Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Cybersecurity & Healthcare: Does Cybersecurity Act Help or Hurt?
Newest First  |  Oldest First  |  Threaded View
ChloeMica
ChloeMica,
User Rank: Apprentice
2/17/2016 | 3:18:41 AM
Re: Bankers and financiers have a direct understanding of risk, healthcare pros see risk differently
Improving operational efficiency and reducing cost, while also improving the quality of care is a global healthcare challenge.

Creative Peptides
royhugginsms
royhugginsms,
User Rank: Apprentice
2/13/2016 | 4:01:36 PM
Bankers and financiers have a direct understanding of risk, healthcare pros see risk differently
Firtly, thank you for this essay. It hits a lot of my frustration points, most especially the fact that committees trying to develop best practices could never keep up with security needs.

As a health care guy (mental health) who spends a lot of time consulting and training other health care pros on security in their small practices, I can say that we don't have a solid idea of risk management as a paradigm for protecting information. We work with risk all the time in clinical contexts, e.g. risk of self-harm or risk that certain activities or treatments could result in harm to a client/patient.

The idea of information security, however, is entirely grounded in "best practices" for us. Clinicians look to professional organizations for these best practices, and those orgs have little-to-no idea how to manage them.

When administrators try to advise and guide clinicians according to regs like HIPAA, we often chafe against it because those administrators are usually focused on the concept of "compliance," which feels antithetical to the concept of "care."

My point is: I think healthcare will continue to have significant security issues until healthcare professionals and security professionals learn to understand each other, much like healthcare pros and attorneys have managed to do over the years. 

 
RetiredUser
RetiredUser,
User Rank: Ninja
2/12/2016 | 3:01:40 PM
Red Tape, Red Coffers
I pretty much agree with you here.  And, oh God - I actually read the whole subsection on Healthcare, including a good portion of the Cybersecurity Information Sharing Act of 2015.  What is it about formal Government process that just screams bleeding coffers from the outset?  Not to mention the muddled standards that are hard-to-read and inspire reactions of "yeah, obvious" and "in what world are you living".  

In the time it took to draft the Act, the game changed.  In the time it takes to pass the Act, the game will have changed again.  In the time it takes to form committees, auditing teams, processes, checks and balances...  

You called it: Healthcare needs to treat security the way Financial institutions (finally) are starting to.  Don't look to Government standards or regulations; get on the ball and hire the right InfoSec resources who are current, relevant and part of the hacking landscape.

As always, the distance between the Red Tape lovers and the tech community is light-years apart.

  


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-3297
PUBLISHED: 2022-09-25
Use After Free in GitHub repository vim/vim prior to 9.0.0579.
CVE-2022-41343
PUBLISHED: 2022-09-25
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
CVE-2022-3296
PUBLISHED: 2022-09-25
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.
CVE-2022-41340
PUBLISHED: 2022-09-24
The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
CVE-2022-23463
PUBLISHED: 2022-09-24
Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes suc...