Welcome!

Machine Learning Authors: Pat Romanski, Yeshim Deniz, Liz McMillan, Elizabeth White, Corey Roth

Related Topics: @CloudExpo, Cloud Security, @DXWorldExpo

@CloudExpo: Blog Post

Keeping Digital Health Organizations Safe from Cyber Attack | @CloudExpo #DX #Cloud #Security

We are learning that cybercrime isn’t always focused on economic gain

For health organizations, breaches are a constant threat, due to the high value of healthcare data - Social Security Numbers, treatment records, credit information, and other sensitive personally identifiable information (PII). And the cost of a breach to a health system or hospital can be devastating.

And the health care industry has seen its share of breaches in the past quarter alone. For example, the National Health Service in England and Scotland was hit by a Wanna Decryptor ransomware attack affecting at least 16 of its organizations. Within two days 150 countries were affected. Also last quarter, up to millions of patient records at Bronx-Lebanon Hospital Center in New York stored on a backup system managed by iHealth Innovations were exposed to a data breach.

Despite all the focus on preventing protected health information (PHI) theft and thwarting the next ransomware attack on a health organization, we are learning that cybercrime isn't always focused on economic gain. Some attacks have the goal of bringing critical infrastructure to its knees, as was likely the case of the recent Petya "ransomware" attack in Ukraine. Clearly bad actors and nation states have interests beyond ransom collection and PHI theft. This is beyond what we've seen for traditional cyberattacks, and these attacks can originate beyond a nation's borders.

These days it feels like health organizations are almost under constant attack, especially for ill-equipped, overworked IT staff suffering from the shortfall of qualified security staff. Fewer young people are interested in careers in cyber security (just as their Russian counterparts are attracted to hacking). This trend puts even more pressure on health security teams for innovation and automation for securing their organizations. Otherwise, they won't be able to keep up as their organizations digitalize and ride the Electronic Health Record (EHR) and mobile waves, all which expose more health information systems (HIS) to more attack surfaces.

Health organizations today are also challenged at times with the difficulty of finding the originators of an attack. Offshore state actors have resources available to conceal their identities. They can remain anonymous if desired, which makes the risk/reward ratio for hackers even more attractive. It may be matter of which health organizations are safest vs which are the best in determining the most successful organizations over the next five years.

Look at Ukraine to See the Future
The line between hackonomics and nation-sponsored cyberattacks gets blurred even further as nation states get more active in cybercrime. For those attackers funded by foreign benefactors, attribution of the attack can become even more complex. Yet these attacks, as has been shown, can propagate quickly beyond the attacked nation or organization.

Ukraine has witnessed infrastructure hacks and other cyberattacks resulting in infrastructure blackouts. More about this was written in the recent Wired article How an Entire Nation became Russia's Test Lab for Cyberwar.

Trusted Access Needed in the Medical Field
Just like trust is needed between patient and doctor, trust is the critical foundation for survival in the digital healthcare age. Without trust, the health industry cannot function effectively.

Health organizations need to rethink access control if they are to survive in the new digital world because the traditional security perimeter is helpless in defending against these new attacks. Health security teams need to adopt Zero Trust models of security, which limit connectivity to health systems based on device and user trust.

Trusted Access Control is a Zero Trust approach which leverages application-layer tunneling with software-defined perimeter technology (SDP) with advanced trust assessment that protects data far beyond traditional access control solutions. These new solutions assess trust of devices and users, and grant access to only specific applications and services based on granular trust-based decisions, instead of providing simple posture checking.

This new approach greatly reduces attack surfaces by isolating target health assets, such as HIS servers, from all devices and users, including potential attackers as well as legitimate users with possibly compromised devices. Health information can be seen by only those authorized users who have been authenticated, and whose devices have been verified as trusted and safe in their current context.

These new technologies and capabilities available to health organizations offer a considerable increase in security with less complexity and cost. As the shortage of health security experts increases, more powerful and easier to manage solutions that reduce capital and operating costs are needed. Along with effective security practices and operating discipline, these new solutions will help health organizations preserve trust and grow their practices without having to overspend on security to meet growing cyberattacks, especially since healthcare remains one of the biggest targets for attackers and threats to sensitive healthcare data.

More Stories By Greg Ness

Gregory Ness is the VP of Marketing of Vidder and has over 30 years of experience in marketing technology, B2B and consumer products and services. Prior to Vidder, he was VP of Marketing at cloud migration pioneer CloudVelox. Before CloudVelox he held marketing leadership positions at Vantage Data Centers, Infoblox (BLOX), BlueLane Technologies (VMW), Redline Networks (JNPR), IntruVert (INTC) and ShoreTel (SHOR). He has a BA from Reed College and an MA from The University of Texas at Austin. He has spoken on virtualization, networking, security and cloud computing topics at numerous conferences including CiscoLive, Interop and Future in Review.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


CloudEXPO Stories
Headquartered in Plainsboro, NJ, Synametrics Technologies has provided IT professionals and computer systems developers since 1997. Based on the success of their initial product offerings (WinSQL and DeltaCopy), the company continues to create and hone innovative products that help its customers get more from their computer applications, databases and infrastructure. To date, over one million users around the world have chosen Synametrics solutions to help power their accelerated business or personal computing needs.
Poor data quality and analytics drive down business value. In fact, Gartner estimated that the average financial impact of poor data quality on organizations is $9.7 million per year. But bad data is much more than a cost center. By eroding trust in information, analytics and the business decisions based on these, it is a serious impediment to digital transformation.
Sanjeev Sharma Joins November 11-13, 2018 @DevOpsSummit at @CloudEXPO New York Faculty. Sanjeev Sharma is an internationally known DevOps and Cloud Transformation thought leader, technology executive, and author. Sanjeev's industry experience includes tenures as CTO, Technical Sales leader, and Cloud Architect leader. As an IBM Distinguished Engineer, Sanjeev is recognized at the highest levels of IBM's core of technical leaders.
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.
DXWorldEXPO LLC announced today that Kevin Jackson joined the faculty of CloudEXPO's "10-Year Anniversary Event" which will take place on November 11-13, 2018 in New York City. Kevin L. Jackson is a globally recognized cloud computing expert and Founder/Author of the award winning "Cloud Musings" blog. Mr. Jackson has also been recognized as a "Top 100 Cybersecurity Influencer and Brand" by Onalytica (2015), a Huffington Post "Top 100 Cloud Computing Experts on Twitter" (2013) and a "Top 50 Cloud Computing Blogger for IT Integrators" by CRN (2015). Mr. Jackson's professional career includes service in the US Navy Space Systems Command, Vice President J.P. Morgan Chase, Worldwide Sales Executive for IBM and NJVC Vice President, Cloud Services. He is currently part of a team responsible for onboarding mission applications to the US Intelligence Community cloud computing environment (IC ...