HomeHealth Tech8 ways to create a strong security culture and strengthen incident response...

8 ways to create a strong security culture and strengthen incident response in healthcare

Healthcare Security

Basic cyber hygiene is simply as important for healthcare professionals as personal hygiene, according to John Riggi, senior adviser for cybersecurity and risk with the American Hospital Affiliation and a 28-year veteran of the FBI.

“It must be second nature to lock the computer once you walk away and to not share passwords,” Riggi says. “We have to do it as routine as washing your palms before you see a patient and after you leave a patient’s room. For that routine to become muscle memory, that’s what we’d like to achieve.”

With clinical staff often focusing their consideration on making critical care decisions and juggling the needs of many patients at once, hospitals and health systems are especially vulnerable to phishing and ransomware assaults that make the most of distracted workers. To mitigate this threat, expertise and knowledge security leaders are stepping up their efforts to create a tradition of safety — one in which managers can effectively communicate about the latest major threats and employees can take the best steps to handle a threat.

8 Tips for Developing a Strong Security Culture

Riggi and different security consultants offer these suggestions to assist organizations to develop a culture of security:

Emphasize balance

One of the most common mistakes in approaching cybersecurity is placing too much emphasis on technology or training, declares Jinan Budge, principal analyst for security and risk at Forrester Research. “There must be a balance of people, training, technology, and process. It’s not one or the opposite. It’s all of the above.”

Focus on behavior

The 2021 Verizon Data Breach Investigations Report found that human error is involved in 85% of data breaches. This points to the necessity to encourage conduct change that emphasizes a more secure approach to expertise use, according to Troy Ament, discipline CISO for healthcare and life sciences at Fortinet. “Empowering caregivers and clinic workers to use security best practices can aid in encompassing a tradition of security throughout day-to-day operations,” he says. Positive reinforcement helps, Riggi provides; consider incentives and public recognition for individual employees who report suspicious emails or in any other case mitigate cybersecurity threats.


Related

5 steps to safe IoMT (Internet of Medical Things)


Stay current

Healthcare has seen a “massive improve” in ransomware and phishing attacks targeting patient data and clinical research related to COVID-19, says Marlon Harvey, principal architect within the buyer expertise healthcare apply at Cisco. The combination of remote work and digital care adoption has additionally increased the necessity for secure connectivity. “Safety needs are solely different now for healthcare organizations than they have been 18 months ago,” Harvey says. Ament emphasizes the adoption of approaches such as multifactor authentication and zero trust to better secure distributed systems.

Don’t overload staff

Organizations face hundreds of cybersecurity threats day after day, Riggi says. Communicating every threat would overwhelm staff and desensitize them to risk. As an alternative, security teams ought to summarize key points and share them with management. In turn, managers ought to discuss these threats — in addition to the best tactics for mitigating them — in regular staff conferences. Communicating in that setting helps staff perceive that cybersecurity is a part of the job, he adds.

Target training resources

Remember that clinical staff doesn’t necessarily need the same in-depth knowledge of security practices as IT teams, Harvey says. Besides, conversations about security for frontline clinical staff ought to deal with how adopting best practices can improve effectiveness and allow care supply. Ament agrees: “The key is to make training digestible and implemented of their daily routines.”

Train staff in the moment

“Asking somebody in healthcare to spend an hour a year in security training will not be going to work,” Budge said. She and the opposite consultants advocate implementing training “in the moment.” This might be a pop-up prompt to try a stronger password, color-coded banners for external emails primarily based on the potential menace they pose, posters, and pamphlets in high-traffic areas, or making security experts available for casual conversations in the hospital cafeteria.

Implement governance

Many organizations understandably prioritized urgency for care over security best practices in response to COVID-19. It’s necessary to ensure that each onsite and remote workers understand the best way to preserve security for devices, networks, and virtual consults with patients or other physicians. “IT and cybersecurity departments have an enormous function to play as they re-evaluate among the rushed technology decisions made over the past year,” Ament says. “Governance is crucial in ensuring that any venture that underway has cybersecurity constructed into the complete lifecycle.”

Practice empathy

At last, Budge says, one of the simplest ways to create a culture of security is to understand what is going to resonate with individual healthcare professionals. This requires an empathetic tone, a much less punitive approach to errors, and a willingness to listen to others’ needs. “Emotional vulnerabilities are fairly heightened in the meanwhile, particularly in a healthcare setting,” she says. “Security teams have to keep in mind that it’s not about them — it’s about everybody else in the organization.”

Source

Must Read
Related News