Subscribe
Share
Share
Embed
The State of Enterprise IT Security is the show for technology leaders looking for actionable and approachable guidance in the security landscape. The show features Brad Bussie, the CISO of e360, a premier technology solutions provider. In each episode, Brad covers 3 timely topics in each episode impacting the enterprise security landscape.
Ep. 23: Healthcare Edition: Hidden Costs of Upgrading Legacy Systems, Incident Response Drills, Common Cybersecurity Challenges
===
[00:00:00] Brad Bussie: Healthcare faces. I would say a growing number of cyber security challenges, and one of the biggest issues. Is actually protecting patient privacy and with regulations like HIPAA healthcare providers must ensure that patient data remains confidential and secure
[00:00:21]
[00:00:26] Brad Bussie: hey, everyone. I'm Brad Bussie, Chief Information Security Officer here at e360. Thank you for joining me for the State of Enterprise IT Security Edition. This is the show that makes IT security approachable and actionable for technology leaders. I'm happy to bring you some answers to frequently asked questions today.
[00:00:50] First one, what are the hidden costs we might encounter? When upgrading our legacy systems for better security. Number two, what are the most highly rated cybersecurity solutions for healthcare organizations? And number three, what are the common cybersecurity challenges faced by healthcare organizations today?
[00:01:17] And with that, let's get started. Now, what are the hidden costs we might encounter when upgrading our legacy systems for better security and upgrading legacy systems? It's definitely important, but it comes with several hidden costs that you might not initially consider. for starters, there are compatibility issues.
[00:01:47] You know, new security solutions often don't play nicely with older software, which means you might have to do some customization or even [00:02:00] overhaul your software entirely. Plus, older hardware might not support the new security features. So you might find yourself needing hardware upgrades or replacements.
[00:02:14] Now costs can really start to add up, but really what is the impact on the day-to-day operations? I'd say you're looking at potential downtime during the upgrade process, which can disrupt your business operations. And impact productivity. There's also a learning curve to consider. Your employees will need time to get used to the new systems as well as process age, which can temporarily reduce efficiency.
[00:02:52] And I'm thinking, how about integrating these new systems with existing ones? And from experience, integration can be a real challenge. data migration, for example, it's complex, it's time consuming. There's risks of data loss or corruption, and then ensuring that new systems work seamlessly with your existing ones can also require things like additional development and testing, which can add to the workload and upgrading can trigger the need for new compliance audits and validations, especially in regulated industries.
[00:03:36] Like healthcare and finance. You'll also need to maintain updated documentation for compliance purposes. And that also adds to the workload. So are these security risks during the transition period? I'd say there are risks. [00:04:00] Definitely. the transition period can expose temporary security gaps that cyber criminals might exploit.
[00:04:08] And there can be delays in patching for new vulnerabilities that emerge during the upgrade process, because these things can take quite a while. what about like financial costs? So the initial investment depending can be substantial. you're looking at costs for new software licenses, hardware, and consulting services.
[00:04:34] Plus new systems often come with ongoing maintenance as well as support costs that need to be factored in. So is there a risk of getting too dependent on certain vendors? Yes, there's a potential for vendor lock in, and you might find yourself dependent on specific vendors for software, hardware, or support.
[00:05:02] Which can limit your flexibility and increase long term costs. And finally, are there any hidden security risks to all this? I would say, yes, legacy data might carry outdated security risks that need to be addressed during a migration and improperly decommissioned legacy systems. They can become backdoors for cyber attackers.
[00:05:35] So the bottom line here is that upgrading legacy systems. Is essential for maintaining security, but it's crucial to plan thoroughly and engaging stakeholders and implementing the changes in phases can help manage these challenges effectively. [00:06:00]
[00:06:00] Now, the second question that I got was from healthcare and what are the most highly rated cyber security solutions?
[00:06:09] For healthcare organizations. Now, when it comes to cybersecurity and healthcare, I'd say there's several critical solutions that organizations need to focus on to ensure robust protection. So I'm going to break down a couple. the first one is endpoint security. It's, it's vital. And this involves protecting things like individual devices, computers, tablets, and even medical equipment that connects to a network.
[00:06:44] And given the increasing use of mobile and remote devices, ensuring that these endpoints are secure against malware and unauthorized access is crucial. To prevent breaches at the device level. the second one would be threat and vulnerability management. And this is all about being proactive. And this includes regularly scanning for vulnerabilities, doing things like managing patches and applying security updates, and by identifying and addressing potential threats.
