Welcome!

@CloudExpo Authors: Courtney Abud, Elizabeth White, Carmen Gonzalez, Pat Romanski, Liz McMillan

Related Topics: @CloudExpo, Cloud Security, @DXWorldExpo

@CloudExpo: Blog Post

Keeping Digital Health Organizations Safe from Cyber Attack | @CloudExpo #DX #Cloud #Security

We are learning that cybercrime isn’t always focused on economic gain

For health organizations, breaches are a constant threat, due to the high value of healthcare data - Social Security Numbers, treatment records, credit information, and other sensitive personally identifiable information (PII). And the cost of a breach to a health system or hospital can be devastating.

And the health care industry has seen its share of breaches in the past quarter alone. For example, the National Health Service in England and Scotland was hit by a Wanna Decryptor ransomware attack affecting at least 16 of its organizations. Within two days 150 countries were affected. Also last quarter, up to millions of patient records at Bronx-Lebanon Hospital Center in New York stored on a backup system managed by iHealth Innovations were exposed to a data breach.

Despite all the focus on preventing protected health information (PHI) theft and thwarting the next ransomware attack on a health organization, we are learning that cybercrime isn't always focused on economic gain. Some attacks have the goal of bringing critical infrastructure to its knees, as was likely the case of the recent Petya "ransomware" attack in Ukraine. Clearly bad actors and nation states have interests beyond ransom collection and PHI theft. This is beyond what we've seen for traditional cyberattacks, and these attacks can originate beyond a nation's borders.

These days it feels like health organizations are almost under constant attack, especially for ill-equipped, overworked IT staff suffering from the shortfall of qualified security staff. Fewer young people are interested in careers in cyber security (just as their Russian counterparts are attracted to hacking). This trend puts even more pressure on health security teams for innovation and automation for securing their organizations. Otherwise, they won't be able to keep up as their organizations digitalize and ride the Electronic Health Record (EHR) and mobile waves, all which expose more health information systems (HIS) to more attack surfaces.

Health organizations today are also challenged at times with the difficulty of finding the originators of an attack. Offshore state actors have resources available to conceal their identities. They can remain anonymous if desired, which makes the risk/reward ratio for hackers even more attractive. It may be matter of which health organizations are safest vs which are the best in determining the most successful organizations over the next five years.

Look at Ukraine to See the Future
The line between hackonomics and nation-sponsored cyberattacks gets blurred even further as nation states get more active in cybercrime. For those attackers funded by foreign benefactors, attribution of the attack can become even more complex. Yet these attacks, as has been shown, can propagate quickly beyond the attacked nation or organization.

Ukraine has witnessed infrastructure hacks and other cyberattacks resulting in infrastructure blackouts. More about this was written in the recent Wired article How an Entire Nation became Russia's Test Lab for Cyberwar.

Trusted Access Needed in the Medical Field
Just like trust is needed between patient and doctor, trust is the critical foundation for survival in the digital healthcare age. Without trust, the health industry cannot function effectively.

Health organizations need to rethink access control if they are to survive in the new digital world because the traditional security perimeter is helpless in defending against these new attacks. Health security teams need to adopt Zero Trust models of security, which limit connectivity to health systems based on device and user trust.

Trusted Access Control is a Zero Trust approach which leverages application-layer tunneling with software-defined perimeter technology (SDP) with advanced trust assessment that protects data far beyond traditional access control solutions. These new solutions assess trust of devices and users, and grant access to only specific applications and services based on granular trust-based decisions, instead of providing simple posture checking.

This new approach greatly reduces attack surfaces by isolating target health assets, such as HIS servers, from all devices and users, including potential attackers as well as legitimate users with possibly compromised devices. Health information can be seen by only those authorized users who have been authenticated, and whose devices have been verified as trusted and safe in their current context.

These new technologies and capabilities available to health organizations offer a considerable increase in security with less complexity and cost. As the shortage of health security experts increases, more powerful and easier to manage solutions that reduce capital and operating costs are needed. Along with effective security practices and operating discipline, these new solutions will help health organizations preserve trust and grow their practices without having to overspend on security to meet growing cyberattacks, especially since healthcare remains one of the biggest targets for attackers and threats to sensitive healthcare data.

More Stories By Greg Ness

Gregory Ness is the VP of Marketing of Vidder and has over 30 years of experience in marketing technology, B2B and consumer products and services. Prior to Vidder, he was VP of Marketing at cloud migration pioneer CloudVelox. Before CloudVelox he held marketing leadership positions at Vantage Data Centers, Infoblox (BLOX), BlueLane Technologies (VMW), Redline Networks (JNPR), IntruVert (INTC) and ShoreTel (SHOR). He has a BA from Reed College and an MA from The University of Texas at Austin. He has spoken on virtualization, networking, security and cloud computing topics at numerous conferences including CiscoLive, Interop and Future in Review.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


CloudEXPO Stories
Where many organizations get into trouble, however, is that they try to have a broad and deep knowledge in each of these areas. This is a huge blow to an organization's productivity. By automating or outsourcing some of these pieces, such as databases, infrastructure, and networks, your team can instead focus on development, testing, and deployment. Further, organizations that focus their attention on these areas can eventually move to a test-driven development structure that condenses several long phases into a faster, more efficient process. This methodology has a name, of course: Continuous delivery. As Jones pointed out at CloudEXPO, continuous delivery allows developers to trim the fat off tasks and gives them more time to focus on the individual parts of the process. But remember-implementing this methodology requires organizations to offload management of databases, infrastruct...
On-premise or off, you have powerful tools available to maximize the value of your infrastructure and you demand more visibility and operational control. Fortunately, data center management tools keep a vigil on memory contestation, power, thermal consumption, server health, and utilization, allowing better control no matter your cloud's shape. In this session, learn how Intel software tools enable real-time monitoring and precise management to lower operational costs and optimize infrastructure for today even as you're forecasting for tomorrow.
As the digitization of business accelerates the move of critical applications and content to the cloud, the network has never been as critical to business success. Consuming everything ‘as-a-service' requires new levels of network automation, agility and security. Discover how Enterprises can take advantage of Digital Platforms, directly connecting to an extensive ecosystem of digital partners and flex their service at the click of a button.
In today's always-on world, customer expectations have changed. Competitive differentiation is delivered through rapid software innovations, the ability to respond to issues quickly and by releasing high-quality code with minimal interruptions. DevOps isn't some far off goal; it's methodologies and practices are a response to this demand. The demand to go faster. The demand for more uptime. The demand to innovate. In this keynote, we will cover the Nutanix Developer Stack. Built from the foundation of software-defined infrastructure, Nutanix has rapidly expanded into full application lifecycle management across any infrastructure or cloud .Join us as we delve into how the Nutanix Developer Stack makes it easy to build hybrid cloud applications by weaving DBaaS, micro segmentation, event driven lifecycle operations, and both financial and cloud governance together into a single unified st...
CloudEXPO has been the M&A capital for Cloud companies for more than a decade with memorable acquisition news stories which came out of CloudEXPO expo floor. DevOpsSUMMIT New York faculty member Greg Bledsoe shared his views on IBM's Red Hat acquisition live from NASDAQ floor. Acquisition news was announced during CloudEXPO New York which took place November 12-13, 2019 in New York City. Our Silicon Valley 2019 schedule will showcase 200 keynotes, sessions, general sessions, power panels, and hands on tutorials presented by 150 rockstar speakers in 10 hottest conference tracks of 2019: