Cybersecurity: Conduct threat assessments 

Q. We’ve covered the cybersecurity basics; what other activities will help reduce risk? 

A. First, kudos for taking steps to address end-user behavior; protect edge/internet-connected devices; and update anti-virus, operating systems and application suites. Your organization is well positioned to fend off bad actors. 

If you wish to deepen awareness of, protect against and reduce cyber risk further, consider the below advanced activities: 

First, implement continuous digital traffic monitoring through a Security Operations Center (SOC). Most cybersecurity activities are geared toward obtaining a “snapshot” of your environment. When you conduct a vulnerability and threat assessment, for example, you take a picture of your environment and evaluate the results. Within seconds, that picture can change, and a threat can be established without your knowledge until the next snapshot. A SOC provides real-time monitoring, detection, response and mitigation. Most organizations can’t afford to build and staff an SOC, so SOC-as-a-Service, where a third party provides the infrastructure, is common. 

Second, conduct a third-party risk assessment. Ask partners, vendors, etc., who have access to your systems and/or patient data to provide information about their cybersecurity practices. Partners who have physical and virtual access to your network and data are an often-overlooked entry point. Think about your printer/copier service provider, HVAC service company, security cameras/monitoring vendor, outsourced billing partner and others. 

Finally, conduct a data privacy assessment to identify the locations of unencrypted Personally Identifiable Information (PII) and Electronic Patient Healthcare Information (ePHI), and create a gameplan to mitigate associated risks. Most health care organizations do not have a thorough understanding of where PII and ePHI reside within their digital footprint. Often, network shared folders, local hard drives, laptops and operating system recycle bins contain data that, if distributed during a breach, would result in patient harm, fines, employee data theft and more. 

Jeff Woodham is vice president of operations for Mandry Technology Solutions. Reach him at jwoodham@mandrytechnology.com.