[{"innerBlocks":[],"name":"core\/freeform","postId":685,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"The recent data breach at the Los Angeles County Department of Health Services demonstrates the risk that hired third-party vendors pose to healthcare organizations.

The phishing attack at the Los Angeles agency compromised the health information of 14,600 persons.

While many providers continue to leave themselves open to attack by not using appropriate security controls, the controls are comprised if appropriate policies are not in place, says Andrea Limbago, chief social scientist at Virtru, a data encryption vendor. \u201cEnd-to-end encryption would have made the attack more difficult to pull off, and therefore may have deterred the attacker,\u201d Limbago explains.

But because the attack occurred through phishing, it is impossible to say it could have been prevented. Overall, a greater focus on combining data encryption with access controls that evolve over time would have enabled revocation of the data, which could have minimized the amount of data that was compromised.\u201d

Also See:<\/b> Providers not using encryption enough for data in the cloud<\/a>

Because providers generally have multiple partners with each other and vendors, they need to learn how to mitigate risks that accompany third-party data access.

Healthcare providers should not assume other parties will protect their data, so they should implement a strategy that provides greater control of the data even after it leaves their own network, Limbago notes.

\u201cThis includes protections that are bound to the data, such as encryption, while also ensuring the security program is usable across the workforce. Employees will find a means to circumvent a security safeguard if it limits their ability to do their job, so any security solution must work within business workflows.\u201d

There are programs available to providers to increase employee awareness of phishing and other tools such as automated phishing detection software. Again, however, caution rules, she warns. \u201cMany of today\u2019s phishing attacks look extremely legitimate and fool even the most savvy information security professionals. A layered defense can protect data and alter an attacker\u2019s risk calculus so they seek greener pastures elsewhere.\u201d

The layered approach should include phishing detection, two-factor authentication, end-to-end encryption, patch management and password management, Limbago explains. \u201cThese protections stop the majority of attacks and force attackers to use more sophisticated means, which may be out of their technical reach.\u201d
","saveContent":"The recent data breach at the Los Angeles County Department of Health Services demonstrates the risk that hired third-party vendors pose to healthcare organizations.

The phishing attack at the Los Angeles agency compromised the health information of 14,600 persons.

While many providers continue to leave themselves open to attack by not using appropriate security controls, the controls are comprised if appropriate policies are not in place, says Andrea Limbago, chief social scientist at Virtru, a data encryption vendor. \u201cEnd-to-end encryption would have made the attack more difficult to pull off, and therefore may have deterred the attacker,\u201d Limbago explains.

But because the attack occurred through phishing, it is impossible to say it could have been prevented. Overall, a greater focus on combining data encryption with access controls that evolve over time would have enabled revocation of the data, which could have minimized the amount of data that was compromised.\u201d

Also See:<\/b> Providers not using encryption enough for data in the cloud<\/a>

Because providers generally have multiple partners with each other and vendors, they need to learn how to mitigate risks that accompany third-party data access.

Healthcare providers should not assume other parties will protect their data, so they should implement a strategy that provides greater control of the data even after it leaves their own network, Limbago notes.

\u201cThis includes protections that are bound to the data, such as encryption, while also ensuring the security program is usable across the workforce. Employees will find a means to circumvent a security safeguard if it limits their ability to do their job, so any security solution must work within business workflows.\u201d

There are programs available to providers to increase employee awareness of phishing and other tools such as automated phishing detection software. Again, however, caution rules, she warns. \u201cMany of today\u2019s phishing attacks look extremely legitimate and fool even the most savvy information security professionals. A layered defense can protect data and alter an attacker\u2019s risk calculus so they seek greener pastures elsewhere.\u201d

The layered approach should include phishing detection, two-factor authentication, end-to-end encryption, patch management and password management, Limbago explains. \u201cThese protections stop the majority of attacks and force attackers to use more sophisticated means, which may be out of their technical reach.\u201d
","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

How a layered data security strategy helps providers stay safer

More for you