[{"innerBlocks":[],"name":"core\/freeform","postId":127610,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"

Healthcare organizations are still a top target for hackers<\/h2>
Security concerns will only grow in 2017, as cyber attacks become more focused and sophisticated. Healthcare organizations will continue to struggle to protect their networks and keep patients\u2019 protected health information out of the wrong hands. Health Data Management sought predictions for the New Year from some of the nation\u2019s top security experts.They included Mac McMillan, co-founder and CEO of CynergisTek, a top-ranked information security and privacy consulting firm focused on the healthcare IT industry; David Finn, health information technology officer for Symantec; Tim Erlin, senior director of IT security and risk strategy for Tripwire; Brian Evans, senior managing consultant for IBM Security; and Lance Hayden, chief privacy and security officer for ePatientFinder.<\/p>

Ransomware threat will continue to grow<\/h2>
Extorting payment for encrypted health data had a breakout year in 2016, and the threat will only grow in 2017, the security experts agree. Extortion attacks\u2014whether its ransomware or some other attack\u2014causes havoc and has proven to be effective \u201cat eliciting the pay-up response,\u201d McMillan says. \u201cAs long as it works, cybercriminals will use it.\u201d Finn expects the threat of ransomware will grow throughout most of the year. Reducing the risk of these incidents will mean organizations need to improve strategies for backing up data, Hayden predicts.<\/p>

Medical device vulnerabilities will demand action<\/h2>
The number of medical devices being used by healthcare organizations is growing, and many represent security risks for organizations. Some connect wirelessly to hospitals\u2019 networks, and older models that run on older operating systems are particularly at risk for hacking. If they\u2019re compromised, they may be used as an entry point to access hospital data. Others fear that infusion pumps or pacemakers could be hacked to provide dangerous medical care to patients.<\/p>

Reimbursement uncertainty may reduce spending on security<\/h2>
With the changes expected from a new Trump administration in Washington, it\u2019s difficult to know how reimbursements to providers will be affected. Finn of Symantec believes that uncertainties surrounding reimbursement will affect overall spending by healthcare organizations. \u201cThe lack of direction in the business of healthcare will adversely impact spending on health information technology and on security,\u201d he predicts.<\/p>

Too much technology could actually make security worse<\/h2>
More technology is emerging to protect networks and the information that flows over them\u2014but relying on technology alone could rise as a major miscalculation by healthcare organizations, the experts contend. \u201cOrganizations that try to improve security by adding all manner of systems, technology and people with limited understanding of security or healthcare will make security worse\u2014yes, it\u2019s possible,\u201d Finn says.Security can be compromised at a non-technology level\u2014because of the human element or because organizations don\u2019t have a security strategy that\u2019s right for the organization\u2019s size and resources, Hayden says. Finn agrees: \u201cOrganizations that address security with a holistic approach using sound systems, security engineering techniques, and security design principles will make their systems less vulnerable; reduce damage caused by disruptions, hazards and threats; and improve resilience against attacks so they can continue to support critical missions and business functions after being compromised.\u201d<\/p>

Finding security workers will remain a challenge<\/h2>
Hiring qualified personnel with security experience is difficult nationwide, with shortages of workers reported in all industries. As a result, healthcare organizations are fighting to hire trained staff, and often are at a competitive disadvantage in paying for key staff. Experts expect 2017 to be just as challenging for healthcare organizations that want to hire information security professionals.<\/p>

IoT and mobile devices will challenge provider security<\/h2>
The number of devices connected to the Internet\u2014the so-called Internet of Things\u2014continues to soar, expected to reach 20 billion by the end of the decade. They pose a variety of risks to healthcare organizations. McMillan notes that some of these devices are medical devices that connect to hospital networks over the Internet. \u201cAn overwhelming number of these are insecure,\u201d he notes. Also, recent distributed denial of service attacks have shown that IoT devices can be co-opted to overwhelm web servers with requests, and that will raise the ante on protecting healthcare IoT devices.<\/p>

