Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Cybersecurity & Healthcare: Does Cybersecurity Act Help or Hurt?
Threaded  |  Newest First  |  Oldest First
RetiredUser
RetiredUser,
 User Rank: Ninja
2/12/2016 | 3:01:40 PM
Red Tape, Red Coffers
I pretty much agree with you here.  And, oh God - I actually read the whole subsection on Healthcare, including a good portion of the Cybersecurity Information Sharing Act of 2015.  What is it about formal Government process that just screams bleeding coffers from the outset?  Not to mention the muddled standards that are hard-to-read and inspire reactions of "yeah, obvious" and "in what world are you living".  

In the time it took to draft the Act, the game changed.  In the time it takes to pass the Act, the game will have changed again.  In the time it takes to form committees, auditing teams, processes, checks and balances...  

You called it: Healthcare needs to treat security the way Financial institutions (finally) are starting to.  Don't look to Government standards or regulations; get on the ball and hire the right InfoSec resources who are current, relevant and part of the hacking landscape.

As always, the distance between the Red Tape lovers and the tech community is light-years apart.

  
royhugginsms
royhugginsms,
 User Rank: Apprentice
2/13/2016 | 4:01:36 PM
Bankers and financiers have a direct understanding of risk, healthcare pros see risk differently
Firtly, thank you for this essay. It hits a lot of my frustration points, most especially the fact that committees trying to develop best practices could never keep up with security needs.

As a health care guy (mental health) who spends a lot of time consulting and training other health care pros on security in their small practices, I can say that we don't have a solid idea of risk management as a paradigm for protecting information. We work with risk all the time in clinical contexts, e.g. risk of self-harm or risk that certain activities or treatments could result in harm to a client/patient.

The idea of information security, however, is entirely grounded in "best practices" for us. Clinicians look to professional organizations for these best practices, and those orgs have little-to-no idea how to manage them.

When administrators try to advise and guide clinicians according to regs like HIPAA, we often chafe against it because those administrators are usually focused on the concept of "compliance," which feels antithetical to the concept of "care."

My point is: I think healthcare will continue to have significant security issues until healthcare professionals and security professionals learn to understand each other, much like healthcare pros and attorneys have managed to do over the years. 

 
ChloeMica
ChloeMica,
 User Rank: Apprentice
2/17/2016 | 3:18:41 AM
Re: Bankers and financiers have a direct understanding of risk, healthcare pros see risk differently
Improving operational efficiency and reducing cost, while also improving the quality of care is a global healthcare challenge.

Creative Peptides


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Practical Network Security Approaches for a Multicloud, Hybrid IT World
The report covers areas enterprises should focus on for their multicloud/hybrid cloud security strategy: -increase visibility over the environment -learning cloud-specific skills -relying on established security frameworks -re-architecting the network
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-30333
PUBLISHED: 2022-05-09
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
CVE-2022-23066
PUBLISHED: 2022-05-09
In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to tra...
CVE-2022-28463
PUBLISHED: 2022-05-08
ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
CVE-2022-28470
PUBLISHED: 2022-05-08
marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
CVE-2022-1620
PUBLISHED: 2022-05-08
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.