Free Newsletter
Register for our Free Newsletters
Newsletter
Zones
Analysis, Inspection and Laboratory
LeftNav
Assisted/Independent Living
LeftNav
Clinical and Nursing Equipment
LeftNav
Design and Manufacture of Medical Equipment
LeftNav
Diagnostics Equipment, Monitoring and Test
LeftNav
Education, Training and Professional Services
LeftNav
Health Education and Patient Management
LeftNav
Health Estates Management
LeftNav
Healthcare Support and Information Services
LeftNav
Hygiene and Infection Control
LeftNav
IT and Communications in Healthcare
LeftNav
Materials
LeftNav
Medical Device Technology
LeftNav
Research and Development
LeftNav
Safety and Security
LeftNav
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Health Zone
Pro Security Zone
Web Lec
Pro Engineering Zone
 
 
News

Cyber attack protection for healthcare patient records

Lancope : 23 March, 2015  (Technical Article)
Mike Potts of IT security company, Lancope explains how the protection of healthcare records from cyber attacks is similar to a game of cat and mouse
Cyber attack protection for healthcare patient records


The never-ending battle between healthcare organisations and cyber attackers has always been like a game of cat and mouse. The hacker plays the role of the mouse, constantly trying to sneak past the company’s cat that is guarding information. For years, the cat not only consistently beat the mouse, he would help his fellow cats identify new mice and keep them out of their cupboards too. But as the successful data breaches over the past year demonstrate, including one earlier this year that made headlines after millions of health insurance records were compromised, the mice are now kicking the cats in their tails.



As the healthcare sector continues its collective effort to move to a 100-percent electronic records system, these recent attacks should serve to do two things. First, it should shine a light on why your existing cybersecurity system is likely inadequate – even if it complies with HIPAA’s Security Rule. Second, it should prompt you to immediately call your CSO, CIO and IT administrators into your office to overhaul your security posture and establish new employee education and incident response training programs.



While you may not have thought of this industry as a primary target for attackers, I hope you understand that cyber criminals consider healthcare information just as valuable as credit card numbers and other financial records if not more so given the longer shelf life of social security numbers and other personal information. And furthermore, traditional security solutions alone are incapable of keeping thieves out of your network. Healthcare security needs a more holistic approach that keeps watch both outside and inside your network and can help your security personnel more quickly identify and remediate threats. Here is why:



A Game of Cat and Mouse



Your first question might be, “what happened to the cat that I thought was such an effective guard?” Actually, the question you should be asking first is “what’s happened to the mouse to make him so much better at sneaking past the cat-guarded gate?”



The mouse has become faster, smarter and more agile. His motivations have evolved too, from hacking into systems to gain public notoriety and praise from his fellow mice, to silently and anonymously stealing information for financial gain.



In fact, the cat often does not even realise the mouse has snuck in and has been sitting for weeks, possibly months, stealing whatever it finds valuable.



The solution is not to add more cats that keep their ever-watchful eyes trained outside your network in order to spot outside attackers from trying to get in. That’s still important, the cat hasn’t become obsolete. But now building a better mouse trap requires a more holistic approach that guards both from the outside-in and from the inside-out.



This requires monitoring activity across your entire network in real time, including who is accessing and moving data stored in third party cloud-based services like Dropbox or Salesforce.com. Simply put, security cannot be a one-time “set it and forget it” process.



In addition to implementing technology tools to enable you to see who is in your network and what, exactly, they are doing, you need to educate and train all of your employees, not just those in the IT department. Practice makes perfect. Just as you run regular fire drills, do the same to ensure your teams know what to do when a security threat is identified outside or inside your network? You want to put out a fire in a trash can long before it becomes a blaze that engulfs the whole building and causes irreparable damage.



A Holistic Approach



There’s no sugar-coating this fact: it’s likely only a matter of time before a breach occurs. You still want to lock your front doors (a.k.a. your perimeter), but don’t put all your eggs in that one basket. You have to balance your cybersecurity technology budget and include tools that provide your security team with the intelligence, visibility and forensic IR capabilities they need to identify when someone picks the lock and shut them down before any significant damage is done.


Bookmark and Share
 
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
 
   © 2012 ProHealthServiceZone.com
Netgains Logo