As providers share more data, they\u2019ll face increased risks<\/h2>
Recent final rules from agencies and legislation passed by Congress will increase requirements to share healthcare information to improve patient care. That\u2019s great, but it also will increase the likelihood that information can be intercepted, the experts believe. \u201cSharing health data for treatment, payment and operations will expand\u2014creating more opportunity for data loss and theft,\u201d Finn predicts. That\u2019s particularly true as data goes to vendors who have third-party supply chain relationships with providers, McMillan adds. \u201cA growing number of breaches are involving third parties, and they have the potential to be huge incidents.\u201d<\/p>

Insiders will pose a growing risk for security<\/h2>
Most hackers need a hand in accessing data networks, and many times, that comes from insiders who, either accidentally or purposely, distribute network credentials. \u201cInsiders will continue to be a problem in the security chain because healthcare will continue to ignore them as both a weakness and a strength,\u201d Finn says. Hayden agrees, noting that healthcare organizations in 2017 need to create a culture of security that include management support and involvement, a strong training and awareness program. \u201cOrganizations need to engage users, through gamification, champion programs, and more,\u201d Hayden adds.<\/p>

Protecting data in the cloud will pose new challenges<\/h2>
Providers will put more healthcare data in the cloud in 2017, and that will raise the stakes on protecting patient information that\u2019s offsite, McMillan says. \u201cAt some point, the threat will find a way to attack the cloud successfully, and when that happens, the only question is whether it will be all data or some, in terms of loss,\u201d he says. \u201cInnovation such as using the cloud is the proverbial double-edged sword. It\u2019s an absolute necessity for advancement, but security continues to lag further behind, which ultimately risks the advancement.\u201d<\/p>

Providers will need to increase sophistication in detecting attacks<\/h2>
Providers will need to increase their sophistication in using analytics to detect unusual network activity, but that will be a struggle unless healthcare organizations have the acumen to use these tools, the experts contend. \u201cBad actors continue to be at the center of many incidents,\u201d McMillan says. \u201cOrganizations must move to behavioral-based analytics if they hope to stop bad behaviors and fraud.\u201d<\/p>

","saveContent":"

Healthcare organizations are still a top target for hackers<\/h2>
Security concerns will only grow in 2017, as cyber attacks become more focused and sophisticated. Healthcare organizations will continue to struggle to protect their networks and keep patients\u2019 protected health information out of the wrong hands. Health Data Management sought predictions for the New Year from some of the nation\u2019s top security experts.They included Mac McMillan, co-founder and CEO of CynergisTek, a top-ranked information security and privacy consulting firm focused on the healthcare IT industry; David Finn, health information technology officer for Symantec; Tim Erlin, senior director of IT security and risk strategy for Tripwire; Brian Evans, senior managing consultant for IBM Security; and Lance Hayden, chief privacy and security officer for ePatientFinder.<\/p>

Ransomware threat will continue to grow<\/h2>
Extorting payment for encrypted health data had a breakout year in 2016, and the threat will only grow in 2017, the security experts agree. Extortion attacks\u2014whether its ransomware or some other attack\u2014causes havoc and has proven to be effective \u201cat eliciting the pay-up response,\u201d McMillan says. \u201cAs long as it works, cybercriminals will use it.\u201d Finn expects the threat of ransomware will grow throughout most of the year. Reducing the risk of these incidents will mean organizations need to improve strategies for backing up data, Hayden predicts.<\/p>

Medical device vulnerabilities will demand action<\/h2>
The number of medical devices being used by healthcare organizations is growing, and many represent security risks for organizations. Some connect wirelessly to hospitals\u2019 networks, and older models that run on older operating systems are particularly at risk for hacking. If they\u2019re compromised, they may be used as an entry point to access hospital data. Others fear that infusion pumps or pacemakers could be hacked to provide dangerous medical care to patients.<\/p>

Reimbursement uncertainty may reduce spending on security<\/h2>
With the changes expected from a new Trump administration in Washington, it\u2019s difficult to know how reimbursements to providers will be affected. Finn of Symantec believes that uncertainties surrounding reimbursement will affect overall spending by healthcare organizations. \u201cThe lack of direction in the business of healthcare will adversely impact spending on health information technology and on security,\u201d he predicts.<\/p>

