Chief information security officers (CISOs) at healthcare organizations are facing a number of security threats and challenges, including an increase in ransomware and other cyberattacks targeting the information systems at patient care organizations. Hussein Syed, CISO at the West Orange, N.J.-based RWJBarnabas Health, an integrated healthcare system in New Jersey, is acutely aware of these challenges and the need to use new processes and tools to adequately mitigate the risks of data breaches and ransomware attacks.
“Today’s hackers operate as professional organizations, meaning they do a lot of planning and diligence before executing attacks. This means healthcare organizations must be equally proactive and thoughtful in how we assess the security of our organizations,” Syed said back in February during the announcement of a healthcare security readiness program developed by VMWare and Intel Health and Life Sciences.
RWJBarnabas Health was an early participant in the VMWare/Intel healthcare security readiness program, which offers healthcare organizations free assessments to benchmark the organization’s security maturity, priorities and capabilities against their peers. According to Syed, the assessment tool provides valuable insight into the organization’s security posture compared to other healthcare organizations when it comes to breach mitigation in order to identify and implement solutions to further reduce risks. RWJBarnabas health was formed last year as the result of a merger of Barnabas Health and Robert Wood Johnson Health System. The health system, with a service area covering five million people, consists of 11 acute care hospitals, three acute care children’s hospitals, ambulatory care centers and geriatric centers
During the HIMSS17 Conference in Orlando, Syed, who has been in the CISO role at RWJBarnabas for two years, spoke with Healthcare Informatics Assistant Editor Heather Landi about how the threat landscape in healthcare has changed and the steps that RWJBarnabas Health is taking to combat cybersecurity threats and challenges in this evolving environment. Below are excerpts from that interview.
Leading up to the HIMSS17 conference, what were you interested in seeing?
I came here with a pretty open mind. This is a different conference for me [compared to the RSA Conference in San Francisco, a cybersecurity conference] because I’m not walking up to a booth thinking that they are selling security technologies. I walk into the HP booth and they are talking about imaging and after a little conversation, they say, ‘we also use these technologies, such as encryption, to provide security to the solutions as well.’ The paradigm has slightly shifted. [The health IT vendors] talk about how to do the security and meet HIPAA [Health Insurance Portability and Accountability Act] security requirements. A couple of years ago we would laugh when vendors would say ‘our products are HIPAA compliant.’ Nothing is HIPAA compliant unless you configure it to be HIPAA compliant. That’s changed as vendors now say ‘this product is designed to meet HIPAA compliance requirements.’
Hussein Syed
The healthcare market has changed; it’s not just HIPAA anymore. Five or six years ago, people worried about HIPAA. Now I’ve seen, last year, there were about 16 to 17 major ransomware challenges that the healthcare market had to face and they ranged from small health systems to large ones. And you can say that the smaller ones are not doing their job and that’s why they got infected, but it’s just the luck of the draw where there was a small gap and somebody was able to infiltrate and get through and encrypt the data. Anybody can be a victim, no one is safe from that anymore.
For healthcare CISOs, what are the top priorities right now?
Right now, we’re looking very carefully around how to build our environment to be safe, to be protected from risk. That’s a big challenge, and most organizations have gone through the basics stuff, such as malware protection, locking down the USB ports and email encryption and email filtering/spam protection solutions. So they’re well on the road to have a basic infrastructure in place. Now you need to go to the next level, because the threat landscape is changing. You can start looking at the predictions that analysts are making about what you should worry about for next year. And you can look at all those things and map everything with what you have, with the cybersecurity frameworks that you have adopted, and check off what’s there and what’s not there and evaluate where you can make a better mark.
What are the steps that RWJBarnabas is taking to enhance information security?
We have zeroed in on a number of things that we need to focus on in 2017. One thing we have to do is we have to get a very good handle on access management. And, I’m not just talking about the user accounts, I’m talking about the whole life cycle of user predicting and intelligence around the use of those credentials, such as, when do people log in and log off, what do they do, what is their behavior, so we get a picture and understand a user’s normal behavior. We’re also looking at collecting all those data around user access so we can quickly identify threats. Secondly, we’re serious about overlaying it with multiple factor authentication, whether it’s single sign-on or two-factor authentication.
In order to improve security controls to prevent breaches, we also are focused on implementing micro-segmentation of networks and installing new DDoS and web application firewalls. With regarding to segmenting the environment, traditionally healthcare networks got built and those environments grew and people created bigger networks and there is a misunderstanding where IT folks think that VLAN is segmenting the environment; it’s segmenting it from a routing and switching perspective. You actually have to segment the environment by using firewall technology or micro-segmenting, that way you have multiple environments in the same virtualized chassis or same network, but they are separate from each other so one doesn’t know the other exists and problems here don’t bleed over to the other side. That is an active project, starting Q2, to work out a very strong micro-segmentation strategy and implementation.
The other area that we have focused on is identifying where our structured and unstructured data is and locking it down. It’s easier to lock down structured data because sits in a database and it’s known to people and what we look at there is privileged account management—who has access to it, how are they accessing it, how often do they access sit, what type of data do they extract from that system and where do they put it? We are working to further secure the databases by using database activity monitoring so that we can create a profile and then if there is a change in that profile, we are making sure that we are notified and alerted and protecting that. In addition to that, what we want to do is have an inventory of unstructured data is so we can encrypt that environment. Traditionally, we have mobile devices, laptops, desktops, but now we’re focusing on encrypting databases and encrypting file shares and tying it to the data and access management that we have. So the user who needs to have access to that data is the only one who can de-crypt that data, nobody else. So if that data is exfiltrated or stolen, it’s encrypted data and it’s protected. And there are two benefits with that—one, we have fewer people looking at that data, and second, if it is accessed, it’s only for legitimate reasons.
Insider data breaches are an ongoing challenge. What are you doing to address that challenge?
We are focused heavily on creating awareness about threats, about breaches, about infiltrations, and where things can happen, creating awareness that even if it’s not a breach, it could be disruptive to the environment. We are focused on training to educate users, including phishing exercises and internal webinars. If a department is having a meeting, even if it’s only three to four minutes where we can come in and talk about [cybersecurity], it helps to keep it fresh in [employees’] minds and creates better awareness.
As you mentioned ransomware and other cyberattacks are a growing threat to healthcare organizations. What are you doing to mitigate that risk?
It’s a patient safety issue, it’s a revenue management issue, it’s a reputational issue and it’s a huge expense issue too, so what we have done is we have blocked all servers to be allowed to go to the internet and we have removed access for everybody to download any software. If a user needs software downloaded, then they go into a quarantine state, download it, un-package it, run it through protection to make sure it’s clean before it’s allowed to be installed. We’re actively removing administrative rights from workstations. For outbound Internet traffic, we have implemented proxies so every traffic that leaves our network has to be authenticated traffic. We also block almost all the categories around software downloads, spyware and questionable sites, and we’ve logged anything that is not categorized. So, for example, we have 110 categories of business, and for websites not categorized, it blocks it. The user then fills out a form providing the business reason they need to go to this website and that form goes to our one of our security analysts to review it. If feel that it is a legitimate website with no threat, they will permit it, otherwise the security analyst will write back, ‘These are the reasons you are blocked, it’s not the website that you are trying to go to, it’s a phishing website.’ And we’ll educate our users to Google the business and then pull up their website rather than type in the domain name provide in the email. And sometimes you’ll get this email from the users saying, ‘wow, that’s how creative [cybercriminals] are, and then they’ll go home and tell their family about this, so it’s helping to educate others.
