Story image

How to effectively address security challenges in a digital healthcare world

23 May 18

Businesses operating in the healthcare industry are increasingly going digital – and protecting themselves from cybercriminals should be a core part of their business.

According to Wavelink, criminals are often looking to steal sensitive information or make money through ransomware attacks, which is why it’s important for healthcare firms to maintain organisation-wide security that is both up-to-date and automated.

The 2017 Ponemon Cost of a Data Breach report says that healthcare is the most expensive industry for data breaches across the world – often costing 2.5 times the global average across industries.

According to Wavelink’s Hugo Hutchinson, healthcare need to be aware of their responsibilities about protecting patients’ privacy as well as protecting themselves against attacks.

He suggests a multi-layered approach that includes firewalls, cloud security, advanced threat protection, application security, access management, network operation centres, and security operation centres.

Often there can be a large number of people and devices that need to access healthcare firms’ networks. Employees, patients, and visitors are likely to use their own devices, while the organisation’s own devices also need to be managed.

Wavelink notes that it can be hard to keep track of who is being given access to what parts of the network.

“Best practice is to enforce access policies for all users and devices. This requires micro-segmentation of the network using internal network security firewalls so people can only get into the parts of the network that they’re authorised to access,” Hutchinson explains.

Wavelink adds that it’s essential to have strong security policies and processes, but these must not hinder the organisation from providing excellent patient care.

This means applications must perform at expected levels without being compromised by security measures such as slow packet processing, content inspection, or policy management processing.

The company also states that advanced threat protection can help to minimise the risk of a successful cyber attack. Sandboxing is able to create an isolated, secure environment to validate incoming threats. It could then share that threat information with the security community and disrupt zero-day threats.

“Threats are emerging and evolving too fast for manual processes to keep up. Organisations can’t expect to adequately fight the growing threats just by throwing more resources at them; automation is the only answer. It’s faster and less error-prone than humans, and it’s better at prioritising threats so organisations don’t spend time fighting every apparent threat,” Hutchinson says.

“An automated system means security staff can work on minimising vulnerabilities and educating staff to help reduce the impact of human error on the organisation’s security.”

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
What disaster recovery will look like in 2019
“With nearly half of all businesses experiencing an unrecoverable data event in the last three years, current backup solutions are no longer fit for purpose."
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.