Healthcare organizations continue to be attractive targets for global cybercriminals leading to recurring cybersecurity disasters with notable ones being an attack on Ascension, forcing hospitals across different states to return to paper recordkeeping. Nitin Natarajan, the Deputy Director at the Cybersecurity and Infrastructure Security Agency (CISA), during a chat session at the INVEST conference, offered some key insights into the current state of cybersecurity in the healthcare industry.
Natarajan emphasized that cybercriminal activity is becoming increasingly sophisticated and that all healthcare providers are potential targets—making it important for providers to work relentlessly towards boosting their resilience and quick recovery from such attacks. He encouraged the industry to examine third-party cybersecurity risks during their corporate planning.
Despite efforts towards improving cybersecurity, it’s important to understand that drastic positive changes won’t occur overnight. This point was highlighted by the launch of a new cybersecurity program by HHS, which will offer about $50 million for developing better defensive tools for healthcare providers. This is a step forward, but a lot of work still needs to be done.
In the quest to enhance defenses, Natarajan highlighted that healthcare organizations must ensure that all their employees receive, at the very least, basic cybersecurity training. He emphasized that cybersecurity is not just the responsibility of CISOs and CIOs, but the entire workforce. For effective cybersecurity, every staff member should be equipped with skills such as proper application of two-factor authentication and the ability to recognize phishing emails.
Natarajan noted that, despite constrained financial resources, healthcare providers should be aware of existing free tools that they can benefit from. CISA and other federal organizations offer these tools free of charge. It may not be the complete solution for smaller hospitals that are trying to balance payroll and staff recruitment and retention, but with these tools and some companies offering free versions of their products, there are more opportunities to consider.
Lastly, Natarajan believes that the future lies in a “secure by design” approach to healthcare technology – a design strategy that integrates secure elements from the initial stages, so that additional packages or security settings are unnecessary for end users.
For more details, refer to the original article.