Per the theme of security assessment I’ve been posting about, part of crafting a multi-year security roadmap is examining technologies and practices that have limited use in healthcare but are widely deployed in other industries.
Application Security Testing – Vendor applications including those with FDA 510k approval may have security vulnerabilities. Testing third party products with source code analysis tools can find defects that are missed by traditional vulnerability scanning software. Related to Application testing is third party vendor management. Testing and verifying the security of cloud hosted service providers and business associates is becoming a best practice.
Data Loss Prevention – Although many healthcare organizations have strict policies on the use of email, social networking, cloud storage, remote access, and mobile devices, it’s increasingly import to have technology in place that enforces policies, preventing users from violating policy by sending data to non-secured locations i.e. sending patient information to a referring clinician who uses Gmail. Many vendors offer appliances that quarantine, notify, restrict, and manage the flow of email containing person identified information/protected healthcare information. Related to DLP is a strategy to prevent use of unencrypted storage devices – thumb drives, DVDs, CDs etc.
Adaptive Authentication – Critical applications, including email, enterprise resource planning, and clinical applications deserve increased authentication rigor. For example, if a user is not typically outside the US and suddenly logs in from an unexpected location, then the user should be challenged with an additional factor. Approaches could include a secret question or a one time PIN code sent to a known cell phone. Such applications can also perform a risk analysis of authentication events to detect anomalies, including authentication events using compromised accounts and suspect IP addresses.
As with other posts on such topics, I look forward to comments about your plans and experiences in these areas.
In addition to his CIO role at BIDMC, Dr. Halamka blogs at GeekDoctor.blogspot.com.