[00:07:23] Before they can be exploited, healthcare organizations can significantly reduce the risk of security incidents. Third, network security. I would say is another key area. it ensures secure communication within the healthcare network, and that's through the use of firewalls, intrusion detection and prevention systems, And secure VPNs and these tools help monitor and control network traffic.
[00:07:58] And that's [00:08:00] preventing unauthorized access as well as data breaches. And in the event of a security incident, cause this is starting to happen more and more incident management and response are critical, having a well defined process for detecting, investigating, containing, And eradicating threats is essential.
[00:08:24] Regular incident response drills and tabletop exercises can prepare the organization to handle real incidents effectively, as well as minimize their impact. I would say data encryption is pretty essential for protecting sensitive healthcare data. that's both at rest and in transit. Encryption ensures that even if data is intercepted, it remains unreadable to unauthorized parties.
[00:08:55] And that's crucial for protecting patient health information and complying with regulations like HIPAA. Another one, Identity and Access Management. And that's to ensure that only authorized personnel have access to sensitive information and systems. So this includes multi-factor authentication, single sign on and proper user provisioning and deprovisioning processes.
[00:09:27] And this is to prevent unauthorized access as well as insider threats. And another one, regular security awareness training. I mean, for staff, this is key to reducing human error, which is a, I'd say, a significant factor in many security breaches. Thank you training helps employees recognize and respond appropriately to threats like phishing and social engineering attacks.
[00:09:57] Finally, I would say [00:10:00] compliance management is pretty essential for healthcare organizations because adhering to regulations like HIPAA, mandates specific security measures. And compliant solutions help ensure that these requirements are met. Thank you very much. Reducing the risk of legal as well as financial penalties.
[00:10:23] And I'd say by focusing on these key areas. Healthcare organizations can build that comprehensive cybersecurity strategy that we've talked about. it helps protect sensitive patient data and maintains the integrity of their IT infrastructure. A third question that I received for this podcast, what are the common cybersecurity challenges faced by healthcare organizations today?
[00:10:54] And healthcare faces. I would say a growing number of cyber security challenges, and one of the biggest issues. Is actually protecting patient privacy and with regulations like HIPAA healthcare providers must ensure that patient data remains confidential and secure and unauthorized access or disclosure, whether it's from an external hacker or internal negligence, it can be increasingly damaging.
[00:11:27] Both to patients and the organization's reputation. And I would say another significant challenge is dealing with legacy systems. Many healthcare facilities rely on outdated technology. It's no longer supported by manufacturers. And these systems are particularly vulnerable to cyber attacks because they don't receive necessary security updates.
[00:11:54] Some of you, you can't update them. And transitioning away from these legacy systems, [00:12:00] it's crucial, but it's often complex. And super expensive. So the next one I would say is ransomware and malware attacks. They pose a pretty major threat. We hear about them all the time. healthcare data, it's super valuable and it's a prime target for cybercriminals who encrypt the data.
[00:12:22] And then demand a ransom. the healthcare sector, it's especially vulnerable to these attacks due to the need for continuous access to patient information. Last one, I would say the, the shortage of skilled cybersecurity professionals. I mean, in the healthcare sector, it's, it's a pretty pressing issue is just like retaining quality staff and it's challenging, partly because Because there isn't enough ongoing training as well as support.
[00:12:58] And this lack of skilled professionals leaves healthcare organizations more vulnerable. To evolving threats. Now, actually, I think I will add another one, IoT and medical device security. It's, it's becoming increasingly important as the use of internet of thing devices or internet of medical things, introduces new vulnerabilities.
[00:13:26] And these devices often lack any security measures, making them easy targets for cyber attacks. that could potentially compromise patient data and safety. And I think financial constraints, especially after the pandemic, have limited, as well as enforced some of the impact to healthcare orgs, to invest in robust cybersecurity measures.
[00:13:56] And many have had to prioritize immediate [00:14:00] patient care needs over cybersecurity, and that's leaving them more vulnerable to attacks. And I think if I, if I had to think about this and add one more, third-party risks are major concerns in healthcare organizations, and they work with a ton of different third-party vendors, and each can introduce additional security risks.
[00:14:25] And ensuring that all partners adhere to high standards of data protection is crucial, but it's definitely challenging. Now, I would say addressing these challenges requires a comprehensive approach, including regular security assessments, robust employee training, investment in modern security solutions, and strict compliance with regulatory standards.
[00:14:54] And by tackling these issues head on, I think healthcare organizations can better protect their systems and the sensitive data they manage. Thank you again for joining me. And I look forward to the next time on the State of Enterprise IT Security Edition.
[00:15:15]