Too much technology could actually make security worse<\/h2>
More technology is emerging to protect networks and the information that flows over them\u2014but relying on technology alone could rise as a major miscalculation by healthcare organizations, the experts contend. \u201cOrganizations that try to improve security by adding all manner of systems, technology and people with limited understanding of security or healthcare will make security worse\u2014yes, it\u2019s possible,\u201d Finn says.Security can be compromised at a non-technology level\u2014because of the human element or because organizations don\u2019t have a security strategy that\u2019s right for the organization\u2019s size and resources, Hayden says. Finn agrees: \u201cOrganizations that address security with a holistic approach using sound systems, security engineering techniques, and security design principles will make their systems less vulnerable; reduce damage caused by disruptions, hazards and threats; and improve resilience against attacks so they can continue to support critical missions and business functions after being compromised.\u201d<\/p>

Finding security workers will remain a challenge<\/h2>
Hiring qualified personnel with security experience is difficult nationwide, with shortages of workers reported in all industries. As a result, healthcare organizations are fighting to hire trained staff, and often are at a competitive disadvantage in paying for key staff. Experts expect 2017 to be just as challenging for healthcare organizations that want to hire information security professionals.<\/p>

IoT and mobile devices will challenge provider security<\/h2>
The number of devices connected to the Internet\u2014the so-called Internet of Things\u2014continues to soar, expected to reach 20 billion by the end of the decade. They pose a variety of risks to healthcare organizations. McMillan notes that some of these devices are medical devices that connect to hospital networks over the Internet. \u201cAn overwhelming number of these are insecure,\u201d he notes. Also, recent distributed denial of service attacks have shown that IoT devices can be co-opted to overwhelm web servers with requests, and that will raise the ante on protecting healthcare IoT devices.<\/p>

As providers share more data, they\u2019ll face increased risks<\/h2>
Recent final rules from agencies and legislation passed by Congress will increase requirements to share healthcare information to improve patient care. That\u2019s great, but it also will increase the likelihood that information can be intercepted, the experts believe. \u201cSharing health data for treatment, payment and operations will expand\u2014creating more opportunity for data loss and theft,\u201d Finn predicts. That\u2019s particularly true as data goes to vendors who have third-party supply chain relationships with providers, McMillan adds. \u201cA growing number of breaches are involving third parties, and they have the potential to be huge incidents.\u201d<\/p>

Insiders will pose a growing risk for security<\/h2>
Most hackers need a hand in accessing data networks, and many times, that comes from insiders who, either accidentally or purposely, distribute network credentials. \u201cInsiders will continue to be a problem in the security chain because healthcare will continue to ignore them as both a weakness and a strength,\u201d Finn says. Hayden agrees, noting that healthcare organizations in 2017 need to create a culture of security that include management support and involvement, a strong training and awareness program. \u201cOrganizations need to engage users, through gamification, champion programs, and more,\u201d Hayden adds.<\/p>

Protecting data in the cloud will pose new challenges<\/h2>
Providers will put more healthcare data in the cloud in 2017, and that will raise the stakes on protecting patient information that\u2019s offsite, McMillan says. \u201cAt some point, the threat will find a way to attack the cloud successfully, and when that happens, the only question is whether it will be all data or some, in terms of loss,\u201d he says. \u201cInnovation such as using the cloud is the proverbial double-edged sword. It\u2019s an absolute necessity for advancement, but security continues to lag further behind, which ultimately risks the advancement.\u201d<\/p>

Providers will need to increase sophistication in detecting attacks<\/h2>
Providers will need to increase their sophistication in using analytics to detect unusual network activity, but that will be a struggle unless healthcare organizations have the acumen to use these tools, the experts contend. \u201cBad actors continue to be at the center of many incidents,\u201d McMillan says. \u201cOrganizations must move to behavioral-based analytics if they hope to stop bad behaviors and fraud.\u201d<\/p>

","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

10 top security concerns for 2017

More for you