How to Be Proactive About Operational Resilience and Incident Response
At the recent 2024 HIMSS Global Health Conference & Exhibition, held in mid-March, Access Point Consulting CEO Geoff Hancock moderated a panel titled, "How to Be Proactive About Operational Resilience and Incident Response." Joined on the panel by Jeff Ulanet, CFO and CTO of Atlas Health; and Rick Leib, CISO, Client Services of Access Point Consulting, Hancock led a discussion that centered on why resilience is such a critical quality in the cybersecurity and business continuity practices of a healthcare organization, and how practitioners can design programs and work with executive management to achieve the necessary resilience.
Hancock began the discussion by setting the stage -- cyber attacks and intrusions are on a growth trajectory, becoming more numerous and more severe. For healthcare organizations the grim reality is that an intruder will, at some point, be successful penetrating the perimeter. At that point, the emphasis shifts to surviving, minimizing the damage of, and responding to that attack -- to being a resilient organization.
The Look of Resilience
Leib began talking about what a resilient organization does -- quickly recognizing that an intrusion has occurred and responding to the incident with actions that are carefully developed and rigorously rehearsed. To be effective, he said, requires thinking beyond normal cybersecurity limits. "It goes beyond cyber simple cyber security measures -- goes beyond firewalls, goes beyond access controls. It goes much deeper into actually understanding your assets and your business impact analyses," he explained.
Given that definition, Hancock asked, how should companies go about making themselves resilient? Leib began by talking about performing gap analysis: Looking at the difference between the actions, procedures, and technologies that regulations require and those that the organization has deployed. It is, Leib said, critical for companies to be in regulatory compliance. Getting into compliance, he noted, can help an organization understand the assets (both infrastructure and data) that they have in place, and which assets require protection.
Coming into compliance, Leib explained, involves having a plan to respond to attacks on critical and important assets, and that plan will require the approval and involvement of the C-suite. Executive approval is required because of the investment in time and money required to put the plan into action. And executive involvement is required because the response will necessarily go beyond the organizational limits of any single department or workgroup -- it will require a culture of resilience that spreads across the entire organization.
Ulanet added that, in healthcare, many questions about data security and resilience are coming from their customers who want to know that their very sensitive data has been protected from loss and that the healthcare has protected itself from interruptions to clinical care. And these customers don’t simply want reassuring words -- they want evidence that the organization has demonstrated its programs for resilience.
Protecting Intelligence
One of the new areas of concern is with the security and reliability of data used to train AI models. Ulanet explained the nature, and scale, of the issue. "We've seen examples of ML and AI that's been manipulated to produce a false outcome," he said. "Imaging is an example of things that never took place in the real world but took place inside a machine. Just extrapolate that to a clinical outcome and you can see the danger that's apparent." Complicating the issue is that, "…the danger could be from within, cultural bias or some other form of bias, or it could come from the outside ,the data source itself, or the way the ingestion point of that data works. It's a much more complex vector than I think we've ever faced."
Hancock pointed out that a framework for ensuring data integrity has existed for years, developed by NIST at the behest of a national cybersecurity directive. There has been, however, a huge gulf between having a framework available for use and having a framework that is actually put to use by healthcare organizations. These companies must, he explained, treat their data and their incident response plans and procedures the way that resilience plans for national critical infrastructure should be treated.
Among the important components of those plans, Leib said, are the anomaly detection products and processes that now must extend beyond the traditional network scope to include cloud applications and infrastructure. Both the scope of the problem and its importance have increased as organizations depend on the cloud for more and more tasks.
Experience Matters
The discussion ultimately found its way to the need for experienced managers to guide the development of resilience plans. These experienced CISOs can be difficult to find and afford, especially for smaller or younger organizations. The three participants agreed that the "V-CISO", or virtual CISO engaged from a consulting firm, can be a very good solution for these smaller organizations that can't afford a full-time, permanent CISO. Even with someone in the CISO role, they noted, the V-CISO can help coach and mentor the organization's CISO while they grow in the role.
There is no question, though, that an effective resilience plan is an expense for the organization, sometimes a substantial expense. The question is not to weigh the cost of the program against not investing, it is to weigh the cost of the resilience program against the cost to the organization of a cybersecurity (or data integrity) incident with no resilience program in place. In that light, resilience is considerably less costly.
.png)
Trending Articles & Security Reports
Patch Updates, New Malware Threats, and the Ongoing Supply Chain Battle
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
Ransomware Readiness: Navigating the Threat to Your Business
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Penetration Testing vs. Red Teaming
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Understanding and Managing Supply Chain Risk (with Michael Caruso)
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
