Healthcare Has Reactive, Inefficient Approach to Cybersecurity

Based on a three-month review of cyber risk management for the healthcare industry, the Health Information Trust Alliance concludes that “today’s approach to cybersecurity is predominantly reactive and, for the vast majority of organizations, inefficient and labor-intensive.”


Based on a three-month review of cyber risk management for the healthcare industry, the Health Information Trust Alliance (HITRUST) concludes that “today’s approach to cybersecurity is predominantly reactive and, for the vast majority of organizations, inefficient and labor-intensive.”

According to HITRUST’s analysis, despite the fact that healthcare organizations are increasingly utilizing threat indicators and other threat intelligence, they are doing so without understanding the relevance to their organization. In addition, most organizations are still unable to understand the effectiveness of deployed information security products, especially in relation to emerging cyber threats.

Specifically, the HITRUST review finds that:

*Organizations consistently identified a lack of awareness of emerging cyber threats, especially previously unseen attacks, as a key concern and organizations almost universally acknowledged they had minimal understanding as to the impact of cyber threats on their current cyber security products and the unique applications, systems and devices they protect.

*As a result, this lack of awareness leads many organizations to expend resources and rely heavily on indicators of compromise (IOCs) to determine if a breach or other suspicious cyber activity has already occurred while simultaneously updating rules and policies to block the IOCs. Although valuable, HITRUST argues that this approach is retrospective in nature and introduces inefficiencies.

*And, organizations lack understanding as to the effectiveness of the multitude of products deployed in their environments and lack the ability to communicate, especially to senior management, the effectiveness of their security measures against the probable cyber threat landscape.

“To enable a better understanding of the emerging threat landscape and the impact on organizational-specific cyber security defenses, a new approach needs to be deployed and new tools developed,” according to HITRUST. “This fundamental shift requires a more proactive model where organizations have real-time situational awareness or insights into emerging cyber threats. The shift also requires the ability to understand the impact of emerging threats on an organization’s specific environment, including layered information security products deployed with custom configurations, as well as industry-specific applications, such as electronic health records.”

Toward that end, HITRUST has developed—with IT security testing firm NSS Labs—a new software package called CyberVision aimed at helping healthcare organizations to proactively identify emerging cybersecurity threats and to predict the damage that could be done. Health Data Management spoke with HITRUST’s chief executive officer Daniel Nutkis about the new service, which can be found here.

More for you

Loading data for hdm_tax_topic #care-team-experience...