vulnerabilities. Smaller providers in particular should look to partner with service providers to procure and consume expert security services rather than continue to pour money into the management of in-house...

Shiny Objects

Security leaders all too often succumb to the distraction of a new shiny object that promises to be the panacea to all their security problems. Vendors encourage this line of thinking happy to make another sale and to have a new customer. What makes things worse is that a focus on CapEx budgets at most organizations to buy and implement more tools encourages this behavior when really an annual service may be a far cheaper, better, and faster...